Get a Dependabot alert | Sample

3 parameters

ownerstringrequired

The account owner of the repository; the name is not case sensitive.

repostringrequired

The repository name without the `.git` extension; the name is not case sensitive.

alert_numberintegerrequired

The integer identifying the Dependabot alert in the repository.

5 status codes

200Returns a Dependabot alert object containing its number and state, vulnerable dependency, security advisory, security vulnerability, resource URLs, timestamps, and dismissal or fix details.

numberintegerrequired

The security alert number.

statestringrequired

The state of the Dependabot alert.

Allowed:auto_dismisseddismissedfixedopen

dependencyobjectrequired

Details for the vulnerable dependency.

security_advisoryobjectrequired

Details for the GitHub Security Advisory.

security_vulnerabilityobjectrequired

Details pertaining to one vulnerable version range for the advisory.

urlstringrequired

The REST API URL of the alert resource.

html_urlstringrequired

The GitHub URL of the alert resource.

created_atstringrequired

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

updated_atstringrequired

The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_atstringrequired

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_byobjectrequired

A GitHub user.

dismissed_reasonstringrequired

The reason that the alert was dismissed.

Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk

dismissed_commentstringrequired

An optional comment associated with the alert's dismissal.

fixed_atstringrequired

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

auto_dismissed_atstringoptional

The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissal_requestobjectoptional

Information about an active dismissal request for this Dependabot alert.

assigneesarray<SimpleUser>optional

The users assigned to this alert.

304Returned when the alert has not changed since the request's conditional version.

403Returned when the authenticated user or token does not have permission to access security alerts for the repository.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

404Returned when the specified repository or Dependabot alert does not exist.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

410Returned when the requested alert resource is no longer available.

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

Error handling

A 403 is returned when the token lacks access to security alerts or the required scope. A 404 is returned when the repository or alert_number cannot be found, and a 410 is returned when the alert resource is no longer available. alert_number must be an integer identifying a Dependabot alert in the specified repository.

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.alerts.get({
  owner: "octocat",
  repo: "hello-world",
  alertNumber: "example",
});

{
  "number": 1,
  "state": "open",
  "dependency": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "manifest_path": "path/to/requirements.txt",
    "scope": "runtime",
    "relationship": "direct"
  },
  "security_advisory": {
    "ghsa_id": "GHSA-8f4m-hccc-8qph",
    "cve_id": "CVE-2021-20191",
    "summary": "Insertion of Sensitive Information into Log File in ansible",
    "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.",
    "vulnerabilities": [
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.9.0, < 2.9.18",
        "first_patched_version": {
          "identifier": "2.9.18"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": "< 2.8.19",
        "first_patched_version": {
          "identifier": "2.8.19"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.10.0, < 2.10.7",
        "first_patched_version": {
          "identifier": "2.10.7"
        }
      }
    ],
    "severity": "medium",
    "cvss": {
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "score": 5.5
    },
    "cvss_severities": {
      "cvss_v3": {
        "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "score": 5.5
      },
      "cvss_v4": {
        "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "score": 8.5
      }
    },
    "epss": {
      "percentage": 0.00045,
      "percentile": 0.16001
    },
    "cwes": [
      {
        "cwe_id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      }
    ],
    "identifiers": [
      {
        "type": "GHSA",
        "value": "GHSA-8f4m-hccc-8qph"
      },
      {
        "type": "CVE",
        "value": "CVE-2021-20191"
      }
    ],
    "references": [
      {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191"
      },
      {
        "url": "https://access.redhat.com/security/cve/cve-2021-20191"
      },
      {
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
      }
    ],
    "published_at": "2021-06-01T17:38:00Z",
    "updated_at": "2021-08-12T23:06:00Z",
    "withdrawn_at": null
  },
  "security_vulnerability": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "severity": "medium",
    "vulnerable_version_range": "< 2.8.19",
    "first_patched_version": {
      "identifier": "2.8.19"
    }
  },
  "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1",
  "html_url": "https://github.com/octocat/hello-world/security/dependabot/1",
  "created_at": "2022-06-14T15:21:52Z",
  "updated_at": "2022-06-14T15:21:52Z",
  "dismissed_at": null,
  "dismissed_by": null,
  "dismissed_reason": null,
  "dismissed_comment": null,
  "fixed_at": null,
  "assignees": [
    {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    }
  ]
}

Request

Response

Errors