Sample - GitHub REST API
PATCH/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}

Update a secret scanning alert

Updates the status of a secret scanning alert in an eligible repository.

You can also use this endpoint to assign or unassign an alert to a user who has write access to the repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

3 parameters · 5 body fields
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
alert_numberintegerrequired
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.
statestringrequired
Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
Allowed:openresolved
resolutionstringoptional
**Required when the `state` is `resolved`.** The reason for resolving the alert.
Allowed:false_positivewont_fixrevokedused_in_tests
resolution_commentstringoptional
An optional comment when closing or reopening an alert. Cannot be updated or deleted.
assigneestringoptional
The username of the user to assign to the alert. Set to `null` to unassign the alert.
validitystringoptional
Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override.
Allowed:activeinactive

6 status codes
200Response
numberintegeroptional
The security alert number.
created_atstringoptional
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringoptional
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
urlstringoptional
The REST API URL of the alert resource.
html_urlstringoptional
The GitHub URL of the alert resource.
locations_urlstringoptional
The REST API URL of the code locations for this alert.
statestringoptional
Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
Allowed:openresolved
resolutionstringoptional
**Required when the `state` is `resolved`.** The reason for resolving the alert.
Allowed:false_positivewont_fixrevokedused_in_tests
resolved_atstringoptional
The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
resolved_byobjectoptional
A GitHub user.
resolution_commentstringoptional
An optional comment to resolve an alert.
secret_typestringoptional
The type of secret that secret scanning detected.
secret_type_display_namestringoptional
User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."
providerstringoptional
The provider of the secret that was detected.
provider_slugstringoptional
The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the `providers` or `exclude_providers` parameters.
secretstringoptional
The secret that was detected.
push_protection_bypassedbooleanoptional
Whether push protection was bypassed for the detected secret.
push_protection_bypassed_byobjectoptional
A GitHub user.
push_protection_bypassed_atstringoptional
The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
push_protection_bypass_request_reviewerobjectoptional
A GitHub user.
push_protection_bypass_request_reviewer_commentstringoptional
An optional comment when reviewing a push protection bypass.
push_protection_bypass_request_commentstringoptional
An optional comment when requesting a push protection bypass.
push_protection_bypass_request_html_urlstringoptional
The URL to a push protection bypass request.
validitystringoptional
The token status as of the latest validity check.
Allowed:activeinactiveunknown
publicly_leakedbooleanoptional
Whether the detected secret was publicly leaked.
multi_repobooleanoptional
Whether the detected secret was found in multiple repositories under the same organization or enterprise.
is_base64_encodedbooleanoptional
A boolean value representing whether or not alert is base64 encoded
first_location_detectedobjectoptional
Details on the location where the token was initially detected. This can be a commit, wiki commit, issue, discussion, pull request.
has_more_locationsbooleanoptional
A boolean value representing whether or not the token in the alert was detected in more than one location.
assigned_toobjectoptional
A GitHub user.
closure_request_commentstringoptional
An optional comment from the closure request author.
closure_request_reviewer_commentstringoptional
An optional comment from the closure request reviewer.
closure_request_reviewerobjectoptional
A GitHub user.
metadataarray<object>optional
A list of metadata key/value pairs associated with the secret scanning alert.
400Bad request, resolution comment is invalid or the resolution was not changed.
403Delegated alert dismissal is enabled and the authenticated user is not a valid reviewer.
404Repository is public, or secret scanning is disabled for the repository, or the resource is not found
422State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional

Error handling

A 400 is returned: Bad request, resolution comment is invalid or the resolution was not changed. A 403 is returned: Delegated alert dismissal is enabled and the authenticated user is not a valid reviewer. A 404 is returned: Repository is public, or secret scanning is disabled for the repository, or the resource is not found. A 422 is returned: State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert. A 503 is returned: Service unavailable.