apicheats.dev github/llms.txt Raw .md
GET

GET /repos/{owner}/{repo}/dependabot/alerts — GitHub API

GitHub token (required); https://api.github.com

GitHub API

List Dependabot alerts for a repository

Replace example-owner/example-repo with a repository you can access and set GITHUB_TOKEN before requesting state=open&per_page=30. A fine-grained token needs Dependabot alerts repository permission (read); classic tokens need security_events, or public_repo when used only with public repositories. A 403 or 404 is an access or repository error, not an empty alert list. This is one page: follow the returned Link header URL marked rel="next" to retrieve more alerts; do not assume the first page is complete or invent before/after cursors. The response below is illustrative, based on the documented schema, not fetched account data. A null first_patched_version means no available fix is listed for that vulnerability. See the GitHub repository Dependabot alerts docs.

Base URL
https://api.github.com
Auth
Authorization: Bearer <GITHUB_API_KEY>
Last verified
2026-10-20 · upstream hash matched
Actions Try in browser→
Agents: curl -H "Accept: text/markdown" this URL
→ 532 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X GET 'https://api.github.com/repos/example-owner/example-repo/dependabot/alerts?state=open&per_page=30' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10'

Parameters

Name In Type Required Description
owner path string Yes The account owner of the repository. The name is not case sensitive.
repo path string Yes The name of the repository without the `.git` extension. The name is not case sensitive.
classification query string No A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned. Can be: `malware`, `general`
state query string No A comma-separated list of states. If specified, only alerts with these states will be returned. Can be: `auto_dismissed`, `dismissed`, `fixed`, `open`
severity query string No A comma-separated list of severities. If specified, only alerts with these severities will be returned. Can be: `low`, `medium`, `high`, `critical`
ecosystem query string No A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned. Can be: `composer`, `go`, `maven`, `npm`, `nuget`, `pip`, `pub`, `rubygems`, `rust`
package query string No A comma-separated list of package names. If specified, only alerts for these packages will be returned.
manifest query string No A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.
epss_percentage query string No CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as: - An exact number (`n`) - Comparators such as `>n`, `<n`, `>=n`, `<=n` - A range like `n..n`, where `n` is a number from 0.0 to 1.0 Filters the list of alerts based on EPSS percentages. If specified, only alerts with the provided EPSS percentages will be returned.
has query string No Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned. Multiple `has` filters can be passed to filter for alerts that have all of the values. Currently, only `patch` is supported.
assignee query string No Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., `octocat` or `octocat,hubot`) to return alerts assigned to any of the specified users. Use `*` to list alerts with at least one assignee or `none` to list alerts with no assignees.
scope query string No The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
relationship query string No A comma-separated list of relationships of the vulnerable dependency to your project. If specified, only alerts with these relationships will be returned. > [!NOTE] > We are rolling out support for dependency relationship across ecosystems. This value will be "unknown" for all dependencies in unsupported ecosystems.
sort query string No The property by which to sort the results. `created` means when the alert was created. `updated` means when the alert's state last changed. `epss_percentage` sorts alerts by the Exploit Prediction Scoring System (EPSS) percentage.
direction query string No The direction to sort the results by.
before query string No A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results before this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
after query string No A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results after this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
per_page query integer No The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."

Response 200 OK

[
  {
    "number": 1,
    "state": "open",
    "html_url": "https://github.com/example-owner/example-repo/security/dependabot/1",
    "security_vulnerability": {
      "package": {
        "ecosystem": "pip",
        "name": "ansible"
      },
      "severity": "medium",
      "vulnerable_version_range": "< 2.8.19",
      "first_patched_version": null
    }
  }
]
Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.