List locations for a secret scanning alert

Lists all locations for a given secret scanning alert for an eligible repository.
To use this endpoint, you must be an administrator for the repository or for the organization that owns the repository, and you must use a personal access token with the repo scope or security_events scope.
For public repositories, you may instead use the public_repo scope.

GitHub Apps must have the secret_scanning_alerts read permission to use this endpoint.

[ { "details": { "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b", "blob_url": "string", "commit_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b", "commit_url": "string", "end_column": 0, "end_line": 0, "path": "/example/secrets.txt", "start_column": 0, "start_line": 0 }, "type": "commit" } ]

Request

Path Params

owner

string

required

The account owner of the repository. The name is not case sensitive.

repo

string

required

The name of the repository. The name is not case sensitive.

alert_number

string

required

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Query Params

page

integer

optional

Page number of the results to fetch.

per_page

integer

optional

The number of results per page (max 100).

Responses

🟢200Response

application/json

Body

List of locations where the secret was detected

array of:

details

required

One of

secret-scanning-location-commit

secret-scanning-location-issue-title

secret-scanning-location-issue-body

secret-scanning-location-issue-comment

Represents a 'commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.

blob_sha

string

required

SHA-1 hash ID of the associated blob

Example:

af5626b4a114abcb82d63db7c8082c3c4756e51b

blob_url

string

required

The API URL to get the associated blob resource

commit_sha

string

required

SHA-1 hash ID of the associated commit

Example:

af5626b4a114abcb82d63db7c8082c3c4756e51b

commit_url

string

required

The API URL to get the associated commit resource

end_column

number

required

The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII

end_line

number

required

Line number at which the secret ends in the file

path

string

required

The file path in the repository

Example:

/example/secrets.txt

start_column

number

required

The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII

start_line

number

required

Line number at which the secret starts in the file

type

enum<string>

required

The location type. Because secrets may be found in different types of resources (ie. code, comments, issues), this field identifies the type of resource where the secret was found.

Allowed values:

commitissue_titleissue_bodyissue_comment

Example:

commit

🟠404Repository is public, or secret scanning is disabled for the repository, or the resource is not found

🔴503503