curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/sarifs' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "commit_sha": "example-commit-sha",
  "ref": "refs/heads/main",
  "sarif": "example-sarif"
}'

# POST /repos/{owner}/{repo}/code-scanning/sarifs (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Upload an analysis as SARIF data

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/sarifs' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "commit_sha": "example-commit-sha",
  "ref": "refs/heads/main",
  "sarif": "example-sarif"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| commit_sha | body | string | Yes | The SHA of the commit to which the analysis you are uploading relates. |
| ref | body | string | Yes | The full Git reference, formatted as `refs/heads/<branch name>`, `refs/tags/<... |
| sarif | body | string | Yes | A Base64 string representing the SARIF file to upload. You must first compres... |
| checkout_uri | body | string | No | The base directory used in the analysis, as it appears in the SARIF file. Thi... |
| started_at | body | string | No | The time that the analysis run began. This is a timestamp in [ISO 8601](https... |
| tool_name | body | string | No | The name of the tool used to generate the code scanning analysis. If this par... |
Other params: validate

## Response example
{"id":"6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53","url":"https://example.com"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /repos/{owner}/{repo}/code-scanning/sarifs — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Upload an analysis as SARIF data

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 407 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/repos/example-owner/example-repo/code-scanning/sarifs' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "commit_sha": "example-commit-sha",  "ref": "refs/heads/main",  "sarif": "example-sarif"}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
commit_sha	body	string	Yes	The SHA of the commit to which the analysis you are uploading relates.
ref	body	string	Yes	The full Git reference, formatted as `refs/heads/<branch name>`, `refs/tags/<tag>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.
sarif	body	string	Yes	A Base64 string representing the SARIF file to upload. You must first compress your SARIF file using [`gzip`](http://www.gnu.org/software/gzip/manual/gzip.html) and then translate the contents of the file into a Base64 encoding string. For more information, see "[SARIF support for code scanning](https://docs.github.com/code-security/secure-coding/sarif-support-for-code-scanning)."
checkout_uri	body	string	No	The base directory used in the analysis, as it appears in the SARIF file. This property is used to convert file paths from absolute to relative, so that alerts can be mapped to their correct location in the repository.
started_at	body	string	No	The time that the analysis run began. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.
tool_name	body	string	No	The name of the tool used to generate the code scanning analysis. If this parameter is not used, the tool name defaults to "API". If the uploaded SARIF contains a tool GUID, this will be available for filtering using the `tool_guid` parameter of operations such as `GET /repos/{owner}/{repo}/code-scanning/alerts`.
validate	body	boolean	No	Whether the SARIF file will be validated according to the code scanning specifications. This parameter is intended to help integrators ensure that the uploaded SARIF files are correctly rendered by code scanning.

Response 200 OK

{
  "id": "6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53",
  "url": "https://example.com"
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.