GitHub: Get a Dependabot alert

← Dependabot operations · Get started

Operation github.dependabot_get_alert

Provider route: GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["dependabot"]["dependabotGetAlert"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.dependabot.dependabotGetAlert(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.dependabot.dependabot_get_alert(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.alert_number	integer	Required within parent	The security alert number. Read only: true

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Get a Dependabot alert — response body

Referenced models: Get a Dependabot alert — response body

Schemas

7 more schemas are linked from the tables above, on the schema pages.

Get a Dependabot alert — response body

Field	Type	Presence	Description and constraints
$	object	Root	A Dependabot alert. Additional keys: not allowed
assignees	array	Optional	The users assigned to this alert. Read only: true
assignees[]	Model	Each item	Expand List users — response body — item
auto_dismissed_at	Model	Optional	Expand Get a Dependabot alert — response body — auto dismissed at
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dependency	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency
dismissal_request	Model	Optional	Expand Get a Dependabot alert — response body — dismissal request
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	JSON	Required within parent
dismissed_comment (anyOf 1)	string	Alternative	An optional comment associated with the alert's dismissal. Maximum length: 280
dismissed_comment (anyOf 2)	null	Alternative
dismissed_reason	JSON	Required within parent
dismissed_reason (anyOf 1)	string	Alternative	The reason that the alert was dismissed. Known values: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk
dismissed_reason (anyOf 2)	null	Alternative
fixed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
reachability	Model	Optional	Expand Get a Dependabot alert — response body — reachability
security_advisory	Model	Required within parent	Expand Get a Dependabot alert — response body — security advisory
security_vulnerability	Model	Required within parent	Expand Get a Dependabot alert — response body — security vulnerability
state	string	Required within parent	The state of the Dependabot alert. Known values: auto_dismissed, dismissed, fixed, open Read only: true
updated_at	string	Required within parent	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — auto dismissed at, Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a Dependabot alert — response body — dismissal request, Get a Dependabot alert — response body — security advisory, Get a Dependabot alert — response body — security vulnerability, Get an issue — response body — user, List users — response body — item, Get a Dependabot alert — response body — dependency, Get a Dependabot alert — response body — reachability

Get a Dependabot alert — response body — auto dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — fixed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — number

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	integer	Alternative	The security alert number. Read only: true
$ (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Get a Dependabot alert — response body — dismissal request

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	Information about an active dismissal request for this Dependabot alert.
$ (anyOf 1).created_at	string	Optional	The date and time when the dismissal request was created. Format: date-time
$ (anyOf 1).id	JSON	Optional
$ (anyOf 1).id (anyOf 1)	integer	Alternative	The unique identifier of the dismissal request.
$ (anyOf 1).id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester	object	Optional	The user who requested the dismissal.
$ (anyOf 1).requester.id	JSON	Optional
$ (anyOf 1).requester.id (anyOf 1)	integer	Alternative	The unique identifier of the user.
$ (anyOf 1).requester.id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester.login	string	Optional	The login name of the user.
$ (anyOf 1).status	string	Optional	The current status of the dismissal request. Known values: pending, approved, rejected, cancelled
$ (anyOf 1).url	string	Optional	The API URL to get more information about this dismissal request. Format: uri
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — security vulnerability

Field	Type	Presence	Description and constraints
$	object	Root	Details pertaining to one vulnerable version range for the advisory. Read only: true Additional keys: not allowed
first_patched_version	JSON	Required within parent
first_patched_version (anyOf 1)	object	Alternative	Details pertaining to the package version that patches this vulnerability. Read only: true Additional keys: not allowed
first_patched_version (anyOf 1).identifier	string	Required within parent	The package version that patches this vulnerability. Read only: true
first_patched_version (anyOf 2)	null	Alternative
package	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency package
severity	string	Required within parent	The severity of the vulnerability. Known values: low, medium, high, critical Read only: true
vulnerable_version_range	string	Required within parent	Conditions that identify vulnerable versions of this vulnerability's package. Read only: true

Referenced models: Get a Dependabot alert — response body — dependency package

Get an issue — response body — user

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	Model	Alternative	Expand Get an issue — response body — user A Git Hub user
$ (anyOf 2)	null	Alternative

Referenced models: Get an issue — response body — user A Git Hub user

Get a Dependabot alert — response body — dependency package

Field	Type	Presence	Description and constraints
$	object	Root	Details for the vulnerable package. Read only: true Additional keys: not allowed
ecosystem	string	Required within parent	The package's language or package management ecosystem. Read only: true
name	string	Required within parent	The unique package name within its ecosystem. Read only: true

Policy, approvals and errors

SDK function policy ID: github.dependabot_get_alert. Catalog operation: dependabot/get-alert. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source