List Dependabot alerts for an organization

Lists Dependabot alerts for an organization.

To use this endpoint, you must be an owner or security manager for the organization, and you must use an access token with the repo scope or security_events scope.

For public repositories, you may instead use the public_repo scope.

GitHub Apps must have Dependabot alerts read permission to use this endpoint.

[ { "created_at": "2019-08-24T14:15:22Z", "dependency": { "manifest_path": "string", "package": { "ecosystem": "string", "name": "string" }, "scope": "development" }, "dismissed_at": "2019-08-24T14:15:22Z", "dismissed_by": { "avatar_url": "https://github.com/images/error/octocat_happy.gif", "email": "string", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "gravatar_id": "41d064eb2195891e12d0413f63227ea7", "html_url": "https://github.com/octocat", "id": 1, "login": "octocat", "name": "string", "node_id": "MDQ6VXNlcjE=", "organizations_url": "https://api.github.com/users/octocat/orgs", "received_events_url": "https://api.github.com/users/octocat/received_events", "repos_url": "https://api.github.com/users/octocat/repos", "site_admin": true, "starred_at": "\"2020-07-09T00:17:55Z\"", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "type": "User", "url": "https://api.github.com/users/octocat" }, "dismissed_comment": "string", "dismissed_reason": "fix_started", "fixed_at": "2019-08-24T14:15:22Z", "html_url": "http://example.com", "number": 0, "repository": { "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}", "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}", "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}", "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}", "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}", "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}", "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}", "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}", "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}", "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors", "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments", "description": "This your first repo!", "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads", "events_url": "https://api.github.com/repos/octocat/Hello-World/events", "fork": true, "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks", "full_name": "octocat/Hello-World", "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}", "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}", "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}", "hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks", "html_url": "https://github.com/octocat/Hello-World", "id": 1296269, "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}", "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}", "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}", "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}", "labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}", "languages_url": "https://api.github.com/repos/octocat/Hello-World/languages", "merges_url": "https://api.github.com/repos/octocat/Hello-World/merges", "milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}", "name": "Hello-World", "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5", "notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}", "owner": { "avatar_url": "https://github.com/images/error/octocat_happy.gif", "email": "string", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "gravatar_id": "41d064eb2195891e12d0413f63227ea7", "html_url": "https://github.com/octocat", "id": 1, "login": "octocat", "name": "string", "node_id": "MDQ6VXNlcjE=", "organizations_url": "https://api.github.com/users/octocat/orgs", "received_events_url": "https://api.github.com/users/octocat/received_events", "repos_url": "https://api.github.com/users/octocat/repos", "site_admin": true, "starred_at": "\"2020-07-09T00:17:55Z\"", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "type": "User", "url": "https://api.github.com/users/octocat" }, "private": true, "pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}", "releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}", "stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers", "statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}", "subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers", "subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription", "tags_url": "https://api.github.com/repos/octocat/Hello-World/tags", "teams_url": "https://api.github.com/repos/octocat/Hello-World/teams", "trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}", "url": "https://api.github.com/repos/octocat/Hello-World" }, "security_advisory": { "cve_id": "string", "cvss": { "score": 0, "vector_string": "string" }, "cwes": [ { "cwe_id": "string", "name": "string" } ], "description": "string", "ghsa_id": "string", "identifiers": [ { "type": "CVE", "value": "string" } ], "published_at": "2019-08-24T14:15:22Z", "references": [ { "url": "http://example.com" } ], "severity": "low", "summary": "string", "updated_at": "2019-08-24T14:15:22Z", "vulnerabilities": [ { "first_patched_version": { "identifier": "string" }, "package": { "ecosystem": "string", "name": "string" }, "severity": "low", "vulnerable_version_range": "string" } ], "withdrawn_at": "2019-08-24T14:15:22Z" }, "security_vulnerability": { "first_patched_version": { "identifier": "string" }, "package": { "ecosystem": "string", "name": "string" }, "severity": "low", "vulnerable_version_range": "string" }, "state": "dismissed", "updated_at": "2019-08-24T14:15:22Z", "url": "http://example.com" } ]

Request

Path Params

org

string

required

The organization name. The name is not case sensitive.

Query Params

state

string

optional

A comma-separated list of states. If specified, only alerts with these states will be returned.

Can be: dismissed, fixed, open

severity

string

optional

A comma-separated list of severities. If specified, only alerts with these severities will be returned.

Can be: low, medium, high, critical

ecosystem

string

optional

A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.

Can be: composer, go, maven, npm, nuget, pip, pub, rubygems, rust

package

string

optional

A comma-separated list of package names. If specified, only alerts for these packages will be returned.

scope

string

optional

The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.

sort

string

optional

The property by which to sort the results.
created means when the alert was created.
updated means when the alert's state last changed.

direction

string

optional

The direction to sort the results by.

before

string

optional

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor.

after

string

optional

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor.

first

integer

optional

Deprecated. The number of results per page (max 100), starting from the first matching result.
This parameter must not be used in combination with last.
Instead, use per_page in combination with after to fetch the first page of results.

last

integer

optional

Deprecated. The number of results per page (max 100), starting from the last matching result.
This parameter must not be used in combination with first.
Instead, use per_page in combination with before to fetch the last page of results.

per_page

integer

optional

The number of results per page (max 100).

Responses

🟢200Response

application/json

Body

array of:

created_at

string <date-time>

read-onlyrequired

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dependency

object

read-onlyrequired

Details for the vulnerable dependency.

manifest_path

string

read-onlyoptional

The full path to the dependency manifest file, relative to the root of the repository.

package

object (dependabot-alert-package)

read-onlyoptional

Details for the vulnerable package.

scope

enum<string> | enum<null>

read-onlyoptional

The execution scope of the vulnerable dependency.

Allowed values:

developmentruntime

dismissed_at

string <date-time> | null

read-onlyrequired

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dismissed_by

object (Simple User) | null

required

A GitHub user.

avatar_url

string <uri>

required

Example:

https://github.com/images/error/octocat_happy.gif

string | null

optional

events_url

string

required

Example:

https://api.github.com/users/octocat/events{/privacy}

followers_url

string <uri>

required

Example:

https://api.github.com/users/octocat/followers

following_url

string

required

Example:

https://api.github.com/users/octocat/following{/other_user}

gists_url

string

required

Example:

https://api.github.com/users/octocat/gists{/gist_id}

gravatar_id

string | null

required

Example:

41d064eb2195891e12d0413f63227ea7

html_url

string <uri>

required

Example:

https://github.com/octocat

integer

required

Example:

string

required

Example:

octocat

name

string | null

optional

node_id

string

required

Example:

MDQ6VXNlcjE=

organizations_url

string <uri>

required

Example:

https://api.github.com/users/octocat/orgs

received_events_url

string <uri>

required

Example:

https://api.github.com/users/octocat/received_events

repos_url

string <uri>

required

Example:

https://api.github.com/users/octocat/repos

site_admin

boolean

required

starred_at

string

optional

Example:

"2020-07-09T00:17:55Z"

starred_url

string

required

Example:

https://api.github.com/users/octocat/starred{/owner}{/repo}

subscriptions_url

string <uri>

required

Example:

https://api.github.com/users/octocat/subscriptions

type

string

required

Example:

User

url

string <uri>

required

Example:

https://api.github.com/users/octocat

dismissed_comment

string | null

required

An optional comment associated with the alert's dismissal.

<= 280 characters

dismissed_reason

enum<string> | enum<null>

required

The reason that the alert was dismissed.

Allowed values:

fix_startedinaccurateno_bandwidthnot_usedtolerable_risk

fixed_at

string <date-time> | null

read-onlyrequired

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

html_url

string <uri>

read-onlyrequired

The GitHub URL of the alert resource.

number

integer

read-onlyrequired

The security alert number.

repository

object (Simple Repository)

required

A GitHub repository.

archive_url

string

required

A template for the API URL to download the repository as an archive.

Example:

https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}

assignees_url

string

required

A template for the API URL to list the available assignees for issues in the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/assignees{/user}

blobs_url

string

required

A template for the API URL to create or retrieve a raw Git blob in the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}

branches_url

string

required

A template for the API URL to get information about branches in the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/branches{/branch}

collaborators_url

string

required

A template for the API URL to get information about collaborators of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}

comments_url

string

required

A template for the API URL to get information about comments on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/comments{/number}

commits_url

string

required

A template for the API URL to get information about commits on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/commits{/sha}

compare_url

string

required

A template for the API URL to compare two commits or refs.

Example:

https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}

contents_url

string

required

A template for the API URL to get the contents of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/contents/{+path}

contributors_url

string <uri>

required

A template for the API URL to list the contributors to the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/contributors

deployments_url

string <uri>

required

The API URL to list the deployments of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/deployments

description

string | null

required

The repository description.

Example:

This your first repo!

downloads_url

string <uri>

required

The API URL to list the downloads on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/downloads

events_url

string <uri>

required

The API URL to list the events of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/events

fork

boolean

required

Whether the repository is a fork.

forks_url

string <uri>

required

The API URL to list the forks of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/forks

full_name

string

required

The full, globally unique, name of the repository.

Example:

octocat/Hello-World

git_commits_url

string

required

A template for the API URL to get information about Git commits of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}

git_refs_url

string

required

A template for the API URL to get information about Git refs of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}

git_tags_url

string

required

A template for the API URL to get information about Git tags of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}

hooks_url

string <uri>

required

The API URL to list the hooks on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/hooks

html_url

string <uri>

required

The URL to view the repository on GitHub.com.

Example:

https://github.com/octocat/Hello-World

integer

required

A unique identifier of the repository.

Example:

1296269

issue_comment_url

string

required

A template for the API URL to get information about issue comments on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}

issue_events_url

string

required

A template for the API URL to get information about issue events on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/issues/events{/number}

issues_url

string

required

A template for the API URL to get information about issues on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/issues{/number}

keys_url

string

required

A template for the API URL to get information about deploy keys on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/keys{/key_id}

labels_url

string

required

A template for the API URL to get information about labels of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/labels{/name}

languages_url

string <uri>

required

The API URL to get information about the languages of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/languages

merges_url

string <uri>

required

The API URL to merge branches in the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/merges

milestones_url

string

required

A template for the API URL to get information about milestones of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/milestones{/number}

name

string

required

The name of the repository.

Example:

Hello-World

node_id

string

required

The GraphQL identifier of the repository.

Example:

MDEwOlJlcG9zaXRvcnkxMjk2MjY5

notifications_url

string

required

A template for the API URL to get information about notifications on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}

owner

object (Simple User)

required

A GitHub user.

private

boolean

required

Whether the repository is private.

pulls_url

string

required

A template for the API URL to get information about pull requests on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/pulls{/number}

releases_url

string

required

A template for the API URL to get information about releases on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/releases{/id}

stargazers_url

string <uri>

required

The API URL to list the stargazers on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/stargazers

statuses_url

string

required

A template for the API URL to get information about statuses of a commit.

Example:

https://api.github.com/repos/octocat/Hello-World/statuses/{sha}

subscribers_url

string <uri>

required

The API URL to list the subscribers on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/subscribers

subscription_url

string <uri>

required

The API URL to subscribe to notifications for this repository.

Example:

https://api.github.com/repos/octocat/Hello-World/subscription

tags_url

string <uri>

required

The API URL to get information about tags on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/tags

teams_url

string <uri>

required

The API URL to list the teams on the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/teams

trees_url

string

required

A template for the API URL to create or retrieve a raw Git tree of the repository.

Example:

https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}

url

string <uri>

required

The URL to get more information about the repository from the GitHub API.

Example:

https://api.github.com/repos/octocat/Hello-World

security_advisory

object (dependabot-alert-security-advisory)

read-onlyrequired

Details for the GitHub Security Advisory.

cve_id

string | null

read-onlyrequired

The unique CVE ID assigned to the advisory.

cvss

object

read-onlyrequired

Details for the advisory pertaining to the Common Vulnerability Scoring System.

cwes

array [object {2}]

read-onlyrequired

Details for the advisory pertaining to Common Weakness Enumeration.

description

string

read-onlyrequired

A long-form Markdown-supported description of the advisory.

ghsa_id

string

read-onlyrequired

The unique GitHub Security Advisory ID assigned to the advisory.

identifiers

array [object {2}]

read-onlyrequired

Values that identify this advisory among security information sources.

published_at

string <date-time>

read-onlyrequired

The time that the advisory was published in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

references

array [object {1}]

read-onlyrequired

Links to additional advisory information.

severity

enum<string>

read-onlyrequired

The severity of the advisory.

Allowed values:

lowmediumhighcritical

summary

string

read-onlyrequired

A short, plain text summary of the advisory.

<= 1024 characters

updated_at

string <date-time>

read-onlyrequired

The time that the advisory was last modified in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

vulnerabilities

array[object (dependabot-alert-security-vulnerability) {4}]

read-onlyrequired

Vulnerable version range information for the advisory.

withdrawn_at

string <date-time> | null

read-onlyrequired

The time that the advisory was withdrawn in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

security_vulnerability

object (dependabot-alert-security-vulnerability)

read-onlyrequired

Details pertaining to one vulnerable version range for the advisory.

state

enum<string>

read-onlyrequired

The state of the Dependabot alert.

Allowed values:

dismissedfixedopen

updated_at

string <date-time>

read-onlyrequired

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

url

string <uri>

read-onlyrequired

The REST API URL of the alert resource.

🔵304304

🟠400400

🟠403403

🟠404404

🟠422422