How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
GitHub

GitHub Scanning API

The Scanning API from GitHub — 11 operation(s) for scanning.

Documentation Provider Profile APIs.io OpenAPI GitHub

GitHub Scanning API is one of 350 APIs that GitHub publishes on the APIs.io network, described by a machine-readable OpenAPI specification and an AsyncAPI event-driven specification.

Tagged areas include Scanning. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an AsyncAPI specification, and an API reference.

This API exposes 15 operations across 11 paths, and defines 77 schemas. It is described by OpenAPI 3.2.0, at version 1.1.4.

Requests are made against 2 base URLs: {protocol}://{hostname}/api/v3, {protocol}://{hostname}.

15 operations 11 paths 77 schemas 1 DELETE11 GET3 PATCH

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.1.4
Base URL
https://api.github.com
Authentication
HTTP Bearer
License
MIT
Terms of Service
View terms
Resource Areas
1

Authentication & Security 1

GitHub Scanning API declares 1 security scheme for authenticating requests. It accepts HTTP bearer tokens (bearerHttpAuthentication).

  • bearerHttpAuthentication — Bearer Token

Paths & Operations 15

Across 11 paths, the API surfaces 15 operations — 1 DELETE, 11 GET, 3 PATCH. Each is listed below with its method, path, parameters, and response codes.

Scanning 15
GET
/orgs/{org}/code-scanning/alerts
GitHub List Code Scanning Alerts for an Organization
listCodeScanningAlertsForAnOrganization 11 params → 200404503
GET
/orgs/{org}/secret-scanning/alerts
GitHub List Secret Scanning Alerts for an Organization
listSecretScanningAlertsForAnOrganization 10 params → 200404503
GET
/repos/{owner}/{repo}/code-scanning/alerts
GitHub List Code Scanning Alerts for Repository
listCodeScanningAlertsForRepository 14 params → 200304403404503
GET
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
GitHub Get Code Scanning Alert
getCodeScanningAlert 6 params → 200304403404503
PATCH
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
GitHub Update Code Scanning Alert
updateCodeScanningAlert 6 params body → 200403404503
GET
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances
GitHub List Instances of Code Scanning Alert
listInstancesOfCodeScanningAlert 9 params → 200403404503
GET
/repos/{owner}/{repo}/code-scanning/analyses
GitHub List Code Scanning Analyses for Repository
listCodeScanningAnalysesForRepository 13 params → 200403404503
GET
/repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}
GitHub Get Code Scanning Analysis for Repository
getCodeScanningAnalysisForRepository 6 params → 200403404503
DELETE
/repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}
GitHub Delete Code Scanning Analysis from Repository
deleteCodeScanningAnalysisFromRepository 7 params → 200400403404503
GET
/repos/{owner}/{repo}/code-scanning/default-setup
GitHub Get Code Scanning Default Setup Configuration
getCodeScanningDefaultSetupConfiguration 5 params → 200403404503
PATCH
/repos/{owner}/{repo}/code-scanning/default-setup
GitHub Update Code Scanning Default Setup Configuration
updateCodeScanningDefaultSetupConfiguration 5 params body → 200202403404409503
GET
/repos/{owner}/{repo}/secret-scanning/alerts
GitHub List Secret Scanning Alerts for Repository
listSecretScanningAlertsForRepository 14 params → 200404503
GET
/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
GitHub Get Secret Scanning Alert
getSecretScanningAlert 6 params → 200304404503
PATCH
/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
GitHub Update Secret Scanning Alert
updateSecretScanningAlert 6 params body → 200400404422503
GET
/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations
GitHub List Locations for Secret Scanning Alert
listLocationsForSecretScanningAlert 8 params → 200404503

Schemas 77

The contract defines 77 schemas that model the data the API accepts and returns. The most detailed are simple-repository (46 properties), simple-user (21 properties), nullable-simple-user (21 properties), nullable-simple-user_3 (21 properties). Each schema is shown below with its type and property counts.

code-scanning-analysis-analysis-key
string
Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
code-scanning-ref
string
The Git reference, formatted as refs/pull/ /merge, refs/pull/ /head, refs/heads/ or simply .
secret-scanning-alert-resolution
stringnull
Required when the state is resolved. The reason for resolving the alert.
code-scanning-alert-state
string
State of a code scanning alert.
alert-created-at
string
The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-alert-instance
object
10 properties
alert-html-url
string
The GitHub URL of the alert resource.
secret-scanning-alert-state
string
Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.
code-scanning-alert-severity
string
Severity of a code scanning alert.
alert-updated-at
string
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-analysis-tool-guid
stringnull
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
code-scanning-alert-rule-summary
object
6 properties
code-scanning-alert-state-query
string
State of a code scanning alert.
simple-user
object
A GitHub user.
21 properties 18 required
organization-secret-scanning-alert
object
18 properties
code-scanning-analysis-tool-name
string
The name of the tool used to generate the code scanning analysis.
code-scanning-analysis-category
string
Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed o…
alert-instances-url
string
The REST API URL for fetching the list of instances for an alert.
simple-repository
object
A GitHub repository.
46 properties 46 required
basic-error
object
Basic Error
4 properties
alert-number
integer
The security alert number.
nullable-alert-updated-at
stringnull
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
alert-fixed-at
stringnull
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-organization-alert-items
object
16 properties 13 required
alert-dismissed-at
stringnull
The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-analysis-tool-version
stringnull
The version of the tool used to generate the code scanning analysis.
code-scanning-alert-location
object
Describe a region within a file for the alert.
5 properties
code-scanning-analysis-tool
object
3 properties
code-scanning-alert-dismissed-comment
stringnull
The dismissal comment associated with the dismissal of the alert.
code-scanning-alert-dismissed-reason
stringnull
Required when the state is dismissed. The reason for dismissing or closing the alert.
alert-url
string
The REST API URL of the alert resource.
code-scanning-alert-classification
stringnull
A classification of the file. For example to identify it as generated.
nullable-simple-user
objectnull
A GitHub user.
21 properties 18 required
code-scanning-alert-environment
string
Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language tha…
code-scanning-default-setup
object
Configuration for code scanning default setup.
4 properties
code-scanning-alert-items
object
15 properties 12 required
code-scanning-analysis-environment
string
Identifies the variable values associated with the environment in which this analysis was performed.
code-scanning-default-setup-update
object
Configuration for code scanning default setup.
2 properties 1 required
code-scanning-alert
object
15 properties 12 required
code-scanning-alert-rule
object
9 properties
code-scanning-analysis-tool-guid_2
string
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
code-scanning-alert-rule-summary_2
object
6 properties
scim-error
object
Scim Error
6 properties
code-scanning-analysis-commit-sha
string
The SHA of the commit to which the analysis you are uploading relates.
code-scanning-alert-set-state
string
Sets the state of the code scanning alert. You must provide dismissedreason when you set the state to dismissed.
code-scanning-default-setup-update-response
object
You can use runurl to track the status of the run. This includes a property status and conclusion. You should not rely on this always being an actions workflow…
2 properties
code-scanning-analysis-created-at
string
The time that the analysis was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
alert-fixed-at_2
string
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-analysis-tool-version_2
string
The version of the tool used to generate the code scanning analysis.
code-scanning-analysis-deletion
object
Successful deletion of a code scanning analysis
2 properties 2 required
code-scanning-analysis-sarif-id
string
An identifier for the upload.
nullable-simple-user_2
object
GitHub user.
21 properties 18 required
code-scanning-analysis
object
15 properties 14 required
alert-dismissed-at_2
string
The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
code-scanning-analysis-url
string
The REST API URL of the analysis resource.
empty-object
object
An object without any properties.
code-scanning-alert-dismissed-comment_2
string
The dismissal comment associated with the dismissal of the alert.
code-scanning-alert-dismissed-reason_2
string
Required when the state is dismissed. The reason for dismissing or closing the alert.
code-scanning-alert-classification_2
string
classification of the file. For example to identify it as generated.
secret-scanning-alert-resolution_2
string
Required when the state is resolved. The reason for resolving the alert.
secret-scanning-location
object
2 properties 2 required
secret-scanning-alert-resolution-comment
string
An optional comment when closing an alert. Cannot be updated or deleted. Must be null when changing state to open.
secret-scanning-location-discussion-body
object
Represents a 'discussionbody' secret scanning location type. This location type shows that a secret was detected in the body of a discussion.
1 property 1 required
secret-scanning-location-issue-body
object
Represents an 'issuebody' secret scanning location type. This location type shows that a secret was detected in the body of an issue.
1 property 1 required
secret-scanning-location-issue-comment
object
Represents an 'issuecomment' secret scanning location type. This location type shows that a secret was detected in a comment on an issue.
1 property 1 required
secret-scanning-location-pull-request-body
object
Represents a 'pullrequestbody' secret scanning location type. This location type shows that a secret was detected in the body of a pull request.
1 property 1 required
secret-scanning-location-discussion-comment
object
Represents a 'discussioncomment' secret scanning location type. This location type shows that a secret was detected in a comment on a discussion.
1 property 1 required
nullable-alert-updated-at_2
string
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
secret-scanning-location-pull-request-title
object
Represents a 'pullrequesttitle' secret scanning location type. This location type shows that a secret was detected in the title of a pull request.
1 property 1 required
secret-scanning-location-commit
object
Represents a 'commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.
9 properties 9 required
secret-scanning-location-pull-request-review-comment
object
Represents a 'pullrequestreviewcomment' secret scanning location type. This location type shows that a secret was detected in a review comment on a pull reques…
1 property 1 required
secret-scanning-location-discussion-title
object
Represents a 'discussiontitle' secret scanning location type. This location type shows that a secret was detected in the title of a discussion.
1 property 1 required
secret-scanning-location-issue-title
object
Represents an 'issuetitle' secret scanning location type. This location type shows that a secret was detected in the title of an issue.
1 property 1 required
secret-scanning-location-pull-request-review
object
Represents a 'pullrequestreview' secret scanning location type. This location type shows that a secret was detected in a review on a pull request.
1 property 1 required
secret-scanning-alert
object
17 properties
secret-scanning-location-pull-request-comment
object
Represents a 'pullrequestcomment' secret scanning location type. This location type shows that a secret was detected in a comment on a pull request.
1 property 1 required
nullable-simple-user_3
object
GitHub user.
21 properties 18 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

github-scanning-api-openapi.yml Raw ↑

Other APIs GitHub publishes across the network.

GitHub Events API
AE Profile APIs.io
GitHub Feeds API
AE Profile APIs.io
GitHub Gists API
AE Profile APIs.io
GitHub Issues API
AE Profile APIs.io
GitHub Licenses API
AE Profile APIs.io
GitHub Markdown API
AE Profile APIs.io
GitHub Meta API
AE Profile APIs.io
GitHub Notifications API
AE Profile APIs.io
GitHub Octocat API
AE Profile APIs.io
GitHub Projects API
AE Profile APIs.io
GitHub Repos API
AE Profile APIs.io
GitHub Search API
AE Profile APIs.io
#Scanning
← Back to G APIs
API Details
ID
github:github-scanning-api
Base URL
https://api.github.com
Docs
https://docs.github.com/en/rest/apps?apiVersion=2022-11-28
Provider
GitHub
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=github-scanning-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/github-scanning-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of GitHub Scanning API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.