apicheats.dev Cheat sheet Raw .md
POST

Try POST /repos/{owner}/{repo}/code-scanning/sarifs — GitHub API

GitHub playground

Upload an analysis as SARIF data

Credentials

Kept in this tab only. Requests go through apicheats.dev's same-origin proxy straight to api.github.com; the proxy stores and logs nothing about them.

Headers

Path

Body application/json

7 body fields
  • commit_sha · required · string — The SHA of the commit to which the analysis you are uploading relates.
  • ref · required · string — The full Git reference, formatted as `refs/heads/<branch name>`, `refs/tags/<tag>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.
  • sarif · required · string — A Base64 string representing the SARIF file to upload. You must first compress your SARIF file using [`gzip`](http://www.gnu.org/software/gzip/manual/gzip.html) and then translate the contents of the file into a Base64 encoding string. For more information, see "[SARIF support for code scanning](https://docs.github.com/code-security/secure-coding/sarif-support-for-code-scanning)."
  • checkout_uri · optional · string — The base directory used in the analysis, as it appears in the SARIF file. This property is used to convert file paths from absolute to relative, so that alerts can be mapped to their correct location in the repository.
  • started_at · optional · string — The time that the analysis run began. This is a timestamp in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format: `YYYY-MM-DDTHH:MM:SSZ`.
  • tool_name · optional · string — The name of the tool used to generate the code scanning analysis. If this parameter is not used, the tool name defaults to "API". If the uploaded SARIF contains a tool GUID, this will be available for filtering using the `tool_guid` parameter of operations such as `GET /repos/{owner}/{repo}/code-scanning/alerts`.
  • validate · optional · boolean — Whether the SARIF file will be validated according to the code scanning specifications. This parameter is intended to help integrators ensure that the uploaded SARIF files are correctly rendered by code scanning.