Sample - GitHub REST API
GET/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}

Get a secret scanning alert

Gets a single secret scanning alert detected in an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

4 parameters
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
alert_numberintegerrequired
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.
hide_secretbooleanoptional
A boolean value representing whether or not to hide literal secrets in the results.
Default:false

4 status codes
200Response
numberintegeroptional
The security alert number.
created_atstringoptional
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringoptional
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
urlstringoptional
The REST API URL of the alert resource.
html_urlstringoptional
The GitHub URL of the alert resource.
locations_urlstringoptional
The REST API URL of the code locations for this alert.
statestringoptional
Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
Allowed:openresolved
resolutionstringoptional
**Required when the `state` is `resolved`.** The reason for resolving the alert.
Allowed:false_positivewont_fixrevokedused_in_tests
resolved_atstringoptional
The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
resolved_byobjectoptional
A GitHub user.
resolution_commentstringoptional
An optional comment to resolve an alert.
secret_typestringoptional
The type of secret that secret scanning detected.
secret_type_display_namestringoptional
User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."
providerstringoptional
The provider of the secret that was detected.
provider_slugstringoptional
The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the `providers` or `exclude_providers` parameters.
secretstringoptional
The secret that was detected.
push_protection_bypassedbooleanoptional
Whether push protection was bypassed for the detected secret.
push_protection_bypassed_byobjectoptional
A GitHub user.
push_protection_bypassed_atstringoptional
The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
push_protection_bypass_request_reviewerobjectoptional
A GitHub user.
push_protection_bypass_request_reviewer_commentstringoptional
An optional comment when reviewing a push protection bypass.
push_protection_bypass_request_commentstringoptional
An optional comment when requesting a push protection bypass.
push_protection_bypass_request_html_urlstringoptional
The URL to a push protection bypass request.
validitystringoptional
The token status as of the latest validity check.
Allowed:activeinactiveunknown
publicly_leakedbooleanoptional
Whether the detected secret was publicly leaked.
multi_repobooleanoptional
Whether the detected secret was found in multiple repositories under the same organization or enterprise.
is_base64_encodedbooleanoptional
A boolean value representing whether or not alert is base64 encoded
first_location_detectedobjectoptional
Details on the location where the token was initially detected. This can be a commit, wiki commit, issue, discussion, pull request.
has_more_locationsbooleanoptional
A boolean value representing whether or not the token in the alert was detected in more than one location.
assigned_toobjectoptional
A GitHub user.
closure_request_commentstringoptional
An optional comment from the closure request author.
closure_request_reviewer_commentstringoptional
An optional comment from the closure request reviewer.
closure_request_reviewerobjectoptional
A GitHub user.
metadataarray<object>optional
A list of metadata key/value pairs associated with the secret scanning alert.
304Not modified
404Repository is public, or secret scanning is disabled for the repository, or the resource is not found
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional

Error handling

A 404 is returned: Repository is public, or secret scanning is disabled for the repository, or the resource is not found. A 503 is returned: Service unavailable.