REST API endpoints for commits

Use the REST API to interact with commits.

Note

Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.

List commits

GET /repos/{owner}/{repo}/commits

Signature verification object
The response will include a verification object that describes the result of verifying the commit's signature. The following fields are included in the verification object:

NameTypeDescriptionverifiedbooleanIndicates whether GitHub considers the signature in this commit to be verified.reasonstringThe reason for verified value. Possible values and their meanings are enumerated in table below.signaturestringThe signature that was extracted from the commit.payloadstringThe value that was signed.verified_atstringThe date the signature was verified by GitHub.
These are the possible values for reason in the verification object:

ValueDescriptionexpired_keyThe key that made the signature is expired.not_signing_keyThe "signing" flag is not among the usage flags in the GPG key that made the signature.gpgverify_errorThere was an error communicating with the signature verification service.gpgverify_unavailableThe signature verification service is currently unavailable.unsignedThe object does not include a signature.unknown_signature_typeA non-PGP signature was found in the commit.no_userNo user was associated with the committer email address in the commit.unverified_emailThe committer email address in the commit was associated with a user, but the email address is not verified on their account.bad_emailThe committer email address in the commit is not included in the identities of the PGP key that made the signature.unknown_keyThe key that made the signature has not been registered with any user's account.malformed_signatureThere was an error parsing the signature.invalidThe signature could not be cryptographically verified using the key whose key-id was found in the signature.validNone of the above errors applied, so the signature is considered to be verified.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits

Response schema (Status: 200):

Array of Commit:

List branches for HEAD commit

GET /repos/{owner}/{repo}/commits/{commit_sha}/branches-where-head

Protected branches are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server. For more information, see GitHub's products in the GitHub Help documentation.
Returns all branches where the given commit SHA is the HEAD, or latest commit for the branch.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/COMMIT_SHA/branches-where-head

Response schema (Status: 200):

Array of Branch Short:

List pull requests associated with a commit

GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls

Lists the merged pull request that introduced the commit to the repository. If the commit is not present in the default branch, it will return merged and open pull requests associated with the commit.
To list the open or merged pull requests associated with a branch, you can set the commit_sha parameter to the branch name.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/COMMIT_SHA/pulls

Response schema (Status: 200):

Array of Pull Request Simple:

Get a commit

GET /repos/{owner}/{repo}/commits/{ref}

Returns the contents of a single commit reference. You must have read access for the repository to use this endpoint.
Note

If there are more than 300 files in the commit diff and the default JSON media type is requested, the response will include pagination link headers for the remaining files, up to a limit of 3000 files. Each page contains the static commit information, and the only changes are to the file listing.

This endpoint supports the following custom media types. For more information, see "Media types." Pagination query parameters are not supported for these media types.

application/vnd.github.diff: Returns the diff of the commit. Larger diffs may time out and return a 5xx status code.
application/vnd.github.patch: Returns the patch of the commit. Diffs with binary data will have no patch property. Larger diffs may time out and return a 5xx status code.
application/vnd.github.sha: Returns the commit's SHA-1 hash. You can use this endpoint to check if a remote reference's SHA-1 hash is the same as your local reference's SHA-1 hash by providing the local SHA-1 reference as the ETag.

Signature verification object
The response will include a verification object that describes the result of verifying the commit's signature. The following fields are included in the verification object:

NameTypeDescriptionverifiedbooleanIndicates whether GitHub considers the signature in this commit to be verified.reasonstringThe reason for verified value. Possible values and their meanings are enumerated in table below.signaturestringThe signature that was extracted from the commit.payloadstringThe value that was signed.verified_atstringThe date the signature was verified by GitHub.
These are the possible values for reason in the verification object:

ValueDescriptionexpired_keyThe key that made the signature is expired.not_signing_keyThe "signing" flag is not among the usage flags in the GPG key that made the signature.gpgverify_errorThere was an error communicating with the signature verification service.gpgverify_unavailableThe signature verification service is currently unavailable.unsignedThe object does not include a signature.unknown_signature_typeA non-PGP signature was found in the commit.no_userNo user was associated with the committer email address in the commit.unverified_emailThe committer email address in the commit was associated with a user, but the email address is not verified on their account.bad_emailThe committer email address in the commit is not included in the identities of the PGP key that made the signature.unknown_keyThe key that made the signature has not been registered with any user's account.malformed_signatureThere was an error parsing the signature.invalidThe signature could not be cryptographically verified using the key whose key-id was found in the signature.validNone of the above errors applied, so the signature is considered to be verified.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example 1: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/REF

Response schema (Status: 200):

Example 2: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/REF \
  -H "Accept: application/vnd.github.diff"

Response schema (Status: 200):

string

Example 3: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/REF \
  -H "Accept: application/vnd.github.patch"

Response schema (Status: 200):

string

Example 4: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/commits/REF \
  -H "Accept: application/vnd.github.sha"

Response schema (Status: 200):

string

Compare two commits

GET /repos/{owner}/{repo}/compare/{basehead}

Compares two commits against one another. You can compare refs (branches or tags) and commit SHAs in the same repository, or you can compare refs and commit SHAs that exist in different repositories within the same repository network, including fork branches. For more information about how to view a repository's network, see "Understanding connections between repositories."
This endpoint is equivalent to running the git log BASE..HEAD command, but it returns commits in a different order. The git log BASE..HEAD command returns commits in reverse chronological order, whereas the API returns commits in chronological order.
This endpoint supports the following custom media types. For more information, see "Media types."

application/vnd.github.diff: Returns the diff of the commit.
application/vnd.github.patch: Returns the patch of the commit. Diffs with binary data will have no patch property.

The API response includes details about the files that were changed between the two commits. This includes the status of the change (if a file was added, removed, modified, or renamed), and details of the change itself. For example, files with a renamed status have a previous_filename field showing the previous filename of the file, and files with a modified status have a patch field showing the changes made to the file.
When calling this endpoint without any paging parameter (per_page or page), the returned list is limited to 250 commits, and the last commit in the list is the most recent of the entire comparison.
Working with large comparisons
To process a response with a large number of commits, use a query parameter (per_page or page) to paginate the results. When using pagination:

The list of changed files is only shown on the first page of results, and it includes up to 300 changed files for the entire comparison.
The results are returned in chronological order, but the last commit in the returned list may not be the most recent one in the entire set if there are more pages of results.

For more information on working with pagination, see "Using pagination in the REST API."
Signature verification object
The response will include a verification object that describes the result of verifying the commit's signature. The verification object includes the following fields:

NameTypeDescriptionverifiedbooleanIndicates whether GitHub considers the signature in this commit to be verified.reasonstringThe reason for verified value. Possible values and their meanings are enumerated in table below.signaturestringThe signature that was extracted from the commit.payloadstringThe value that was signed.verified_atstringThe date the signature was verified by GitHub.
These are the possible values for reason in the verification object:

ValueDescriptionexpired_keyThe key that made the signature is expired.not_signing_keyThe "signing" flag is not among the usage flags in the GPG key that made the signature.gpgverify_errorThere was an error communicating with the signature verification service.gpgverify_unavailableThe signature verification service is currently unavailable.unsignedThe object does not include a signature.unknown_signature_typeA non-PGP signature was found in the commit.no_userNo user was associated with the committer email address in the commit.unverified_emailThe committer email address in the commit was associated with a user, but the email address is not verified on their account.bad_emailThe committer email address in the commit is not included in the identities of the PGP key that made the signature.unknown_keyThe key that made the signature has not been registered with any user's account.malformed_signatureThere was an error parsing the signature.invalidThe signature could not be cryptographically verified using the key whose key-id was found in the signature.validNone of the above errors applied, so the signature is considered to be verified.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example 1: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/compare/BASEHEAD

Response schema (Status: 200):

Example 2: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/compare/BASEHEAD \
  -H "Accept: application/vnd.github.diff"

Response schema (Status: 200):

Same response schema as Get a commit.

Example 3: Status Code 200

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/compare/BASEHEAD \
  -H "Accept: application/vnd.github.patch"

Response schema (Status: 200):

Same response schema as Get a commit.