Sample - GitHub REST API
PATCH/repos/{owner}/{repo}/dependabot/alerts/{alert_number}

Update a Dependabot alert

Updates the state, dismissal details, assignees, or agent assignment for a Dependabot alert. Supply state to change the alert state or assignees to replace its assignee set; when state is dismissed, also provide dismissed_reason, and use agent_assignment only when assigning an agent bot. The response returns the updated alert, including its current security advisory and assignment-related state.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

3 parameters · 5 body fields
ownerstringrequired
The account owner of the repository; the name is not case sensitive.
repostringrequired
The repository name without the `.git` extension; the name is not case sensitive.
alert_numberintegerrequired
The integer identifying the Dependabot alert in the repository.

Dependabot alert fields to update. Provide at least one of state or assignees; other fields configure dismissal or agent assignment.

statestringrequired
The state of the Dependabot alert. A `dismissed_reason` must be provided when setting the state to `dismissed`.
Allowed:dismissedopen
dismissed_reasonstringoptional
**Required when `state` is `dismissed`.** A reason for dismissing the alert.
Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk
dismissed_commentstringoptional
An optional comment associated with dismissing the alert.
assigneesarray<string>optional
Usernames to assign to this Dependabot Alert. Pass one or more user logins to _replace_ the set of assignees on this alert. Send an empty array (`[]`) to clear all assignees from the alert. To assign an AI agent, include the bot login (for example, `copilot-swe-agent[bot]`).
agent_assignmentobjectoptional
Parameters for AI agent assignment. Only used when an agent bot login is included in `assignees`. Ignored when no agent is being assigned.

7 status codes
200Returns the updated Dependabot alert object containing its number and state, vulnerable dependency, security advisory, security vulnerability, resource URLs, timestamps, and dismissal or fix details.
numberintegerrequired
The security alert number.
statestringrequired
The state of the Dependabot alert.
Allowed:auto_dismisseddismissedfixedopen
dependencyobjectrequired
Details for the vulnerable dependency.
security_advisoryobjectrequired
Details for the GitHub Security Advisory.
security_vulnerabilityobjectrequired
Details pertaining to one vulnerable version range for the advisory.
urlstringrequired
The REST API URL of the alert resource.
html_urlstringrequired
The GitHub URL of the alert resource.
created_atstringrequired
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringrequired
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_atstringrequired
The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_byobjectrequired
A GitHub user.
dismissed_reasonstringrequired
The reason that the alert was dismissed.
Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk
dismissed_commentstringrequired
An optional comment associated with the alert's dismissal.
fixed_atstringrequired
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
auto_dismissed_atstringoptional
The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissal_requestobjectoptional
Information about an active dismissal request for this Dependabot alert.
assigneesarray<SimpleUser>optional
The users assigned to this alert.
400Returned when the request body or a field value fails validation.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
403Returned when the authenticated user does not have access to security alerts for the repository.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Returned when the specified repository or Dependabot alert does not exist.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
409Returned when the requested update conflicts with the current alert state or another operation.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
410Returned when the requested alert resource is no longer available.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Returned when validation fails or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 400 is returned when the request fails validation, while a 403 indicates that the authenticated user lacks access to repository security alerts. A 404 means the repository or alert_number was not found, a 409 indicates a conflicting update, a 410 means the resource is no longer available, and a 422 indicates validation failure or endpoint abuse. Provide at least one of state or assignees; state must be dismissed or open, and a dismissed state requires dismissed_reason.