Sample - GitHub REST API
GET/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations

List locations for a secret scanning alert

Lists all locations for a given secret scanning alert for an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

5 parameters
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
alert_numberintegerrequired
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.
pageintegeroptional
The page number of the results to fetch. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:1
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:30

3 status codes
200Response
typestringoptional
The location type. Because secrets may be found in different types of resources (ie. code, comments, issues, pull requests, discussions), this field identifies the type of resource where the secret was found.
Allowed:commitwiki_commitissue_titleissue_bodyissue_commentdiscussion_titlediscussion_bodydiscussion_commentpull_request_titlepull_request_bodypull_request_commentpull_request_review
detailsobjectoptional
Represents a 'commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.
404Repository is public, or secret scanning is disabled for the repository, or the resource is not found
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional

Error handling

A 404 is returned: Repository is public, or secret scanning is disabled for the repository, or the resource is not found. A 503 is returned: Service unavailable.