GitHub: List instances of a code scanning alert

← Code scanning operations · Get started

Operation github.code_scanning_list_alert_instances

Provider route: GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["codeScanning"]["codeScanningListAlertInstances"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.codeScanning.codeScanningListAlertInstances(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.code_scanning.code_scanning_list_alert_instances(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.alert_number	integer	Required within parent	The security alert number. Read only: true
query	object	Optional	Additional keys: not allowed
query.page	integer	Optional	Default: 1
query.per_page	integer	Optional	Default: 30
query.ref	string	Optional	The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
query.pr	integer	Optional

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	array	Root
$[]	Model	Each item	Expand List instances of a code scanning alert — response body — item

Referenced models: List instances of a code scanning alert — response body — item

Schemas

List instances of a code scanning alert — response body — item

Field	Type	Presence	Description and constraints
$	object	Root
analysis_key	string	Optional	Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
category	string	Optional	Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
classifications	array	Optional	Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
classifications[]	Model	Each item	Expand List instances of a code scanning alert — response body — item classifications item
commit_sha	string	Optional
environment	string	Optional	Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
html_url	string	Optional
location	Model	Optional	Expand List instances of a code scanning alert — response body — item location
message	object	Optional
message.text	string	Optional
ref	string	Optional	The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
state	Model	Optional	Expand List instances of a code scanning alert — response body — item state

Referenced models: List instances of a code scanning alert — response body — item classifications item, List instances of a code scanning alert — response body — item state, List instances of a code scanning alert — response body — item location

List instances of a code scanning alert — response body — item classifications item

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	A classification of the file. For example to identify it as generated. Known values: source, generated, test, library
$ (anyOf 2)	null	Alternative

List instances of a code scanning alert — response body — item state

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	State of a code scanning alert instance. Known values: open, fixed
$ (anyOf 2)	null	Alternative

List instances of a code scanning alert — response body — item location

Field	Type	Presence	Description and constraints
$	object	Root	Describe a region within a file for the alert.
end_column	JSON	Optional
end_column (anyOf 1)	integer	Alternative
end_column (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
end_line	JSON	Optional
end_line (anyOf 1)	integer	Alternative
end_line (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
path	string	Optional
start_column	JSON	Optional
start_column (anyOf 1)	integer	Alternative
start_column (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
start_line	JSON	Optional
start_line (anyOf 1)	integer	Alternative
start_line (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Policy, approvals and errors

SDK function policy ID: github.code_scanning_list_alert_instances. Catalog operation: code-scanning/list-alert-instances. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source