List Dependabot alerts for a repository

You must use an access token with the security_events scope to use this endpoint with private repositories.
You can also use tokens with the public_repo scope for public repositories only.
GitHub Apps must have Dependabot alerts read permission to use this endpoint.

[ { "created_at": "2019-08-24T14:15:22Z", "dependency": { "manifest_path": "string", "package": { "ecosystem": "string", "name": "string" }, "scope": "development" }, "dismissed_at": "2019-08-24T14:15:22Z", "dismissed_by": { "avatar_url": "https://github.com/images/error/octocat_happy.gif", "email": "string", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "gravatar_id": "41d064eb2195891e12d0413f63227ea7", "html_url": "https://github.com/octocat", "id": 1, "login": "octocat", "name": "string", "node_id": "MDQ6VXNlcjE=", "organizations_url": "https://api.github.com/users/octocat/orgs", "received_events_url": "https://api.github.com/users/octocat/received_events", "repos_url": "https://api.github.com/users/octocat/repos", "site_admin": true, "starred_at": "\"2020-07-09T00:17:55Z\"", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "type": "User", "url": "https://api.github.com/users/octocat" }, "dismissed_comment": "string", "dismissed_reason": "fix_started", "fixed_at": "2019-08-24T14:15:22Z", "html_url": "http://example.com", "number": 0, "security_advisory": { "cve_id": "string", "cvss": { "score": 0, "vector_string": "string" }, "cwes": [ { "cwe_id": "string", "name": "string" } ], "description": "string", "ghsa_id": "string", "identifiers": [ { "type": "CVE", "value": "string" } ], "published_at": "2019-08-24T14:15:22Z", "references": [ { "url": "http://example.com" } ], "severity": "low", "summary": "string", "updated_at": "2019-08-24T14:15:22Z", "vulnerabilities": [ { "first_patched_version": { "identifier": "string" }, "package": { "ecosystem": "string", "name": "string" }, "severity": "low", "vulnerable_version_range": "string" } ], "withdrawn_at": "2019-08-24T14:15:22Z" }, "security_vulnerability": { "first_patched_version": { "identifier": "string" }, "package": { "ecosystem": "string", "name": "string" }, "severity": "low", "vulnerable_version_range": "string" }, "state": "dismissed", "updated_at": "2019-08-24T14:15:22Z", "url": "http://example.com" } ]

Request

Path Params

owner

string

required

The account owner of the repository. The name is not case sensitive.

repo

string

required

The name of the repository. The name is not case sensitive.

Query Params

state

string

optional

A comma-separated list of states. If specified, only alerts with these states will be returned.

Can be: dismissed, fixed, open

severity

string

optional

A comma-separated list of severities. If specified, only alerts with these severities will be returned.

Can be: low, medium, high, critical

ecosystem

string

optional

A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.

Can be: composer, go, maven, npm, nuget, pip, pub, rubygems, rust

package

string

optional

A comma-separated list of package names. If specified, only alerts for these packages will be returned.

manifest

string

optional

A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.

scope

string

optional

The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.

sort

string

optional

The property by which to sort the results.
created means when the alert was created.
updated means when the alert's state last changed.

direction

string

optional

The direction to sort the results by.

page

integer

optional

Deprecated. Page number of the results to fetch. Use cursor-based pagination with before or after instead.

per_page

integer

optional

The number of results per page (max 100).

before

string

optional

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor.

after

string

optional

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor.

first

integer

optional

Deprecated. The number of results per page (max 100), starting from the first matching result.
This parameter must not be used in combination with last.
Instead, use per_page in combination with after to fetch the first page of results.

last

integer

optional

Deprecated. The number of results per page (max 100), starting from the last matching result.
This parameter must not be used in combination with first.
Instead, use per_page in combination with before to fetch the last page of results.

Responses

🟢200Response

application/json

Body

array of:

created_at

string <date-time>

read-onlyrequired

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dependency

object

read-onlyrequired

Details for the vulnerable dependency.

manifest_path

string

read-onlyoptional

The full path to the dependency manifest file, relative to the root of the repository.

package

object (dependabot-alert-package)

read-onlyoptional

Details for the vulnerable package.

scope

enum<string> | enum<null>

read-onlyoptional

The execution scope of the vulnerable dependency.

Allowed values:

developmentruntime

dismissed_at

string <date-time> | null

read-onlyrequired

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dismissed_by

object (Simple User) | null

required

A GitHub user.

avatar_url

string <uri>

required

Example:

https://github.com/images/error/octocat_happy.gif

string | null

optional

events_url

string

required

Example:

https://api.github.com/users/octocat/events{/privacy}

followers_url

string <uri>

required

Example:

https://api.github.com/users/octocat/followers

following_url

string

required

Example:

https://api.github.com/users/octocat/following{/other_user}

gists_url

string

required

Example:

https://api.github.com/users/octocat/gists{/gist_id}

gravatar_id

string | null

required

Example:

41d064eb2195891e12d0413f63227ea7

html_url

string <uri>

required

Example:

https://github.com/octocat

integer

required

Example:

string

required

Example:

octocat

name

string | null

optional

node_id

string

required

Example:

MDQ6VXNlcjE=

organizations_url

string <uri>

required

Example:

https://api.github.com/users/octocat/orgs

received_events_url

string <uri>

required

Example:

https://api.github.com/users/octocat/received_events

repos_url

string <uri>

required

Example:

https://api.github.com/users/octocat/repos

site_admin

boolean

required

starred_at

string

optional

Example:

"2020-07-09T00:17:55Z"

starred_url

string

required

Example:

https://api.github.com/users/octocat/starred{/owner}{/repo}

subscriptions_url

string <uri>

required

Example:

https://api.github.com/users/octocat/subscriptions

type

string

required

Example:

User

url

string <uri>

required

Example:

https://api.github.com/users/octocat

dismissed_comment

string | null

required

An optional comment associated with the alert's dismissal.

<= 280 characters

dismissed_reason

enum<string> | enum<null>

required

The reason that the alert was dismissed.

Allowed values:

fix_startedinaccurateno_bandwidthnot_usedtolerable_risk

fixed_at

string <date-time> | null

read-onlyrequired

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

html_url

string <uri>

read-onlyrequired

The GitHub URL of the alert resource.

number

integer

read-onlyrequired

The security alert number.

security_advisory

object (dependabot-alert-security-advisory)

read-onlyrequired

Details for the GitHub Security Advisory.

cve_id

string | null

read-onlyrequired

The unique CVE ID assigned to the advisory.

cvss

object

read-onlyrequired

Details for the advisory pertaining to the Common Vulnerability Scoring System.

cwes

array [object {2}]

read-onlyrequired

Details for the advisory pertaining to Common Weakness Enumeration.

description

string

read-onlyrequired

A long-form Markdown-supported description of the advisory.

ghsa_id

string

read-onlyrequired

The unique GitHub Security Advisory ID assigned to the advisory.

identifiers

array [object {2}]

read-onlyrequired

Values that identify this advisory among security information sources.

published_at

string <date-time>

read-onlyrequired

The time that the advisory was published in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

references

array [object {1}]

read-onlyrequired

Links to additional advisory information.

severity

enum<string>

read-onlyrequired

The severity of the advisory.

Allowed values:

lowmediumhighcritical

summary

string

read-onlyrequired

A short, plain text summary of the advisory.

<= 1024 characters

updated_at

string <date-time>

read-onlyrequired

The time that the advisory was last modified in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

vulnerabilities

array[object (dependabot-alert-security-vulnerability) {4}]

read-onlyrequired

Vulnerable version range information for the advisory.

withdrawn_at

string <date-time> | null

read-onlyrequired

The time that the advisory was withdrawn in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

security_vulnerability

object (dependabot-alert-security-vulnerability)

read-onlyrequired

Details pertaining to one vulnerable version range for the advisory.

state

enum<string>

read-onlyrequired

The state of the Dependabot alert.

Allowed values:

dismissedfixedopen

updated_at

string <date-time>

read-onlyrequired

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

url

string <uri>

read-onlyrequired

The REST API URL of the alert resource.

🔵304304

🟠400400

🟠403403

🟠404404

🟠422422