curl -X POST 'https://api.github.com/repos/example-owner/example-repo/security-advisories' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "summary": "example-summary",
  "description": "example-description",
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "rubygems",
        "name": "example-name"
      },
      "vulnerable_version_range": "example-vulnerable-version-range",
      "patched_versions": "example-patched-versions",
      "vulnerable_functions": [
        "example-vulnerable-functions"
      ]
    }
  ]
}'

# POST /repos/{owner}/{repo}/security-advisories (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create a repository security advisory

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/repos/example-owner/example-repo/security-advisories' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "summary": "example-summary",
  "description": "example-description",
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "rubygems",
        "name": "example-name"
      },
      "vulnerable_version_range": "example-vulnerable-version-range",
      "patched_versions": "example-patched-versions",
      "vulnerable_functions": [
        "example-vulnerable-functions"
      ]
    }
  ]
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| summary | body | string | Yes | A short summary of the advisory. |
| description | body | string | Yes | A detailed description of what the advisory impacts. |
| vulnerabilities | body | object[] | Yes | A product affected by the vulnerability detailed in a repository security adv... |
| cve_id | body | string | No | The Common Vulnerabilities and Exposures (CVE) ID. |
| cwe_ids | body | string[] | No | A list of Common Weakness Enumeration (CWE) IDs. |
| credits | body | object[] | No | A list of users receiving credit for their participation in the security advi... |
Other params: severity, cvss_vector_string, start_private_fork

## Response example
{"ghsa_id":"string","cve_id":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /repos/{owner}/{repo}/security-advisories — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create a repository security advisory

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 400 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/repos/example-owner/example-repo/security-advisories' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "summary": "example-summary",  "description": "example-description",  "vulnerabilities": [    {      "package": {        "ecosystem": "rubygems",        "name": "example-name"      },      "vulnerable_version_range": "example-vulnerable-version-range",      "patched_versions": "example-patched-versions",      "vulnerable_functions": [        "example-vulnerable-functions"      ]    }  ]}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
summary	body	string	Yes	A short summary of the advisory.
description	body	string	Yes	A detailed description of what the advisory impacts.
cve_id	body	string	No	The Common Vulnerabilities and Exposures (CVE) ID.
vulnerabilities	body	object[]	Yes	A product affected by the vulnerability detailed in a repository security advisory.
cwe_ids	body	string[]	No	A list of Common Weakness Enumeration (CWE) IDs.
credits	body	object[]	No	A list of users receiving credit for their participation in the security advisory.
severity	body	string	No	The severity of the advisory. You must choose between setting this field or `cvss_vector_string`.
cvss_vector_string	body	string	No	The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`.
start_private_fork	body	boolean	No	Whether to create a temporary private fork of the repository to collaborate on a fix.

Response 200 OK

{
  "ghsa_id": "string",
  "cve_id": "string",
  "url": "https://example.com",
  "html_url": "https://example.com",
  "summary": "string",
  "description": "string",
  "severity": "critical",
  "author": {
    "name": "string",
    "email": "string",
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjE=",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": true,
    "starred_at": "\"2020-07-09T00:17:55Z\"",
    "user_view_type": "public"
  },
  "publisher": {
    "name": "string",
    "email": "string",
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjE=",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": true,
    "starred_at": "\"2020-07-09T00:17:55Z\"",
    "user_view_type": "public"
  },
  "identifiers": [
    {
      "type": "CVE",
      "value": "string"
    }
  ],
  "state": "published",
  "created_at": "2026-09-03T00:00:00Z",
  "updated_at": "2026-09-03T00:00:00Z",
  "published_at": "2026-09-03T00:00:00Z",
  "closed_at": "2026-09-03T00:00:00Z",
  "withdrawn_at": "2026-09-03T00:00:00Z",
  "submission": {
    "accepted": true
  },
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "rubygems",
        "name": "string"
      },
      "vulnerable_version_range": "string",
      "patched_versions": "string",
      "vulnerable_functions": [
        "string"
      ]
    }
  ],
  "cvss_severities": {
    "cvss_v3": {
      "vector_string": "string",
      "score": 0
    },
    "cvss_v4": {
      "vector_string": "string",
      "score": 0
    }
  },
  "cwes": [
    {
      "cwe_id": "string",
      "name": "string"
    }
  ],
  "cwe_ids": [
    "string"
  ],
  "credits": [
    {
      "login": "string",
      "type": "analyst"
    }
  ],
  "credits_detailed": [
    {
      "user": {
        "name": "string",
        "email": "string",
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": true,
        "starred_at": "\"2020-07-09T00:17:55Z\"",
        "user_view_type": "public"
      },
      "type": "analyst",
      "state": "accepted"
    }
  ],
  "collaborating_users": [
    {
      "name": "string",
      "email": "string",
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": true,
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    }
  ],
  "collaborating_teams": [
    {
      "id": 0,
      "node_id": "string",
      "name": "string",
      "slug": "string",
      "description": "string",
      "privacy": "string",
      "notification_setting": "string",
      "permission": "string",
      "permissions": {
        "pull": true,
        "triage": true,
        "push": true,
        "maintain": true,
        "admin": true
      },
      "url": "https://example.com",
      "html_url": "https://github.com/orgs/rails/teams/core",
      "members_url": "string",
      "repositories_url": "https://example.com",
      "type": "enterprise",
      "access_source": "direct",
      "organization_id": 37,
      "enterprise_id": 42,
      "parent": {
        "id": 1,
        "node_id": "MDQ6VGVhbTE=",
        "url": "https://api.github.com/organizations/1/team/1",
        "members_url": "https://api.github.com/organizations/1/team/1/members{/member}",
        "name": "Justice League",
        "description": "A great team.",
        "permission": "admin",
        "privacy": "closed",
        "notification_setting": "notifications_enabled",
        "html_url": "https://github.com/orgs/rails/teams/core",
        "repositories_url": "https://api.github.com/organizations/1/team/1/repos",
        "slug": "justice-league",
        "ldap_dn": "uid=example,ou=users,dc=github,dc=com",
        "type": "enterprise",
        "organization_id": 37,
        "enterprise_id": 42
      }
    }
  ],
  "private_fork": {
    "id": 1296269,
    "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
    "name": "Hello-World",
    "full_name": "octocat/Hello-World",
    "owner": {
      "name": "string",
      "email": "string",
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": true,
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    },
    "private": true,
    "html_url": "https://github.com/octocat/Hello-World",
    "description": "This your first repo!",
    "fork": true,
    "url": "https://api.github.com/repos/octocat/Hello-World",
    "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
    "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
    "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
    "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
    "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
    "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
    "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
    "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
    "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
    "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
    "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
    "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
    "events_url": "https://api.github.com/repos/octocat/Hello-World/events",
    "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
    "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
    "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
    "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
    "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
    "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
    "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
    "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
    "labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
    "languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
    "merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
    "milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
    "notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
    "pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
    "releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
    "stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
    "statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
    "subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
    "subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
    "tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
    "teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
    "trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
    "hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
  }
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.