GitHub: Update a secret scanning alert

GitHub secretScanning.secretScanningUpdateAlert: arguments, response, policy and SDK examples.

← Secret scanning operations · Get started

Operation github.secret_scanning_update_alert

Provider route: PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["secretScanning"]["secretScanningUpdateAlert"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.secretScanning.secretScanningUpdateAlert(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.secret_scanning.secret_scanning_update_alert(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.owner`	string	Required within parent
`path.repo`	string	Required within parent
`path.alert_number`	integer	Required within parent	The security alert number. Read only: true
`body`	object	Required within parent
`body.assignee`	Model	Optional	Expand Update a secret scanning alert — request body — body assignee
`body.resolution`	Model	Optional	Expand Update a secret scanning alert — request body — body resolution
`body.resolution_comment`	Model	Optional	Expand Update a secret scanning alert — request body — body resolution comment
`body.state`	string	Optional	Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`. One of: open, resolved
`body.validity`	JSON	Optional
`body.validity (anyOf 1)`	string	Alternative	Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override. One of: active, inactive
`body.validity (anyOf 2)`	null	Alternative
`body (anyOf 1)`	JSON	Alternative
`body (anyOf 2)`	JSON	Alternative
`body (anyOf 3)`	JSON	Alternative

Referenced models: Update a secret scanning alert — request body — body assignee, Update a secret scanning alert — request body — body resolution, Update a secret scanning alert — request body — body resolution comment

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	Model	Root	Expand Get a secret scanning alert — response body

Referenced models: Get a secret scanning alert — response body

Schemas

16 more schemas are linked from the tables above, on the schema pages.

Get a secret scanning alert — response body

Field	Type	Presence	Description and constraints
`$`	object	Root
`assigned_to`	Model	Optional	Expand Get an issue — response body — user
`closure_request_comment`	JSON	Optional
`closure_request_comment (anyOf 1)`	string	Alternative	An optional comment from the closure request author.
`closure_request_comment (anyOf 2)`	null	Alternative
`closure_request_reviewer`	Model	Optional	Expand Get an issue — response body — user
`closure_request_reviewer_comment`	JSON	Optional
`closure_request_reviewer_comment (anyOf 1)`	string	Alternative	An optional comment from the closure request reviewer.
`closure_request_reviewer_comment (anyOf 2)`	null	Alternative
`created_at`	string	Optional	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
`first_location_detected`	Model	Optional	Expand Get a secret scanning alert — response body — first location detected
`has_more_locations`	boolean	Optional	A boolean value representing whether or not the token in the alert was detected in more than one location.
`html_url`	string	Optional	The GitHub URL of the alert resource. Format: uri Read only: true
`is_base64_encoded`	JSON	Optional
`is_base64_encoded (anyOf 1)`	boolean	Alternative	A boolean value representing whether or not alert is base64 encoded
`is_base64_encoded (anyOf 2)`	null	Alternative
`locations_url`	string	Optional	The REST API URL of the code locations for this alert. Format: uri
`metadata`	Model	Optional	Expand Get a secret scanning alert — response body — metadata
`multi_repo`	JSON	Optional
`multi_repo (anyOf 1)`	boolean	Alternative	Whether the detected secret was found in multiple repositories under the same organization or enterprise.
`multi_repo (anyOf 2)`	null	Alternative
`number`	Model	Optional	Expand Get a Dependabot alert — response body — number
`provider`	JSON	Optional
`provider (anyOf 1)`	string	Alternative	The provider of the secret that was detected.
`provider (anyOf 2)`	null	Alternative
`provider_slug`	JSON	Optional
`provider_slug (anyOf 1)`	string	Alternative	The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the `providers` or `exclude_providers` parameters.
`provider_slug (anyOf 2)`	null	Alternative
`publicly_leaked`	JSON	Optional
`publicly_leaked (anyOf 1)`	boolean	Alternative	Whether the detected secret was publicly leaked.
`publicly_leaked (anyOf 2)`	null	Alternative
`push_protection_bypass_request_comment`	JSON	Optional
`push_protection_bypass_request_comment (anyOf 1)`	string	Alternative	An optional comment when requesting a push protection bypass.
`push_protection_bypass_request_comment (anyOf 2)`	null	Alternative
`push_protection_bypass_request_html_url`	JSON	Optional
`push_protection_bypass_request_html_url (anyOf 1)`	string	Alternative	The URL to a push protection bypass request. Format: uri
`push_protection_bypass_request_html_url (anyOf 2)`	null	Alternative
`push_protection_bypass_request_reviewer`	Model	Optional	Expand Get an issue — response body — user
`push_protection_bypass_request_reviewer_comment`	JSON	Optional
`push_protection_bypass_request_reviewer_comment (anyOf 1)`	string	Alternative	An optional comment when reviewing a push protection bypass.
`push_protection_bypass_request_reviewer_comment (anyOf 2)`	null	Alternative
`push_protection_bypassed`	JSON	Optional
`push_protection_bypassed (anyOf 1)`	boolean	Alternative	Whether push protection was bypassed for the detected secret.
`push_protection_bypassed (anyOf 2)`	null	Alternative
`push_protection_bypassed_at`	JSON	Optional
`push_protection_bypassed_at (anyOf 1)`	string	Alternative	The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time
`push_protection_bypassed_at (anyOf 2)`	null	Alternative
`push_protection_bypassed_by`	Model	Optional	Expand Get an issue — response body — user
`resolution`	Model	Optional	Expand Get a secret scanning alert — response body — resolution
`resolution_comment`	JSON	Optional
`resolution_comment (anyOf 1)`	string	Alternative	An optional comment to resolve an alert.
`resolution_comment (anyOf 2)`	null	Alternative
`resolved_at`	JSON	Optional
`resolved_at (anyOf 1)`	string	Alternative	The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time
`resolved_at (anyOf 2)`	null	Alternative
`resolved_by`	Model	Optional	Expand Get an issue — response body — user
`secret`	string	Optional	The secret that was detected.
`secret_type`	string	Optional	The type of secret that secret scanning detected.
`secret_type_display_name`	string	Optional	User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."
`state`	string	Optional	Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`. Known values: open, resolved
`updated_at`	Model	Optional	Expand Get a secret scanning alert — response body — updated at
`url`	string	Optional	The REST API URL of the alert resource. Format: uri Read only: true
`validity`	string	Optional	The token status as of the latest validity check. Known values: active, inactive, unknown

Referenced models: Get a Dependabot alert — response body — number, Get a secret scanning alert — response body — updated at, Get a secret scanning alert — response body — first location detected, Get an issue — response body — user, Get a secret scanning alert — response body — metadata, Get a secret scanning alert — response body — resolution

Update a secret scanning alert — request body — body assignee

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	string	Alternative	The username of the user to assign to the alert. Set to `null` to unassign the alert.
`$ (anyOf 2)`	null	Alternative

Update a secret scanning alert — request body — body resolution

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	string	Alternative	Required when the `state` is `resolved`. The reason for resolving the alert. One of: false_positive, wont_fix, revoked, used_in_tests
`$ (anyOf 2)`	null	Alternative

Update a secret scanning alert — request body — body resolution comment

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	string	Alternative	An optional comment when closing or reopening an alert. Cannot be updated or deleted.
`$ (anyOf 2)`	null	Alternative

Get a Dependabot alert — response body — number

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	integer	Alternative	The security alert number. Read only: true
`$ (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Get a secret scanning alert — response body — updated at

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	string	Alternative	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
`$ (anyOf 2)`	null	Alternative

Get an issue — response body — user

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	Model	Alternative	Expand Get an issue — response body — user A Git Hub user
`$ (anyOf 2)`	null	Alternative

Referenced models: Get an issue — response body — user A Git Hub user

Get a secret scanning alert — response body — resolution

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	string	Alternative	Required when the `state` is `resolved`. The reason for resolving the alert. Known values: false_positive, wont_fix, revoked, used_in_tests
`$ (anyOf 2)`	null	Alternative

Policy, approvals and errors

SDK function policy ID: github.secret_scanning_update_alert. Catalog operation: secret-scanning/update-alert. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Refused by default. This operation leaves the caller holding a credential (Returns the updated alert including its discovered secret credential.), so Alter refuses it on every connection with credential_minting_refused unless an organization admin allows it: a credential_minting rule naming provider github and operation github.secret_scanning_update_alert (or secret-scanning/update-alert). See Allow an operation that hands over a credential.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source

Report an issue with this page