GitHub: Dependabot schemas

← Dependabot operations · All schemas

Get a Dependabot alert — response body

Field	Type	Presence	Description and constraints
$	object	Root	A Dependabot alert. Additional keys: not allowed
assignees	array	Optional	The users assigned to this alert. Read only: true
assignees[]	Model	Each item	Expand List users — response body — item
auto_dismissed_at	Model	Optional	Expand Get a Dependabot alert — response body — auto dismissed at
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dependency	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency
dismissal_request	Model	Optional	Expand Get a Dependabot alert — response body — dismissal request
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	JSON	Required within parent
dismissed_comment (anyOf 1)	string	Alternative	An optional comment associated with the alert's dismissal. Maximum length: 280
dismissed_comment (anyOf 2)	null	Alternative
dismissed_reason	JSON	Required within parent
dismissed_reason (anyOf 1)	string	Alternative	The reason that the alert was dismissed. Known values: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk
dismissed_reason (anyOf 2)	null	Alternative
fixed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
reachability	Model	Optional	Expand Get a Dependabot alert — response body — reachability
security_advisory	Model	Required within parent	Expand Get a Dependabot alert — response body — security advisory
security_vulnerability	Model	Required within parent	Expand Get a Dependabot alert — response body — security vulnerability
state	string	Required within parent	The state of the Dependabot alert. Known values: auto_dismissed, dismissed, fixed, open Read only: true
updated_at	string	Required within parent	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — auto dismissed at, Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a Dependabot alert — response body — dismissal request, Get a Dependabot alert — response body — security advisory, Get a Dependabot alert — response body — security vulnerability, Get an issue — response body — user, List users — response body — item, Get a Dependabot alert — response body — dependency, Get a Dependabot alert — response body — reachability

Get a Dependabot alert — response body — auto dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — dependency

Field	Type	Presence	Description and constraints
$	object	Root	Details for the vulnerable dependency. Read only: true
manifest_path	string	Optional	The full path to the dependency manifest file, relative to the root of the repository. Read only: true
package	Model	Optional	Expand Get a Dependabot alert — response body — dependency package
relationship	JSON	Optional
relationship (anyOf 1)	string	Alternative	The vulnerable dependency's relationship to your project. > [!NOTE] > We are rolling out support for dependency relationship across ecosystems. This value will be "unknown" for all dependencies in unsupported ecosystems. Known values: unknown, direct, transitive, inconclusive Read only: true
relationship (anyOf 2)	null	Alternative
scope	JSON	Optional
scope (anyOf 1)	string	Alternative	The execution scope of the vulnerable dependency. Known values: development, runtime Read only: true
scope (anyOf 2)	null	Alternative
version_requirement	JSON	Optional
version_requirement (anyOf 1)	string	Alternative	The dependency version or version constraint last recorded for the dependency associated with this alert. For dependencies detected from a lockfile, this can be the resolved version. For manifest-only dependencies, it can be the declared version constraint. Returns `null` when unavailable. An empty string can indicate an unconstrained dependency. The stored value is limited to 64 bytes; longer requirements may have been truncated and may no longer form a complete, valid version constraint. When multiple vulnerable versions of a dependency correspond to the same alert, this field contains one recorded version or constraint and may not represent all vulnerable versions. Read only: true
version_requirement (anyOf 2)	null	Alternative

Referenced models: Get a Dependabot alert — response body — dependency package

Get a Dependabot alert — response body — dependency package

Field	Type	Presence	Description and constraints
$	object	Root	Details for the vulnerable package. Read only: true Additional keys: not allowed
ecosystem	string	Required within parent	The package's language or package management ecosystem. Read only: true
name	string	Required within parent	The unique package name within its ecosystem. Read only: true

Get a Dependabot alert — response body — dismissal request

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	Information about an active dismissal request for this Dependabot alert.
$ (anyOf 1).created_at	string	Optional	The date and time when the dismissal request was created. Format: date-time
$ (anyOf 1).id	JSON	Optional
$ (anyOf 1).id (anyOf 1)	integer	Alternative	The unique identifier of the dismissal request.
$ (anyOf 1).id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester	object	Optional	The user who requested the dismissal.
$ (anyOf 1).requester.id	JSON	Optional
$ (anyOf 1).requester.id (anyOf 1)	integer	Alternative	The unique identifier of the user.
$ (anyOf 1).requester.id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).requester.login	string	Optional	The login name of the user.
$ (anyOf 1).status	string	Optional	The current status of the dismissal request. Known values: pending, approved, rejected, cancelled
$ (anyOf 1).url	string	Optional	The API URL to get more information about this dismissal request. Format: uri
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — dismissed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — fixed at

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	string	Alternative	The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
$ (anyOf 2)	null	Alternative

Get a Dependabot alert — response body — number

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	integer	Alternative	The security alert number. Read only: true
$ (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Get a Dependabot alert — response body — reachability

Field	Type	Presence	Description and constraints
$	object	Root	The reachability result for the vulnerability that triggered the alert, indicating whether a vulnerable function is reachable from the repository's own code. Read only: true Additional keys: not allowed
reason	string	Optional	The reason for the reachability verdict. This field is omitted when reachability analysis is disabled or no result has been computed. Known values: unknown, unavailable_unsupported_ecosystem, unavailable_analysis_timed_out, potentially_reachable_invalid_manifest_path, potentially_reachable_missing_vulnerable_function_annotation, potentially_reachable_dependency_not_found, potentially_reachable_dependency_analysis_incomplete, potentially_reachable_repository_analysis_incomplete, potentially_reachable_call_found_outside_manifest_scope, potentially_reachable_unclassified_analysis_state, reachable_vulnerable_function_called, unreachable_vulnerable_function_not_called, potentially_reachable_unresolved_dynamic_call Read only: true
verdict	string	Required within parent	The reachability verdict for the alert. - `reachable`: a path from the repository's code reaches a vulnerable function. - `unreachable`: no path from the repository's code reaches a vulnerable function. - `potentially_reachable`: reachability could not be determined with confidence; review manually. - `unavailable`: no verdict has been computed for the alert yet. - `disabled`: reachability analysis is not enabled for the repository. Known values: reachable, unreachable, potentially_reachable, unavailable, disabled Read only: true

Get a Dependabot alert — response body — security advisory

Field	Type	Presence	Description and constraints
$	object	Root	Details for the GitHub Security Advisory. Read only: true Additional keys: not allowed
classification	string	Optional	The classification of the advisory. Known values: general, malware Read only: true
cve_id	JSON	Required within parent
cve_id (anyOf 1)	string	Alternative	The unique CVE ID assigned to the advisory. Read only: true
cve_id (anyOf 2)	null	Alternative
cvss_severities	Model	Optional	Expand Get a global security advisory — response body — cvss severities
cwes	array	Required within parent	Details for the advisory pertaining to Common Weakness Enumeration. Read only: true
cwes[]	object	Each item	A CWE weakness assigned to the advisory. Read only: true Additional keys: not allowed
cwes[].cwe_id	string	Required within parent	The unique CWE ID. Read only: true
cwes[].name	string	Required within parent	The short, plain text name of the CWE. Read only: true
description	string	Required within parent	A long-form Markdown-supported description of the advisory. Read only: true
epss	Model	Optional	Expand Get a global security advisory — response body — epss
ghsa_id	string	Required within parent	The unique GitHub Security Advisory ID assigned to the advisory. Read only: true
identifiers	array	Required within parent	Values that identify this advisory among security information sources. Read only: true
identifiers[]	object	Each item	An advisory identifier. Read only: true Additional keys: not allowed
identifiers[].type	string	Required within parent	The type of advisory identifier. Known values: CVE, GHSA Read only: true
identifiers[].value	string	Required within parent	The value of the advisory identifer. Read only: true
published_at	string	Required within parent	The time that the advisory was published in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
references	array	Required within parent	Links to additional advisory information. Read only: true
references[]	object	Each item	A link to additional advisory information. Read only: true Additional keys: not allowed
references[].url	string	Required within parent	The URL of the reference. Format: uri Read only: true
severity	string	Required within parent	The severity of the advisory. Known values: low, medium, high, critical Read only: true
summary	string	Required within parent	A short, plain text summary of the advisory. Maximum length: 1024 Read only: true
updated_at	string	Required within parent	The time that the advisory was last modified in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
vulnerabilities	array	Required within parent	Vulnerable version range information for the advisory. Read only: true
vulnerabilities[]	Model	Each item	Expand Get a Dependabot alert — response body — security vulnerability
withdrawn_at	JSON	Required within parent
withdrawn_at (anyOf 1)	string	Alternative	The time that the advisory was withdrawn in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
withdrawn_at (anyOf 2)	null	Alternative

Referenced models: Get a global security advisory — response body — cvss severities, Get a Dependabot alert — response body — security vulnerability, Get a global security advisory — response body — epss

Get a Dependabot alert — response body — security vulnerability

Field	Type	Presence	Description and constraints
$	object	Root	Details pertaining to one vulnerable version range for the advisory. Read only: true Additional keys: not allowed
first_patched_version	JSON	Required within parent
first_patched_version (anyOf 1)	object	Alternative	Details pertaining to the package version that patches this vulnerability. Read only: true Additional keys: not allowed
first_patched_version (anyOf 1).identifier	string	Required within parent	The package version that patches this vulnerability. Read only: true
first_patched_version (anyOf 2)	null	Alternative
package	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency package
severity	string	Required within parent	The severity of the vulnerability. Known values: low, medium, high, critical Read only: true
vulnerable_version_range	string	Required within parent	Conditions that identify vulnerable versions of this vulnerability's package. Read only: true

Referenced models: Get a Dependabot alert — response body — dependency package

Get a repository public key — dependabot dependabot Get Repo Public Key — response body

Field	Type	Presence	Description and constraints
$	object	Root	The public key used for setting Dependabot Secrets.
key	string	Required within parent	The Base64 encoded public key.
key_id	string	Required within parent	The identifier for the key.

Get a repository secret — dependabot dependabot Get Repo Secret — response body

Field	Type	Presence	Description and constraints
$	object	Root	Set secrets for Dependabot.
created_at	string	Required within parent	Format: date-time
name	string	Required within parent	The name of the secret.
updated_at	string	Required within parent	Format: date-time

Get an organization secret — dependabot dependabot Get Org Secret — response body

Field	Type	Presence	Description and constraints
$	object	Root	Secrets for GitHub Dependabot for an organization.
created_at	string	Required within parent	Format: date-time
name	string	Required within parent	The name of the secret.
selected_repositories_url	string	Optional	Format: uri
updated_at	string	Required within parent	Format: date-time
visibility	string	Required within parent	Visibility of a secret Known values: all, private, selected

List Dependabot alerts for an enterprise — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	A Dependabot alert. Additional keys: not allowed
assignees	array	Optional	The users assigned to this alert. Read only: true
assignees[]	Model	Each item	Expand List users — response body — item
auto_dismissed_at	Model	Optional	Expand Get a Dependabot alert — response body — auto dismissed at
created_at	string	Required within parent	The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
dependency	Model	Required within parent	Expand Get a Dependabot alert — response body — dependency
dismissal_request	Model	Optional	Expand Get a Dependabot alert — response body — dismissal request
dismissed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — dismissed at
dismissed_by	Model	Required within parent	Expand Get an issue — response body — user
dismissed_comment	JSON	Required within parent
dismissed_comment (anyOf 1)	string	Alternative	An optional comment associated with the alert's dismissal. Maximum length: 280
dismissed_comment (anyOf 2)	null	Alternative
dismissed_reason	JSON	Required within parent
dismissed_reason (anyOf 1)	string	Alternative	The reason that the alert was dismissed. Known values: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk
dismissed_reason (anyOf 2)	null	Alternative
fixed_at	Model	Required within parent	Expand Get a Dependabot alert — response body — fixed at
html_url	string	Required within parent	The GitHub URL of the alert resource. Format: uri Read only: true
number	Model	Required within parent	Expand Get a Dependabot alert — response body — number
reachability	Model	Optional	Expand Get a Dependabot alert — response body — reachability
repository	Model	Required within parent	Expand List repositories for a user migration — response body — item
security_advisory	Model	Required within parent	Expand Get a Dependabot alert — response body — security advisory
security_vulnerability	Model	Required within parent	Expand Get a Dependabot alert — response body — security vulnerability
state	string	Required within parent	The state of the Dependabot alert. Known values: auto_dismissed, dismissed, fixed, open Read only: true
updated_at	string	Required within parent	The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. Format: date-time Read only: true
url	string	Required within parent	The REST API URL of the alert resource. Format: uri Read only: true

Referenced models: Get a Dependabot alert — response body — auto dismissed at, Get a Dependabot alert — response body — dismissed at, Get a Dependabot alert — response body — fixed at, Get a Dependabot alert — response body — number, Get a Dependabot alert — response body — dismissal request, Get a Dependabot alert — response body — security advisory, Get a Dependabot alert — response body — security vulnerability, Get an issue — response body — user, List repositories for a user migration — response body — item, List users — response body — item, Get a Dependabot alert — response body — dependency, Get a Dependabot alert — response body — reachability

Lists the repositories Dependabot can access in an enterprise — response body

Field	Type	Presence	Description and constraints
$	object	Root	Information about repositories that Dependabot is able to access in an organization Additional keys: not allowed
accessible_repositories	array	Optional
accessible_repositories[]	Model	Each item	Expand Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item
default_level	JSON	Optional
default_level (anyOf 1)	string	Alternative	The default repository access level for Dependabot updates. Known values: public, internal
default_level (anyOf 2)	null	Alternative

Referenced models: Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item

Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	Model	Alternative	Expand Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item A Git Hub repository
$ (anyOf 2)	null	Alternative

Referenced models: Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item A Git Hub repository

Lists the repositories Dependabot can access in an enterprise — response body — accessible repositories item A Git Hub repository

Field	Type	Presence	Description and constraints
$	object	Root	A GitHub repository.
archive_url	string	Required within parent	A template for the API URL to download the repository as an archive.
assignees_url	string	Required within parent	A template for the API URL to list the available assignees for issues in the repository.
blobs_url	string	Required within parent	A template for the API URL to create or retrieve a raw Git blob in the repository.
branches_url	string	Required within parent	A template for the API URL to get information about branches in the repository.
collaborators_url	string	Required within parent	A template for the API URL to get information about collaborators of the repository.
comments_url	string	Required within parent	A template for the API URL to get information about comments on the repository.
commits_url	string	Required within parent	A template for the API URL to get information about commits on the repository.
compare_url	string	Required within parent	A template for the API URL to compare two commits or refs.
contents_url	string	Required within parent	A template for the API URL to get the contents of the repository.
contributors_url	string	Required within parent	A template for the API URL to list the contributors to the repository. Format: uri
deployments_url	string	Required within parent	The API URL to list the deployments of the repository. Format: uri
description	JSON	Required within parent
description (anyOf 1)	string	Alternative	The repository description.
description (anyOf 2)	null	Alternative
downloads_url	string	Required within parent	The API URL to list the downloads on the repository. Format: uri
events_url	string	Required within parent	The API URL to list the events of the repository. Format: uri
fork	boolean	Required within parent	Whether the repository is a fork.
forks_url	string	Required within parent	The API URL to list the forks of the repository. Format: uri
full_name	string	Required within parent	The full, globally unique, name of the repository.
git_commits_url	string	Required within parent	A template for the API URL to get information about Git commits of the repository.
git_refs_url	string	Required within parent	A template for the API URL to get information about Git refs of the repository.
git_tags_url	string	Required within parent	A template for the API URL to get information about Git tags of the repository.
hooks_url	string	Required within parent	The API URL to list the hooks on the repository. Format: uri
html_url	string	Required within parent	The URL to view the repository on GitHub.com. Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	A unique identifier of the repository. Format: int64
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
issue_comment_url	string	Required within parent	A template for the API URL to get information about issue comments on the repository.
issue_events_url	string	Required within parent	A template for the API URL to get information about issue events on the repository.
issues_url	string	Required within parent	A template for the API URL to get information about issues on the repository.
keys_url	string	Required within parent	A template for the API URL to get information about deploy keys on the repository.
labels_url	string	Required within parent	A template for the API URL to get information about labels of the repository.
languages_url	string	Required within parent	The API URL to get information about the languages of the repository. Format: uri
merges_url	string	Required within parent	The API URL to merge branches in the repository. Format: uri
milestones_url	string	Required within parent	A template for the API URL to get information about milestones of the repository.
name	string	Required within parent	The name of the repository.
node_id	string	Required within parent	The GraphQL identifier of the repository.
notifications_url	string	Required within parent	A template for the API URL to get information about notifications on the repository.
owner	Model	Required within parent	Expand List users — response body — item
private	boolean	Required within parent	Whether the repository is private.
pulls_url	string	Required within parent	A template for the API URL to get information about pull requests on the repository.
releases_url	string	Required within parent	A template for the API URL to get information about releases on the repository.
stargazers_url	string	Required within parent	The API URL to list the stargazers on the repository. Format: uri
statuses_url	string	Required within parent	A template for the API URL to get information about statuses of a commit.
subscribers_url	string	Required within parent	The API URL to list the subscribers on the repository. Format: uri
subscription_url	string	Required within parent	The API URL to subscribe to notifications for this repository. Format: uri
tags_url	string	Required within parent	The API URL to get information about tags on the repository. Format: uri
teams_url	string	Required within parent	The API URL to list the teams on the repository. Format: uri
trees_url	string	Required within parent	A template for the API URL to create or retrieve a raw Git tree of the repository.
url	string	Required within parent	The URL to get more information about the repository from the GitHub API. Format: uri

Referenced models: List users — response body — item