REST API endpoints for repository security advisories

Use the REST API to view and manage repository security advisories.

Note

Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.

List repository security advisories for an organization

GET /orgs/{org}/security-advisories

Lists repository security advisories for an organization.
The authenticated user must be an owner or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/security-advisories

Response schema (Status: 200):

Array of objects:

List repository security advisories

GET /repos/{owner}/{repo}/security-advisories

Lists security advisories in a repository.
The authenticated user can access unpublished security advisories from a repository if they are a security manager or administrator of that repository, or if they are a collaborator on any security advisory.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/security-advisories

Response schema (Status: 200):

Same response schema as List repository security advisories for an organization.

Create a repository security advisory

POST /repos/{owner}/{repo}/security-advisories

Creates a new repository security advisory.
In order to create a draft repository security advisory, the authenticated user must be a security manager or administrator of that repository.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/repos/OWNER/REPO/security-advisories \
  -d '{
  "summary": "A new important advisory",
  "description": "A more in-depth description of what the problem is.",
  "severity": "high",
  "cve_id": null,
  "vulnerabilities": [
    {
      "package": {
        "name": "a-package",
        "ecosystem": "npm"
      },
      "vulnerable_version_range": "< 1.0.0",
      "patched_versions": "1.0.0",
      "vulnerable_functions": [
        "important_function"
      ]
    }
  ],
  "cwe_ids": [
    "CWE-1101",
    "CWE-20"
  ],
  "credits": [
    {
      "login": "monalisa",
      "type": "reporter"
    },
    {
      "login": "octocat",
      "type": "analyst"
    }
  ]
}'

Response schema (Status: 201):

Privately report a security vulnerability

POST /repos/{owner}/{repo}/security-advisories/reports

Report a security vulnerability to the maintainers of the repository.
See "Privately reporting a security vulnerability" for more information about private vulnerability reporting.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/repos/OWNER/REPO/security-advisories/reports \
  -d '{
  "summary": "A newly discovered vulnerability",
  "description": "A more in-depth description of what the problem is.",
  "severity": "high",
  "vulnerabilities": [
    {
      "package": {
        "name": "a-package",
        "ecosystem": "npm"
      },
      "vulnerable_version_range": "< 1.0.0",
      "patched_versions": "1.0.0",
      "vulnerable_functions": [
        "important_function"
      ]
    }
  ],
  "cwe_ids": [
    "CWE-123"
  ]
}'

Response schema (Status: 201):

Same response schema as Create a repository security advisory.

Get a repository security advisory

GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}

Get a repository security advisory using its GitHub Security Advisory (GHSA) identifier.
Anyone can access any published security advisory on a public repository.
The authenticated user can access an unpublished security advisory from a repository if they are a security manager or administrator of that repository, or if they are a
collaborator on the security advisory.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID

Response schema (Status: 200):

Same response schema as Create a repository security advisory.

Update a repository security advisory

PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id}

Update a repository security advisory using its GitHub Security Advisory (GHSA) identifier.
In order to update any security advisory, the authenticated user must be a security manager or administrator of that repository,
or a collaborator on the repository security advisory.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Updating the severity and state.

Request:

curl -L \
  -X PATCH \
  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID \
  -d '{
  "severity": "critical",
  "state": "published"
}'

Response schema (Status: 200):

Same response schema as Create a repository security advisory.

To add a credit to an advisory, send the whole array of values.

Request:

curl -L \
  -X PATCH \
  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID \
  -d '{
  "credits": [
    {
      "login": "monauser",
      "type": "remediation_developer"
    }
  ]
}'

Response schema (Status: 200):

Same response schema as Create a repository security advisory.

Request a CVE for a repository security advisory

POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve

If you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see "Requesting a CVE identification number."
You may request a CVE for public repositories, but cannot do so for private repositories.
In order to request a CVE for a repository security advisory, the authenticated user must be a security manager or administrator of that repository.
OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID/cve

Response schema (Status: 202):

object

Create a temporary private fork

POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/forks

Create a temporary private fork to collaborate on fixing a security vulnerability in a repository.
Repository administrators, organization owners, and security managers can create a temporary private fork. The original reporter of a privately reported vulnerability can also create one while they remain a collaborator on the security advisory.
Note

Forking a repository happens asynchronously. You may have to wait up to 5 minutes before you can access the fork.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID/forks

Response schema (Status: 202):