GitHub: List locations for a secret scanning alert

GitHub secretScanning.secretScanningListLocationsForAlert: arguments, response, policy and SDK examples.

← Secret scanning operations · Get started

Operation github.secret_scanning_list_locations_for_alert

Provider route: GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["secretScanning"]["secretScanningListLocationsForAlert"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.secretScanning.secretScanningListLocationsForAlert(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.secret_scanning.secret_scanning_list_locations_for_alert(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.owner`	string	Required within parent
`path.repo`	string	Required within parent
`path.alert_number`	integer	Required within parent	The security alert number. Read only: true
`query`	object	Optional	Additional keys: not allowed
`query.page`	integer	Optional	Default: 1
`query.per_page`	integer	Optional	Default: 30

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	array	Root	List of locations where the secret was detected
`$[]`	Model	Each item	Expand List locations for a secret scanning alert — response body — item

Referenced models: List locations for a secret scanning alert — response body — item

Schemas

7 more schemas are linked from the tables above, on the schema pages.

List locations for a secret scanning alert — response body — item

Field	Type	Presence	Description and constraints
`$`	object	Root
`details`	JSON	Optional
`details (anyOf 1)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details blob sha, blob url, commit sha, commit url, end column, end line, html url, path, start column, start line
`details (anyOf 2)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details blob sha, commit sha, commit url, end column, end line, page url, path, start column, start line
`details (anyOf 3)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, issue title url
`details (anyOf 4)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, issue body url
`details (anyOf 5)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, issue comment url
`details (anyOf 6)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details discussion title url
`details (anyOf 7)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details discussion body url
`details (anyOf 8)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details discussion comment url
`details (anyOf 9)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, pull request title url
`details (anyOf 10)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, pull request body url
`details (anyOf 11)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, pull request comment url
`details (anyOf 12)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, pull request review url
`details (anyOf 13)`	Model	Alternative	Expand List locations for a secret scanning alert — response body — item details html url, pull request review comment url
`type`	string	Optional	The location type. Because secrets may be found in different types of resources (ie. code, comments, issues, pull requests, discussions), this field identifies the type of resource where the secret was found. Known values: commit, wiki_commit, issue_title, issue_body, issue_comment, discussion_title, discussion_body, discussion_comment, pull_request_title, pull_request_body, pull_request_comment, pull_request_review, pull_request_review_comment

List locations for a secret scanning alert — response body — item details blob sha, blob url, commit sha, commit url, end column, end line, html url, path, start column, start line

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents a 'commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.
`blob_sha`	string	Required within parent	SHA-1 hash ID of the associated blob
`blob_url`	string	Required within parent	The API URL to get the associated blob resource
`commit_sha`	string	Required within parent	SHA-1 hash ID of the associated commit
`commit_url`	string	Required within parent	The API URL to get the associated commit resource
`end_column`	JSON	Required within parent
`end_column (anyOf 1)`	number	Alternative	The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII
`end_column (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`end_line`	JSON	Required within parent
`end_line (anyOf 1)`	number	Alternative	Line number at which the secret ends in the file
`end_line (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`html_url`	string	Optional	The GitHub URL to get the associated commit resource. Format: uri
`path`	string	Required within parent	The file path in the repository
`start_column`	JSON	Required within parent
`start_column (anyOf 1)`	number	Alternative	The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII
`start_column (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`start_line`	JSON	Required within parent
`start_line (anyOf 1)`	number	Alternative	Line number at which the secret starts in the file
`start_line (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

List locations for a secret scanning alert — response body — item details discussion body url

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents a 'discussion_body' secret scanning location type. This location type shows that a secret was detected in the body of a discussion.
`discussion_body_url`	string	Required within parent	The URL to the discussion where the secret was detected. Format: uri

List locations for a secret scanning alert — response body — item details discussion comment url

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents a 'discussion_comment' secret scanning location type. This location type shows that a secret was detected in a comment on a discussion.
`discussion_comment_url`	string	Required within parent	The API URL to get the discussion comment where the secret was detected. Format: uri

List locations for a secret scanning alert — response body — item details discussion title url

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents a 'discussion_title' secret scanning location type. This location type shows that a secret was detected in the title of a discussion.
`discussion_title_url`	string	Required within parent	The URL to the discussion where the secret was detected. Format: uri

List locations for a secret scanning alert — response body — item details html url, issue body url

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents an 'issue_body' secret scanning location type. This location type shows that a secret was detected in the body of an issue.
`html_url`	string	Optional	The GitHub URL for the issue where the secret was detected. Format: uri
`issue_body_url`	string	Required within parent	The API URL to get the issue where the secret was detected. Format: uri

List locations for a secret scanning alert — response body — item details html url, issue comment url

Field	Type	Presence	Description and constraints
`$`	object	Root	Represents an 'issue_comment' secret scanning location type. This location type shows that a secret was detected in a comment on an issue.
`html_url`	string	Optional	The GitHub URL for the issue comment where the secret was detected. Format: uri
`issue_comment_url`	string	Required within parent	The API URL to get the issue comment where the secret was detected. Format: uri

Policy, approvals and errors

SDK function policy ID: github.secret_scanning_list_locations_for_alert. Catalog operation: secret-scanning/list-locations-for-alert. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source

Report an issue with this page