GitHub: Security advisories schemas
13 GitHub schemas with complete fields and constraints.
← Security advisories operations · All schemas
Create a repository security advisory — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Additional keys: not allowed |
credits | JSON | Optional | |
credits (anyOf 1) | array | Alternative | A list of users receiving credit for their participation in the security advisory. |
credits (anyOf 1)[] | object | Each item | Additional keys: not allowed |
credits (anyOf 1)[].login | string | Required within parent | The username of the user credited. |
credits (anyOf 1)[].type | string | Required within parent | The type of credit the user is receiving. One of: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other |
credits (anyOf 2) | null | Alternative | |
cve_id | JSON | Optional | |
cve_id (anyOf 1) | string | Alternative | The Common Vulnerabilities and Exposures (CVE) ID. |
cve_id (anyOf 2) | null | Alternative | |
cvss_vector_string | JSON | Optional | |
cvss_vector_string (anyOf 1) | string | Alternative | The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`. |
cvss_vector_string (anyOf 2) | null | Alternative | |
cwe_ids | JSON | Optional | |
cwe_ids (anyOf 1) | array | Alternative | A list of Common Weakness Enumeration (CWE) IDs. |
cwe_ids (anyOf 1)[] | string | Each item | |
cwe_ids (anyOf 2) | null | Alternative | |
description | string | Required within parent | A detailed description of what the advisory impacts. Maximum length: 65535 |
severity | JSON | Optional | |
severity (anyOf 1) | string | Alternative | The severity of the advisory. You must choose between setting this field or `cvss_vector_string`. One of: critical, high, medium, low |
severity (anyOf 2) | null | Alternative | |
start_private_fork | boolean | Optional | Whether to create a temporary private fork of the repository to collaborate on a fix. Default: false |
summary | string | Required within parent | A short summary of the advisory. Maximum length: 1024 |
vulnerabilities | array | Required within parent | A product affected by the vulnerability detailed in a repository security advisory. |
vulnerabilities[] | Model | Each item | Expand Create a repository security advisory — request body — body vulnerabilities item |
Referenced models: Create a repository security advisory — request body — body vulnerabilities item
Create a repository security advisory — request body — body vulnerabilities item
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Additional keys: not allowed |
package | object | Required within parent | The name of the package affected by the vulnerability. |
package.ecosystem | string | Required within parent | The package's language or package management ecosystem. One of: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift |
package.name | JSON | Optional | |
package.name (anyOf 1) | string | Alternative | The unique package name within its ecosystem. |
package.name (anyOf 2) | null | Alternative | |
patched_versions | JSON | Optional | |
patched_versions (anyOf 1) | string | Alternative | The package version(s) that resolve the vulnerability. |
patched_versions (anyOf 2) | null | Alternative | |
vulnerable_functions | JSON | Optional | |
vulnerable_functions (anyOf 1) | array | Alternative | The functions in the package that are affected. |
vulnerable_functions (anyOf 1)[] | string | Each item | |
vulnerable_functions (anyOf 2) | null | Alternative | |
vulnerable_version_range | JSON | Optional | |
vulnerable_version_range (anyOf 1) | string | Alternative | The range of the package versions affected by the vulnerability. |
vulnerable_version_range (anyOf 2) | null | Alternative |
Get a global security advisory — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A GitHub Security Advisory. Additional keys: not allowed |
credits | JSON | Required within parent | |
credits (anyOf 1) | array | Alternative | The users who contributed to the advisory. Read only: true |
credits (anyOf 1)[] | object | Each item | |
credits (anyOf 1)[].type | string | Required within parent | The type of credit the user is receiving. Known values: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other |
credits (anyOf 1)[].user | Model | Required within parent | Expand List users — response body — item |
credits (anyOf 2) | null | Alternative | |
cve_id | JSON | Required within parent | |
cve_id (anyOf 1) | string | Alternative | The Common Vulnerabilities and Exposures (CVE) ID. Read only: true |
cve_id (anyOf 2) | null | Alternative | |
cvss_severities | Model | Optional | Expand Get a global security advisory — response body — cvss severities |
cwes | JSON | Required within parent | |
cwes (anyOf 1) | array | Alternative | |
cwes (anyOf 1)[] | object | Each item | |
cwes (anyOf 1)[].cwe_id | string | Required within parent | The Common Weakness Enumeration (CWE) identifier. |
cwes (anyOf 1)[].name | string | Required within parent | The name of the CWE. Read only: true |
cwes (anyOf 2) | null | Alternative | |
description | JSON | Required within parent | |
description (anyOf 1) | string | Alternative | A detailed description of what the advisory entails. Maximum length: 65535 |
description (anyOf 2) | null | Alternative | |
epss | Model | Optional | Expand Get a global security advisory — response body — epss |
ghsa_id | string | Required within parent | The GitHub Security Advisory ID. Read only: true |
github_reviewed_at | JSON | Required within parent | |
github_reviewed_at (anyOf 1) | string | Alternative | The date and time of when the advisory was reviewed by GitHub, in ISO 8601 format. Format: date-time Read only: true |
github_reviewed_at (anyOf 2) | null | Alternative | |
html_url | string | Required within parent | The URL for the advisory. Format: uri Read only: true |
identifiers | JSON | Required within parent | |
identifiers (anyOf 1) | array | Alternative | Read only: true |
identifiers (anyOf 1)[] | object | Each item | |
identifiers (anyOf 1)[].type | string | Required within parent | The type of identifier. Known values: CVE, GHSA |
identifiers (anyOf 1)[].value | string | Required within parent | The identifier value. |
identifiers (anyOf 2) | null | Alternative | |
nvd_published_at | JSON | Required within parent | |
nvd_published_at (anyOf 1) | string | Alternative | The date and time when the advisory was published in the National Vulnerability Database, in ISO 8601 format. This field is only populated when the advisory is imported from the National Vulnerability Database. Format: date-time Read only: true |
nvd_published_at (anyOf 2) | null | Alternative | |
published_at | string | Required within parent | The date and time of when the advisory was published, in ISO 8601 format. Format: date-time Read only: true |
references | JSON | Required within parent | |
references (anyOf 1) | array | Alternative | |
references (anyOf 1)[] | string | Each item | URLs with more information regarding the advisory. |
references (anyOf 2) | null | Alternative | |
repository_advisory_url | JSON | Required within parent | |
repository_advisory_url (anyOf 1) | string | Alternative | The API URL for the repository advisory. Format: uri Read only: true |
repository_advisory_url (anyOf 2) | null | Alternative | |
severity | string | Required within parent | The severity of the advisory. Known values: critical, high, medium, low, unknown |
source_code_location | JSON | Required within parent | |
source_code_location (anyOf 1) | string | Alternative | The URL of the advisory's source code. Format: uri |
source_code_location (anyOf 2) | null | Alternative | |
summary | string | Required within parent | A short summary of the advisory. Maximum length: 1024 |
type | string | Required within parent | The type of advisory. Known values: reviewed, unreviewed, malware Read only: true |
updated_at | string | Required within parent | The date and time of when the advisory was last updated, in ISO 8601 format. Format: date-time Read only: true |
url | string | Required within parent | The API URL for the advisory. Read only: true |
vulnerabilities | JSON | Required within parent | |
vulnerabilities (anyOf 1) | array | Alternative | The products and respective version ranges affected by the advisory. |
vulnerabilities (anyOf 1)[] | Model | Each item | Expand Get a global security advisory — response body — vulnerabilities array item |
vulnerabilities (anyOf 2) | null | Alternative | |
withdrawn_at | JSON | Required within parent | |
withdrawn_at (anyOf 1) | string | Alternative | The date and time of when the advisory was withdrawn, in ISO 8601 format. Format: date-time Read only: true |
withdrawn_at (anyOf 2) | null | Alternative |
Referenced models: Get a global security advisory — response body — cvss severities, Get a global security advisory — response body — epss, List users — response body — item, Get a global security advisory — response body — vulnerabilities array item
Get a global security advisory — response body — cvss severities
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | JSON | Root | |
$ (anyOf 1) | object | Alternative | |
$ (anyOf 1).cvss_v3 | JSON | Optional | |
$ (anyOf 1).cvss_v3 (anyOf 1) | object | Alternative | |
$ (anyOf 1).cvss_v3 (anyOf 1).score | JSON | Required within parent | |
$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1) | JSON | Alternative | |
$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1) (anyOf 1) | number | Alternative | The CVSS 3 score. Maximum: 10 Minimum: 0 Read only: true |
$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1) (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 2) | null | Alternative | |
$ (anyOf 1).cvss_v3 (anyOf 1).vector_string | JSON | Required within parent | |
$ (anyOf 1).cvss_v3 (anyOf 1).vector_string (anyOf 1) | string | Alternative | The CVSS 3 vector string. |
$ (anyOf 1).cvss_v3 (anyOf 1).vector_string (anyOf 2) | null | Alternative | |
$ (anyOf 1).cvss_v3 (anyOf 2) | null | Alternative | |
$ (anyOf 1).cvss_v4 | JSON | Optional | |
$ (anyOf 1).cvss_v4 (anyOf 1) | object | Alternative | |
$ (anyOf 1).cvss_v4 (anyOf 1).score | JSON | Required within parent | |
$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1) | JSON | Alternative | |
$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1) (anyOf 1) | number | Alternative | The CVSS 4 score. Maximum: 10 Minimum: 0 Read only: true |
$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1) (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 2) | null | Alternative | |
$ (anyOf 1).cvss_v4 (anyOf 1).vector_string | JSON | Required within parent | |
$ (anyOf 1).cvss_v4 (anyOf 1).vector_string (anyOf 1) | string | Alternative | The CVSS 4 vector string. |
$ (anyOf 1).cvss_v4 (anyOf 1).vector_string (anyOf 2) | null | Alternative | |
$ (anyOf 1).cvss_v4 (anyOf 2) | null | Alternative | |
$ (anyOf 2) | null | Alternative |
Get a global security advisory — response body — epss
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | JSON | Root | |
$ (anyOf 1) | object | Alternative | The EPSS scores as calculated by the [Exploit Prediction Scoring System](https://www.first.org/epss). Read only: true |
$ (anyOf 1).percentage | JSON | Optional | |
$ (anyOf 1).percentage (anyOf 1) | number | Alternative | Maximum: 100 Minimum: 0 |
$ (anyOf 1).percentage (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
$ (anyOf 1).percentile | JSON | Optional | |
$ (anyOf 1).percentile (anyOf 1) | number | Alternative | Maximum: 100 Minimum: 0 |
$ (anyOf 1).percentile (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
$ (anyOf 2) | null | Alternative |
Get a global security advisory — response body — vulnerabilities array item
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A vulnerability describing the product and its affected versions within a GitHub Security Advisory. |
first_patched_version | JSON | Required within parent | |
first_patched_version (anyOf 1) | string | Alternative | The package version that resolves the vulnerability. |
first_patched_version (anyOf 2) | null | Alternative | |
package | JSON | Required within parent | |
package (anyOf 1) | Model | Alternative | Expand Get a global security advisory — response body — vulnerabilities array item package ecosystem, name |
package (anyOf 2) | null | Alternative | |
vulnerable_functions | JSON | Required within parent | |
vulnerable_functions (anyOf 1) | array | Alternative | The functions in the package that are affected by the vulnerability. Read only: true |
vulnerable_functions (anyOf 1)[] | string | Each item | |
vulnerable_functions (anyOf 2) | null | Alternative | |
vulnerable_version_range | JSON | Required within parent | |
vulnerable_version_range (anyOf 1) | string | Alternative | The range of the package versions affected by the vulnerability. |
vulnerable_version_range (anyOf 2) | null | Alternative |
Referenced models: Get a global security advisory — response body — vulnerabilities array item package ecosystem, name
Get a global security advisory — response body — vulnerabilities array item package ecosystem, name
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | The name of the package affected by the vulnerability. |
ecosystem | string | Required within parent | The package's language or package management ecosystem. Known values: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift |
name | JSON | Required within parent | |
name (anyOf 1) | string | Alternative | The unique package name within its ecosystem. |
name (anyOf 2) | null | Alternative |
Get a repository advisory comment — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A comment on a repository security advisory. Additional keys: not allowed |
advisory_url | string | Required within parent | Format: uri |
author_association | string | Required within parent | How the author is associated with the repository. Known values: COLLABORATOR, CONTRIBUTOR, FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, MANNEQUIN, MEMBER, NONE, OWNER |
body | string | Required within parent | Contents of the advisory comment. |
created_at | string | Required within parent | Format: date-time |
html_url | string | Required within parent | Web URL for the advisory comment. Format: uri |
id | JSON | Required within parent | |
id (anyOf 1) | integer | Alternative | Unique identifier of the advisory comment. Format: int64 |
id (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
node_id | string | Required within parent | |
updated_at | string | Required within parent | Format: date-time |
url | string | Required within parent | API URL for the advisory comment. Format: uri |
user | Model | Required within parent | Expand Get an issue — response body — user |
Referenced models: Get an issue — response body — user
Get a repository security advisory — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A repository security advisory. Additional keys: not allowed |
author | JSON | Required within parent | |
author (anyOf 1) | JSON | Alternative | The author of the advisory. Read only: true |
author (anyOf 1) (allOf 1) | Model | All variants apply | Expand List users — response body — item |
author (anyOf 2) | null | Alternative | |
closed_at | JSON | Required within parent | |
closed_at (anyOf 1) | string | Alternative | The date and time of when the advisory was closed, in ISO 8601 format. Format: date-time Read only: true |
closed_at (anyOf 2) | null | Alternative | |
collaborating_teams | JSON | Required within parent | |
collaborating_teams (anyOf 1) | array | Alternative | A list of teams that collaborate on the advisory. |
collaborating_teams (anyOf 1)[] | Model | Each item | Expand List teams — response body — item |
collaborating_teams (anyOf 2) | null | Alternative | |
collaborating_users | JSON | Required within parent | |
collaborating_users (anyOf 1) | array | Alternative | A list of users that collaborate on the advisory. |
collaborating_users (anyOf 1)[] | Model | Each item | Expand List users — response body — item |
collaborating_users (anyOf 2) | null | Alternative | |
created_at | JSON | Required within parent | |
created_at (anyOf 1) | string | Alternative | The date and time of when the advisory was created, in ISO 8601 format. Format: date-time Read only: true |
created_at (anyOf 2) | null | Alternative | |
credits | JSON | Required within parent | |
credits (anyOf 1) | array | Alternative | |
credits (anyOf 1)[] | object | Each item | |
credits (anyOf 1)[].login | string | Optional | The username of the user credited. |
credits (anyOf 1)[].type | string | Optional | The type of credit the user is receiving. Known values: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other |
credits (anyOf 2) | null | Alternative | |
credits_detailed | JSON | Required within parent | |
credits_detailed (anyOf 1) | array | Alternative | Read only: true |
credits_detailed (anyOf 1)[] | Model | Each item | Expand Get a repository security advisory — response body — credits detailed array item |
credits_detailed (anyOf 2) | null | Alternative | |
cve_id | JSON | Required within parent | |
cve_id (anyOf 1) | string | Alternative | The Common Vulnerabilities and Exposures (CVE) ID. |
cve_id (anyOf 2) | null | Alternative | |
cvss_severities | Model | Optional | Expand Get a global security advisory — response body — cvss severities |
cwe_ids | JSON | Required within parent | |
cwe_ids (anyOf 1) | array | Alternative | A list of only the CWE IDs. |
cwe_ids (anyOf 1)[] | string | Each item | |
cwe_ids (anyOf 2) | null | Alternative | |
cwes | JSON | Required within parent | |
cwes (anyOf 1) | array | Alternative | Read only: true |
cwes (anyOf 1)[] | object | Each item | |
cwes (anyOf 1)[].cwe_id | string | Required within parent | The Common Weakness Enumeration (CWE) identifier. |
cwes (anyOf 1)[].name | string | Required within parent | The name of the CWE. Read only: true |
cwes (anyOf 2) | null | Alternative | |
description | JSON | Required within parent | |
description (anyOf 1) | string | Alternative | A detailed description of what the advisory entails. Maximum length: 65535 |
description (anyOf 2) | null | Alternative | |
ghsa_id | string | Required within parent | The GitHub Security Advisory ID. Read only: true |
html_url | string | Required within parent | The URL for the advisory. Format: uri Read only: true |
identifiers | array | Required within parent | Read only: true |
identifiers[] | object | Each item | |
identifiers[].type | string | Required within parent | The type of identifier. Known values: CVE, GHSA |
identifiers[].value | string | Required within parent | The identifier value. |
private_fork | JSON | Required within parent | |
private_fork (anyOf 1) | JSON | Alternative | A temporary private fork of the advisory's repository for collaborating on a fix. Read only: true |
private_fork (anyOf 1) (allOf 1) | Model | All variants apply | Expand List repositories for a user migration — response body — item |
private_fork (anyOf 2) | null | Alternative | |
published_at | JSON | Required within parent | |
published_at (anyOf 1) | string | Alternative | The date and time of when the advisory was published, in ISO 8601 format. Format: date-time Read only: true |
published_at (anyOf 2) | null | Alternative | |
publisher | JSON | Required within parent | |
publisher (anyOf 1) | JSON | Alternative | The publisher of the advisory. Read only: true |
publisher (anyOf 1) (allOf 1) | Model | All variants apply | Expand List users — response body — item |
publisher (anyOf 2) | null | Alternative | |
severity | JSON | Required within parent | |
severity (anyOf 1) | string | Alternative | The severity of the advisory. Known values: critical, high, medium, low |
severity (anyOf 2) | null | Alternative | |
state | string | Required within parent | The state of the advisory. Known values: published, closed, withdrawn, draft, triage |
submission | JSON | Required within parent | |
submission (anyOf 1) | object | Alternative | Read only: true |
submission (anyOf 1).accepted | boolean | Required within parent | Whether a private vulnerability report was accepted by the repository's administrators. Read only: true |
submission (anyOf 2) | null | Alternative | |
summary | string | Required within parent | A short summary of the advisory. Maximum length: 1024 |
updated_at | JSON | Required within parent | |
updated_at (anyOf 1) | string | Alternative | The date and time of when the advisory was last updated, in ISO 8601 format. Format: date-time Read only: true |
updated_at (anyOf 2) | null | Alternative | |
url | string | Required within parent | The API URL for the advisory. Format: uri Read only: true |
vulnerabilities | JSON | Required within parent | |
vulnerabilities (anyOf 1) | array | Alternative | |
vulnerabilities (anyOf 1)[] | Model | Each item | Expand Get a repository security advisory — response body — vulnerabilities array item |
vulnerabilities (anyOf 2) | null | Alternative | |
withdrawn_at | JSON | Required within parent | |
withdrawn_at (anyOf 1) | string | Alternative | The date and time of when the advisory was withdrawn, in ISO 8601 format. Format: date-time Read only: true |
withdrawn_at (anyOf 2) | null | Alternative |
Referenced models: Get a global security advisory — response body — cvss severities, Get a repository security advisory — response body — credits detailed array item, Get a repository security advisory — response body — vulnerabilities array item, List repositories for a user migration — response body — item, List users — response body — item, List teams — response body — item
Get a repository security advisory — response body — credits detailed array item
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A credit given to a user for a repository security advisory. Additional keys: not allowed |
state | string | Required within parent | The state of the user's acceptance of the credit. Known values: accepted, declined, pending |
type | string | Required within parent | The type of credit the user is receiving. Known values: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other |
user | Model | Required within parent | Expand List users — response body — item |
Referenced models: List users — response body — item
Get a repository security advisory — response body — vulnerabilities array item
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | A product affected by the vulnerability detailed in a repository security advisory. Additional keys: not allowed |
package | JSON | Required within parent | |
package (anyOf 1) | Model | Alternative | Expand Get a global security advisory — response body — vulnerabilities array item package ecosystem, name |
package (anyOf 2) | null | Alternative | |
patched_versions | JSON | Required within parent | |
patched_versions (anyOf 1) | string | Alternative | The package version(s) that resolve the vulnerability. |
patched_versions (anyOf 2) | null | Alternative | |
vulnerable_functions | JSON | Required within parent | |
vulnerable_functions (anyOf 1) | array | Alternative | The functions in the package that are affected. |
vulnerable_functions (anyOf 1)[] | string | Each item | |
vulnerable_functions (anyOf 2) | null | Alternative | |
vulnerable_version_range | JSON | Required within parent | |
vulnerable_version_range (anyOf 1) | string | Alternative | The range of the package versions affected by the vulnerability. |
vulnerable_version_range (anyOf 2) | null | Alternative |
Referenced models: Get a global security advisory — response body — vulnerabilities array item package ecosystem, name
Privately report a security vulnerability — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Additional keys: not allowed |
cvss_vector_string | JSON | Optional | |
cvss_vector_string (anyOf 1) | string | Alternative | The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`. |
cvss_vector_string (anyOf 2) | null | Alternative | |
cwe_ids | JSON | Optional | |
cwe_ids (anyOf 1) | array | Alternative | A list of Common Weakness Enumeration (CWE) IDs. |
cwe_ids (anyOf 1)[] | string | Each item | |
cwe_ids (anyOf 2) | null | Alternative | |
description | string | Required within parent | A detailed description of what the advisory impacts. Maximum length: 65535 |
severity | JSON | Optional | |
severity (anyOf 1) | string | Alternative | The severity of the advisory. You must choose between setting this field or `cvss_vector_string`. One of: critical, high, medium, low |
severity (anyOf 2) | null | Alternative | |
start_private_fork | boolean | Optional | Whether to create a temporary private fork of the repository to collaborate on a fix. The fork is created only if you are permitted to create one; otherwise, this parameter is ignored and the report is still created. Default: false |
summary | string | Required within parent | A short summary of the advisory. Maximum length: 1024 |
vulnerabilities | JSON | Optional | |
vulnerabilities (anyOf 1) | array | Alternative | An array of products affected by the vulnerability detailed in a repository security advisory. |
vulnerabilities (anyOf 1)[] | Model | Each item | Expand Create a repository security advisory — request body — body vulnerabilities item |
vulnerabilities (anyOf 2) | null | Alternative |
Referenced models: Create a repository security advisory — request body — body vulnerabilities item
Update a repository security advisory — request body — body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Additional keys: not allowed |
collaborating_teams | JSON | Optional | |
collaborating_teams (anyOf 1) | array | Alternative | A list of team slugs which have been granted write access to the advisory. |
collaborating_teams (anyOf 1)[] | string | Each item | |
collaborating_teams (anyOf 2) | null | Alternative | |
collaborating_users | JSON | Optional | |
collaborating_users (anyOf 1) | array | Alternative | A list of usernames who have been granted write access to the advisory. |
collaborating_users (anyOf 1)[] | string | Each item | |
collaborating_users (anyOf 2) | null | Alternative | |
credits | JSON | Optional | |
credits (anyOf 1) | array | Alternative | A list of users receiving credit for their participation in the security advisory. |
credits (anyOf 1)[] | object | Each item | Additional keys: not allowed |
credits (anyOf 1)[].login | string | Required within parent | The username of the user credited. |
credits (anyOf 1)[].type | string | Required within parent | The type of credit the user is receiving. One of: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other |
credits (anyOf 2) | null | Alternative | |
cve_id | JSON | Optional | |
cve_id (anyOf 1) | string | Alternative | The Common Vulnerabilities and Exposures (CVE) ID. |
cve_id (anyOf 2) | null | Alternative | |
cvss_vector_string | JSON | Optional | |
cvss_vector_string (anyOf 1) | string | Alternative | The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`. |
cvss_vector_string (anyOf 2) | null | Alternative | |
cwe_ids | JSON | Optional | |
cwe_ids (anyOf 1) | array | Alternative | A list of Common Weakness Enumeration (CWE) IDs. |
cwe_ids (anyOf 1)[] | string | Each item | |
cwe_ids (anyOf 2) | null | Alternative | |
description | string | Optional | A detailed description of what the advisory impacts. Maximum length: 65535 |
severity | JSON | Optional | |
severity (anyOf 1) | string | Alternative | The severity of the advisory. You must choose between setting this field or `cvss_vector_string`. One of: critical, high, medium, low |
severity (anyOf 2) | null | Alternative | |
state | string | Optional | The state of the advisory. One of: published, closed, draft |
summary | string | Optional | A short summary of the advisory. Maximum length: 1024 |
vulnerabilities | array | Optional | A product affected by the vulnerability detailed in a repository security advisory. |
vulnerabilities[] | Model | Each item | Expand Create a repository security advisory — request body — body vulnerabilities item |
Referenced models: Create a repository security advisory — request body — body vulnerabilities item