curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/alerts/10/autofix/commits' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

# POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix/commits (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Commit an autofix for a code scanning alert

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/alerts/10/autofix/commits' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| alert_number | path | integer | Yes | The number that identifies an alert. You can find this at the end of the URL... |
| target_ref | body | string | No | The Git reference of target branch for the commit. Branch needs to already ex... |
| message | body | string | No | Commit message to be used. |

## Response example
{"target_ref":"string","sha":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix/commits — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Commit an autofix for a code scanning alert

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 301 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/alerts/10/autofix/commits' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
alert_number	path	integer	Yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.
target_ref	body	string	No	The Git reference of target branch for the commit. Branch needs to already exist. For more information, see "[Git References](https://git-scm.com/book/en/v2/Git-Internals-Git-References)" in the Git documentation.
message	body	string	No	Commit message to be used.

Response 200 OK

{
  "target_ref": "string",
  "sha": "string"
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.