Secret scanning

Enterprise Cloud

Enterprise Server 3.10

Enterprise Server 3.11

Enterprise Server 3.6

Enterprise Server 3.7

Enterprise Server 3.8

Enterprise Server 3.9

Free, Pro, & Team

GitHub AE

REST API

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Help us make these docs great!

Actions

Enter a search term to find it in the GitHub Docs.

Secret scanning - GitHub AE Docs

Use the REST API to retrieve and update secret alerts from a repository.

Quickstart

Comparing GitHub's APIs

Resources in the REST API

Rate limits

Media types

Authenticating

Keeping API credentials secure

Troubleshooting

Libraries

Issue event types

GitHub event types

Endpoints for GitHub App installation tokens

Endpoints for GitHub App user tokens

Permissions for GitHub Apps

Overview

Using the API

Script with JavaScript

Script with Ruby

Discover resources for a user

Delivering deployments

Rendering data as graphs

Working with comments

Pagination

Building a CI server

Best practices

Get started - Git database

Get started - Checks

Encrypt secrets

Guides

Artifacts

Permissions

Secrets

Self-hosted runner groups

Self-hosted runners

Workflow jobs

Workflow runs

Workflows

Events

Feeds

Notifications

Starring

Watching

Activity

GitHub Apps

Installations

OAuth Authorizations

Webhooks

Apps

Branches

Protected branches

Check Runs

Check Suites

Checks

Code Scanning

Codes of conduct

Collaborators

Invitations

Commits

Commit comments

Commit statuses

Deploy keys

Deployment branch policies

Deployments

Environments

Deployment statuses

Emojis

Admin stats

Announcement

Audit log

Global Webhooks

License

Organizations

Pre-receive Environments

Users

Enterprise administration

Gists

Comments

Blobs

References

Trees

Git database

Gitignore

Issues

Assignees

Labels

Milestones

Timeline

Licenses

Markdown

Statistics

Metrics

Migrations

Members

Outside Collaborators

Pages

Boards

Cards

Columns

Project boards

Pulls

Review comments

Review requests

Reviews

Rate limit

Reactions

Releases

Release Assets

Autolinks

Forks

Git LFS

Repositories

Search

Teams

Discussion comments

Discussions

External groups

Followers

GPG Keys

Git SSH Keys

https://web.archive.org/web/20231124065718/https://api.github.com/repos/octocat/Hello-World/contents/{+path}

Hello-World

Lists secret scanning alerts for eligible repositories in an enterprise, from newest to oldest.
To use this endpoint, you must be a member of the enterprise, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope. Alerts are only returned for organizations in the enterprise for which you are an organization owner or a <a href="https://docs.github.com/github-ae@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization">security manager</a>.

The slug version of the enterprise name. You can also substitute this value with the enterprise id.

enterprise

Set to <code>open</code> or <code>resolved</code> to only list secret scanning alerts in a specific state.

state

A comma-separated list of secret types to return. By default all secret types are returned.
See "<a href="https://docs.github.com/github-ae@latest/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security">Secret scanning patterns</a>"
for a complete list of secret types.

secret_type

A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are <code>false_positive</code>, <code>wont_fix</code>, <code>revoked</code>, <code>pattern_edited</code>, <code>pattern_deleted</code> or <code>used_in_tests</code>.

resolution

The property to sort the results by. <code>created</code> means when the alert was created. <code>updated</code> means when the alert was updated or resolved.

sort

The direction to sort the results by.

direction

The number of results per page (max 100).

per_page

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results before this cursor.

before

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results after this cursor.

after

A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are <code>active</code>, <code>inactive</code>, and <code>unknown</code>.

validity

List secret scanning alerts for an enterprise

Lists secret scanning alerts for an eligible repository, from newest to oldest. To use this endpoint, you must be an administrator for the repository or organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
GitHub Apps must have the <code>secret_scanning_alerts</code> read permission to use this endpoint.

The account owner of the repository. The name is not case sensitive.

owner

The name of the repository without the <code>.git</code> extension. The name is not case sensitive.

repo

Page number of the results to fetch.

page

Repository is public or secret scanning is disabled for the repository

List secret scanning alerts for a repository

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

The REST API URL of the code locations for this alert.

**Required when the `state` is `resolved`.** The reason for resolving the alert.

The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

The type of secret that secret scanning detected.

Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.

The token status as of the latest validity check.

Gets a single secret scanning alert detected in an eligible repository. To use this endpoint, you must be an administrator for the repository or organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
GitHub Apps must have the <code>secret_scanning_alerts</code> read permission to use this endpoint.

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the <code>number</code> field in the response from the <code>GET /repos/{owner}/{repo}/code-scanning/alerts</code> operation.

alert_number

Repository is public, or secret scanning is disabled for the repository, or the resource is not found

Get a secret scanning alert

Sets the state of the secret scanning alert. You must provide <code>resolution</code> when you set the state to <code>resolved</code>.

Required when the <code>state</code> is <code>resolved</code>. The reason for resolving the alert.

An optional comment when closing an alert. Cannot be updated or deleted. Must be <code>null</code> when changing <code>state</code> to <code>open</code>.

resolution_comment

Updates the status of a secret scanning alert in an eligible repository. To use this endpoint, you must be an administrator for the repository or organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
GitHub Apps must have the <code>secret_scanning_alerts</code> write permission to use this endpoint.

Bad request, resolution comment is invalid or the resolution was not changed.

State does not match the resolution or resolution comment

Update a secret scanning alert

https://web.archive.org/web/20231124065718/https://api.github.com/repos/octocat/Hello-World/issues/1347

List of locations where the secret was detected

Lists all locations for a given secret scanning alert for an eligible repository. To use this endpoint, you must be an administrator for the repository or organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
GitHub Apps must have the <code>secret_scanning_alerts</code> read permission to use this endpoint.

List locations for a secret scanning alert