GitHub: Code scanning schemas

← Code scanning operations · All schemas

Commit an autofix for a code scanning alert — request body — body

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	Commit an autofix for a code scanning alert
$ (anyOf 1).message	string	Optional	Commit message to be used.
$ (anyOf 1).target_ref	string	Optional	The Git reference of target branch for the commit. Branch needs to already exist. For more information, see "[Git References](https://git-scm.com/book/en/v2/Git-Internals-Git-References)" in the Git documentation.
$ (anyOf 2)	null	Alternative

Commit an autofix for a code scanning alert — response body

Field	Type	Presence	Description and constraints
$	object	Root
sha	string	Optional	SHA of commit with autofix.
target_ref	string	Optional	The Git reference of target branch for the commit. For more information, see "[Git References](https://git-scm.com/book/en/v2/Git-Internals-Git-References)" in the Git documentation.

Create a Code QL variant analysis — response body

Field	Type	Presence	Description and constraints
$	object	Root	A run of a CodeQL query against one or more repositories.
actions_workflow_run_id	JSON	Optional
actions_workflow_run_id (anyOf 1)	integer	Alternative	The GitHub Actions workflow run used to execute this variant analysis. This is only available if the workflow run has started.
actions_workflow_run_id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
actor	Model	Required within parent	Expand List users — response body — item
completed_at	JSON	Optional
completed_at (anyOf 1)	string	Alternative	The date and time at which the variant analysis was completed, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Will be null if the variant analysis has not yet completed or this information is not available. Format: date-time
completed_at (anyOf 2)	null	Alternative
controller_repo	Model	Required within parent	Expand List repositories for a user migration — response body — item
created_at	string	Optional	The date and time at which the variant analysis was created, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time
failure_reason	string	Optional	The reason for a failure of the variant analysis. This is only available if the variant analysis has failed. Known values: no_repos_queried, actions_workflow_run_failed, internal_error
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	The ID of the variant analysis.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
query_language	string	Required within parent	The language targeted by the CodeQL query Known values: actions, cpp, csharp, go, java, javascript, python, ruby, rust, swift
query_pack_url	string	Required within parent	The download url for the query pack.
scanned_repositories	array	Optional
scanned_repositories[]	object	Each item
scanned_repositories[].analysis_status	string	Required within parent	The new status of the CodeQL variant analysis repository task. Known values: pending, in_progress, succeeded, failed, canceled, timed_out
scanned_repositories[].artifact_size_in_bytes	JSON	Optional
scanned_repositories[].artifact_size_in_bytes (anyOf 1)	integer	Alternative	The size of the artifact. This is only available for successful analyses.
scanned_repositories[].artifact_size_in_bytes (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
scanned_repositories[].failure_message	string	Optional	The reason of the failure of this repo task. This is only available if the repository task has failed.
scanned_repositories[].repository	Model	Required within parent	Expand Create a Code QL variant analysis — response body — scanned repositories item repository
scanned_repositories[].result_count	JSON	Optional
scanned_repositories[].result_count (anyOf 1)	integer	Alternative	The number of results in the case of a successful analysis. This is only available for successful analyses.
scanned_repositories[].result_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
skipped_repositories	object	Optional	Information about repositories that were skipped from processing. This information is only available to the user that initiated the variant analysis.
skipped_repositories.access_mismatch_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
skipped_repositories.no_codeql_db_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
skipped_repositories.not_found_repos	object	Required within parent
skipped_repositories.not_found_repos.repository_count	JSON	Required within parent
skipped_repositories.not_found_repos.repository_count (anyOf 1)	integer	Alternative	The total number of repositories that were skipped for this reason.
skipped_repositories.not_found_repos.repository_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
skipped_repositories.not_found_repos.repository_full_names	array	Required within parent	A list of full repository names that were skipped. This list may not include all repositories that were skipped.
skipped_repositories.not_found_repos.repository_full_names[]	string	Each item
skipped_repositories.over_limit_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
status	string	Required within parent	Known values: in_progress, succeeded, failed, cancelled
updated_at	string	Optional	The date and time at which the variant analysis was last updated, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time

Referenced models: Create a Code QL variant analysis — response body — scanned repositories item repository, Create a Code QL variant analysis — response body — skipped repositories over limit repos, List repositories for a user migration — response body — item, List users — response body — item

Create a Code QL variant analysis — response body — scanned repositories item repository

Field	Type	Presence	Description and constraints
$	object	Root	Repository Identifier
full_name	string	Required within parent	The full, globally unique, name of the repository.
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	A unique identifier of the repository.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
name	string	Required within parent	The name of the repository.
private	boolean	Required within parent	Whether the repository is private.
stargazers_count	JSON	Required within parent
stargazers_count (anyOf 1)	integer	Alternative
stargazers_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
updated_at	JSON	Required within parent
updated_at (anyOf 1)	string	Alternative	Format: date-time
updated_at (anyOf 2)	null	Alternative

Create a Code QL variant analysis — response body — skipped repositories over limit repos

Field	Type	Presence	Description and constraints
$	object	Root
repositories	array	Required within parent	A list of repositories that were skipped. This list may not include all repositories that were skipped. This is only available when the repository was found and the user has access to it.
repositories[]	Model	Each item	Expand Create a Code QL variant analysis — response body — scanned repositories item repository
repository_count	JSON	Required within parent
repository_count (anyOf 1)	integer	Alternative	The total number of repositories that were skipped for this reason.
repository_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Referenced models: Create a Code QL variant analysis — response body — scanned repositories item repository

Delete a code scanning analysis from a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root	Successful deletion of a code scanning analysis
confirm_delete_url	JSON	Required within parent
confirm_delete_url (anyOf 1)	string	Alternative	Next deletable analysis in chain, with last analysis deletion confirmation Format: uri Read only: true
confirm_delete_url (anyOf 2)	null	Alternative
next_analysis_url	JSON	Required within parent
next_analysis_url (anyOf 1)	string	Alternative	Next deletable analysis in chain, without last analysis deletion confirmation Format: uri Read only: true
next_analysis_url (anyOf 2)	null	Alternative

Get AI Scan enablement for a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root	AI Scan enablement for a repository.
pr_scan	string	Required within parent	Whether AI Scan is enabled for the repository. Known values: enabled, disabled

Get a Code QL database for a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root	A CodeQL database.
commit_oid	JSON	Optional
commit_oid (anyOf 1)	string	Alternative	The commit SHA of the repository at the time the CodeQL database was created.
commit_oid (anyOf 2)	null	Alternative
content_type	string	Required within parent	The MIME type of the CodeQL database file.
created_at	string	Required within parent	The date and time at which the CodeQL database was created, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	The ID of the CodeQL database.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
language	string	Required within parent	The language of the CodeQL database.
name	string	Required within parent	The name of the CodeQL database.
size	JSON	Required within parent
size (anyOf 1)	integer	Alternative	The size of the CodeQL database file in bytes.
size (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
updated_at	string	Required within parent	The date and time at which the CodeQL database was last updated, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time
uploader	Model	Required within parent	Expand List users — response body — item
url	string	Required within parent	The URL at which to download the CodeQL database. The `Accept` header must be set to the value of the `content_type` property. Format: uri

Referenced models: List users — response body — item

Get a code scanning alert — response body

Field	Type	Presence	Description and constraints
$	object	Root
assignees	array	Optional
assignees[]	Model	Each item	Expand List users — response body — item
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dismissal_approved_by	Model	Optional	Expand Get an issue — response body — user
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	Model	Optional	Expand Get a code scanning alert — response body — dismissed comment
dismissed_reason	Model	Required within parent	Expand Get a code scanning alert — response body — dismissed reason
fixed_at	Model	Optional	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
instances_url	string	Required within parent	The REST API URL for fetching the list of instances for an alert. Format: uri Read only: true
linked_pull_requests	array	Optional	Pull requests linked to this alert.
linked_pull_requests[]	Model	Each item	Expand Request reviewers for a pull request — response body
most_recent_instance	Model	Required within parent	Expand Get a code scanning alert — response body — most recent instance
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
rule	Model	Required within parent	Expand Get a code scanning alert — response body — rule
state	Model	Required within parent	Expand Get a code scanning alert — response body — state
tool	Model	Required within parent	Expand Get a code scanning alert — response body — tool
updated_at	string	Optional	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a code scanning alert — response body — dismissed comment, Get a code scanning alert — response body — dismissed reason, Get a code scanning alert — response body — most recent instance, Get a code scanning alert — response body — rule, Get a code scanning alert — response body — state, Get a code scanning alert — response body — tool, Get an issue — response body — user, Request reviewers for a pull request — response body, List users — response body — item

Get a code scanning alert — response body — dismissed comment

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The dismissal comment associated with the dismissal of the alert. Maximum length: 280
$ (anyOf 2)	null	Alternative

Get a code scanning alert — response body — dismissed reason

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	**Required when the state is dismissed.** The reason for dismissing or closing the alert. Known values: false positive, won't fix, used in tests, mitigated
$ (anyOf 2)	null	Alternative

Get a code scanning alert — response body — most recent instance

Field	Type	Presence	Description and constraints
$	object	Root
analysis_key	string	Optional	Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
category	string	Optional	Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
classifications	array	Optional	Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
classifications[]	Model	Each item	Expand List instances of a code scanning alert — response body — item classifications item
commit_sha	string	Optional
environment	string	Optional	Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
html_url	string	Optional
location	Model	Optional	Expand List instances of a code scanning alert — response body — item location
message	object	Optional
message.markdown	string	Optional	The message text as GitHub-flavored Markdown, with placeholder links for related locations replaced by links to the relevant code. Only populated when related locations are available for the alert instance.
message.text	string	Optional
ref	string	Optional	The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
state	Model	Optional	Expand Get a code scanning alert — response body — state

Referenced models: List instances of a code scanning alert — response body — item classifications item, List instances of a code scanning alert — response body — item location, Get a code scanning alert — response body — state

Get a code scanning alert — response body — rule

Field	Type	Presence	Description and constraints
$	object	Root
description	string	Optional	A short description of the rule used to detect the alert.
full_description	string	Optional	A description of the rule used to detect the alert.
help	JSON	Optional
help (anyOf 1)	string	Alternative	Detailed documentation for the rule as GitHub Flavored Markdown.
help (anyOf 2)	null	Alternative
help_uri	JSON	Optional
help_uri (anyOf 1)	string	Alternative	A link to the documentation for the rule used to detect the alert.
help_uri (anyOf 2)	null	Alternative
id	JSON	Optional
id (anyOf 1)	string	Alternative	A unique identifier for the rule used to detect the alert.
id (anyOf 2)	null	Alternative
name	string	Optional	The name of the rule used to detect the alert.
security_severity_level	JSON	Optional
security_severity_level (anyOf 1)	string	Alternative	The security severity of the alert. Known values: low, medium, high, critical
security_severity_level (anyOf 2)	null	Alternative
severity	JSON	Optional
severity (anyOf 1)	string	Alternative	The severity of the alert. Known values: none, note, warning, error
severity (anyOf 2)	null	Alternative
tags	JSON	Optional
tags (anyOf 1)	array	Alternative	A set of tags applicable for the rule.
tags (anyOf 1)[]	string	Each item
tags (anyOf 2)	null	Alternative

Get a code scanning alert — response body — state

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	State of a code scanning alert. Known values: open, dismissed, fixed
$ (anyOf 2)	null	Alternative

Get a code scanning alert — response body — tool

Field	Type	Presence	Description and constraints
$	object	Root
guid	Model	Optional	Expand Get a code scanning alert — response body — tool guid
name	string	Optional	The name of the tool used to generate the code scanning analysis.
version	Model	Optional	Expand Get a code scanning alert — response body — tool version

Referenced models: Get a code scanning alert — response body — tool guid, Get a code scanning alert — response body — tool version

Get a code scanning alert — response body — tool guid

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
$ (anyOf 2)	null	Alternative

Get a code scanning alert — response body — tool version

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The version of the tool used to generate the code scanning analysis.
$ (anyOf 2)	null	Alternative

Get a code scanning analysis for a repository — response body

Field	Type	Presence	Description and constraints
$	object	Root
analysis_key	string	Required within parent	Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
category	string	Optional	Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
commit_sha	string	Required within parent	The SHA of the commit to which the analysis you are uploading relates. Maximum length: 64 Minimum length: 40 Pattern: ^([0-9a-fA-F]{40}(?:[0-9a-fA-F]{24})?)$
created_at	string	Required within parent	The time that the analysis was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
deletable	boolean	Required within parent
environment	string	Required within parent	Identifies the variable values associated with the environment in which this analysis was performed.
error	string	Required within parent
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Unique identifier for this analysis.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
ref	string	Required within parent	The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
results_count	JSON	Required within parent
results_count (anyOf 1)	integer	Alternative	The total number of results in the analysis.
results_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
rules_count	JSON	Required within parent
rules_count (anyOf 1)	integer	Alternative	The total number of rules used in the analysis.
rules_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
sarif_id	string	Required within parent	An identifier for the upload.
tool	Model	Required within parent	Expand Get a code scanning alert — response body — tool
url	string	Required within parent	The REST API URL of the analysis resource. Format: uri Read only: true
warning	string	Required within parent	Warning generated when processing the analysis

Referenced models: Get a code scanning alert — response body — tool

Get a code scanning default setup configuration — response body

Field	Type	Presence	Description and constraints
$	object	Root	Configuration for code scanning default setup.
languages	array	Optional	Languages to be analyzed.
languages[]	string	Each item	Known values: actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift
query_suite	string	Optional	CodeQL query suite to be used. Known values: default, extended
runner_label	JSON	Optional
runner_label (anyOf 1)	string	Alternative	Runner label to be used if the runner type is labeled.
runner_label (anyOf 2)	null	Alternative
runner_type	JSON	Optional
runner_type (anyOf 1)	string	Alternative	Runner type to be used. Known values: standard, labeled
runner_type (anyOf 2)	null	Alternative
schedule	JSON	Optional
schedule (anyOf 1)	string	Alternative	The frequency of the periodic analysis. Known values: weekly
schedule (anyOf 2)	null	Alternative
state	string	Optional	Code scanning default setup has been configured or not. Known values: configured, not-configured
threat_model	string	Optional	Threat model to be used for code scanning analysis. Use `remote` to analyze only network sources and `remote_and_local` to include local sources like filesystem access, command-line arguments, database reads, environment variable and standard input. Known values: remote, remote_and_local
updated_at	JSON	Optional
updated_at (anyOf 1)	string	Alternative	Timestamp of latest configuration update. Format: date-time
updated_at (anyOf 2)	null	Alternative

Get information about a SARIF upload — response body

Field	Type	Presence	Description and constraints
$	object	Root
analyses_url	JSON	Optional
analyses_url (anyOf 1)	string	Alternative	The REST API URL for getting the analyses associated with the upload. Format: uri Read only: true
analyses_url (anyOf 2)	null	Alternative
errors	JSON	Optional
errors (anyOf 1)	array	Alternative	Any errors that ocurred during processing of the delivery. Read only: true
errors (anyOf 1)[]	string	Each item
errors (anyOf 2)	null	Alternative
processing_status	string	Optional	`pending` files have not yet been processed, while `complete` means results from the SARIF have been stored. `failed` files have either not been processed at all, or could only be partially processed. Known values: pending, complete, failed

Get the AI Scan setting for an organization — response body

Field	Type	Presence	Description and constraints
$	object	Root	The AI Scan organization setting
pr_scan	string	Required within parent	Whether AI Scan on pull requests is enabled for the organization. The organization setting respects enterprise policy, and repositories inherit it: when disabled, repositories cannot enable AI Scan; when enabled, repositories can still opt out. Known values: enabled, disabled

Get the analysis status of a repository in a Code QL variant analysis — response body

Field	Type	Presence	Description and constraints
$	object	Root
analysis_status	string	Required within parent	The new status of the CodeQL variant analysis repository task. Known values: pending, in_progress, succeeded, failed, canceled, timed_out
artifact_size_in_bytes	JSON	Optional
artifact_size_in_bytes (anyOf 1)	integer	Alternative	The size of the artifact. This is only available for successful analyses.
artifact_size_in_bytes (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
artifact_url	string	Optional	The URL of the artifact. This is only available for successful analyses.
database_commit_sha	string	Optional	The SHA of the commit the CodeQL database was built against. This is only available for successful analyses.
failure_message	string	Optional	The reason of the failure of this repo task. This is only available if the repository task has failed.
repository	Model	Required within parent	Expand List repositories for a user migration — response body — item
result_count	JSON	Optional
result_count (anyOf 1)	integer	Alternative	The number of results in the case of a successful analysis. This is only available for successful analyses.
result_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
source_location_prefix	string	Optional	The source location prefix to use. This is only available for successful analyses.

Referenced models: List repositories for a user migration — response body — item

Get the status of an autofix for a code scanning alert — response body

Field	Type	Presence	Description and constraints
$	object	Root
description	Model	Required within parent	Expand Get the status of an autofix for a code scanning alert — response body — description
started_at	string	Required within parent	The start time of an autofix in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
status	string	Required within parent	The status of an autofix. Known values: pending, error, success, outdated

Referenced models: Get the status of an autofix for a code scanning alert — response body — description

Get the status of an autofix for a code scanning alert — response body — description

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The description of an autofix.
$ (anyOf 2)	null	Alternative

List code scanning alerts for a repository — response body — item

Field	Type	Presence	Description and constraints
$	object	Root
assignees	array	Optional
assignees[]	Model	Each item	Expand List users — response body — item
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dismissal_approved_by	Model	Optional	Expand Get an issue — response body — user
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	Model	Optional	Expand Get a code scanning alert — response body — dismissed comment
dismissed_reason	Model	Required within parent	Expand Get a code scanning alert — response body — dismissed reason
fixed_at	Model	Optional	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
instances_url	string	Required within parent	The REST API URL for fetching the list of instances for an alert. Format: uri Read only: true
most_recent_instance	Model	Required within parent	Expand Get a code scanning alert — response body — most recent instance
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
rule	Model	Required within parent	Expand Get a code scanning alert — response body — rule
state	Model	Required within parent	Expand Get a code scanning alert — response body — state
tool	Model	Required within parent	Expand Get a code scanning alert — response body — tool
updated_at	string	Optional	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a code scanning alert — response body — dismissed comment, Get a code scanning alert — response body — dismissed reason, Get a code scanning alert — response body — most recent instance, Get a code scanning alert — response body — rule, Get a code scanning alert — response body — state, Get a code scanning alert — response body — tool, Get an issue — response body — user, List users — response body — item

List code scanning alerts for an organization — response body — item

Field	Type	Presence	Description and constraints
$	object	Root
assignees	array	Optional
assignees[]	Model	Each item	Expand List users — response body — item
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dismissal_approved_by	Model	Optional	Expand Get an issue — response body — user
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	Model	Optional	Expand Get a code scanning alert — response body — dismissed comment
dismissed_reason	Model	Required within parent	Expand Get a code scanning alert — response body — dismissed reason
fixed_at	Model	Optional	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
instances_url	string	Required within parent	The REST API URL for fetching the list of instances for an alert. Format: uri Read only: true
most_recent_instance	Model	Required within parent	Expand Get a code scanning alert — response body — most recent instance
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
repository	Model	Required within parent	Expand List repositories for a user migration — response body — item
rule	Model	Required within parent	Expand Get a code scanning alert — response body — rule
state	Model	Required within parent	Expand Get a code scanning alert — response body — state
tool	Model	Required within parent	Expand Get a code scanning alert — response body — tool
updated_at	string	Optional	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a code scanning alert — response body — dismissed comment, Get a code scanning alert — response body — dismissed reason, Get a code scanning alert — response body — most recent instance, Get a code scanning alert — response body — rule, Get a code scanning alert — response body — state, Get a code scanning alert — response body — tool, Get an issue — response body — user, List repositories for a user migration — response body — item, List users — response body — item

List instances of a code scanning alert — response body — item

Field	Type	Presence	Description and constraints
$	object	Root
analysis_key	string	Optional	Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
category	string	Optional	Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
classifications	array	Optional	Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
classifications[]	Model	Each item	Expand List instances of a code scanning alert — response body — item classifications item
commit_sha	string	Optional
environment	string	Optional	Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
html_url	string	Optional
location	Model	Optional	Expand List instances of a code scanning alert — response body — item location
message	object	Optional
message.text	string	Optional
ref	string	Optional	The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
state	Model	Optional	Expand List instances of a code scanning alert — response body — item state

Referenced models: List instances of a code scanning alert — response body — item classifications item, List instances of a code scanning alert — response body — item state, List instances of a code scanning alert — response body — item location

List instances of a code scanning alert — response body — item classifications item

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	A classification of the file. For example to identify it as generated. Known values: source, generated, test, library
$ (anyOf 2)	null	Alternative

List instances of a code scanning alert — response body — item location

Field	Type	Presence	Description and constraints
$	object	Root	Describe a region within a file for the alert.
end_column	JSON	Optional
end_column (anyOf 1)	integer	Alternative
end_column (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
end_line	JSON	Optional
end_line (anyOf 1)	integer	Alternative
end_line (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
path	string	Optional
start_column	JSON	Optional
start_column (anyOf 1)	integer	Alternative
start_column (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
start_line	JSON	Optional
start_line (anyOf 1)	integer	Alternative
start_line (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

List instances of a code scanning alert — response body — item state

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	State of a code scanning alert instance. Known values: open, fixed
$ (anyOf 2)	null	Alternative

Update AI Scan enablement for a repository — request body — body

Field	Type	Presence	Description and constraints
$	object	Root	AI Scan enablement update for a repository. Minimum fields: 1 Additional keys: not allowed
pr_scan	string	Optional	Whether to enable or disable AI Scan for the repository. One of: enabled, disabled

Update a code scanning alert — request body — body assignees

Field	Type	Presence	Description and constraints
$	array	Root	The list of users to assign to the code scanning alert. An empty array unassigns all previous assignees from the alert.
$[]	string	Each item

Update a code scanning alert — request body — body dismissed reason

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	**Required when the state is dismissed.** The reason for dismissing or closing the alert. One of: false positive, won't fix, used in tests, mitigated
$ (anyOf 2)	null	Alternative

Update a code scanning default setup configuration — request body — body

Field	Type	Presence	Description and constraints
$	object	Root	Configuration for code scanning default setup. Additional keys: not allowed
languages	array	Optional	CodeQL languages to be analyzed.
languages[]	string	Each item	One of: actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift
query_suite	string	Optional	CodeQL query suite to be used. One of: default, extended
runner_label	JSON	Optional
runner_label (anyOf 1)	string	Alternative	Runner label to be used if the runner type is labeled.
runner_label (anyOf 2)	null	Alternative
runner_type	string	Optional	Runner type to be used. One of: standard, labeled
state	string	Optional	The desired state of code scanning default setup. One of: configured, not-configured
threat_model	string	Optional	Threat model to be used for code scanning analysis. Use `remote` to analyze only network sources and `remote_and_local` to include local sources like filesystem access, command-line arguments, database reads, environment variable and standard input. One of: remote, remote_and_local

Update the AI Scan setting for an organization — request body — body

Field	Type	Presence	Description and constraints
$	object	Root	The AI Scan organization setting to apply Minimum fields: 1 Additional keys: not allowed
pr_scan	string	Optional	Whether AI Scan is enabled for the organization. Organization respects enterprise policy. Disabled organizations prevent repositories from enabling AI Scan. Enabled organizations enable AI Scan for their repositories, but individual repositories can opt out. One of: enabled, disabled

Upload an analysis as SARIF data — response body

Field	Type	Presence	Description and constraints
$	object	Root
id	string	Optional	An identifier for the upload.
url	string	Optional	The REST API URL for checking the status of the upload. Format: uri Read only: true