{"meta":{"title":"Points de terminaison d’API REST pour les avis de sécurité","intro":"Utiliser l’API REST pour créer et gérer des alertes de sécurité innersource","product":"API REST","breadcrumbs":[{"href":"/fr/enterprise-cloud@latest/rest","title":"API REST"},{"href":"/fr/enterprise-cloud@latest/rest/enterprise-admin","title":"Administration d’entreprise"},{"href":"/fr/enterprise-cloud@latest/rest/enterprise-admin/security-advisories","title":"Avis de sécurité"}],"documentType":"article"},"body":"# Points de terminaison d’API REST pour les avis de sécurité\n\nUtiliser l’API REST pour créer et gérer des alertes de sécurité innersource\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## Sync innersource vulnerabilities for an enterprise\n\n```\nPOST /enterprises/{enterprise}/innersource-vulnerabilities/sync\n```\n\nSynchronize innersource vulnerability data with the Advisory Database for an enterprise.\nThis endpoint receives vulnerability data in OSV format and creates, updates, or withdraws\ninnersource vulnerabilities accordingly. Dependabot alerting is triggered for created and\nupdated vulnerabilities.\nThe request body accepts up to 100 vulnerabilities per call. The request is validated and\nthen queued for asynchronous processing: a successful request returns 202 Accepted with a\nLocation header pointing to a status URL that you poll for the final result.\nSyncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see \"Rate limits for the API\" and \"Best practices for using the REST API.\"\nThis endpoint does not support OAuth apps or personal access tokens.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n#### Body parameters\n\n- **`vulnerabilities`** (array of objects) (required)\n  Array of vulnerabilities in OSV format to synchronize\n  - **`id`** (string) (required)\n    Unique identifier for the vulnerability from the external system\n  - **`schema_version`** (string)\n    The OSV schema version\n  - **`summary`** (string)\n    A short summary of the vulnerability\n  - **`details`** (string)\n    Detailed description of the vulnerability\n  - **`aliases`** (array of strings)\n    IDs for the same vulnerability in other databases. Only CVE IDs are used (to populate the vulnerability's CVE identifier); other aliases are ignored.\n  - **`severity`** (array of objects)\n    Severity information for the vulnerability\n    - **`type`** (string)\n      The type of severity scoring (e.g., CVSS_V3)\n    - **`score`** (string)\n      The severity score or vector string\n  - **`affected`** (array of objects)\n    Packages and versions affected by the vulnerability\n    - **`package`** (object)\n      - **`ecosystem`** (string)\n        The package ecosystem (e.g., npm, pip, maven)\n      - **`name`** (string)\n        The package name\n    - **`ranges`** (array of objects)\n      - **`type`** (string)\n      - **`events`** (array of objects)\n        - **`introduced`** (string)\n          The version that introduced the vulnerability\n        - **`fixed`** (string)\n          The version that fixed the vulnerability\n        - **`last_affected`** (string)\n          The last affected version\n        - **`limit`** (string)\n          The upper limit of the affected range\n  - **`references`** (array of objects)\n    URLs for more information about the vulnerability\n    - **`type`** (string)\n      The type of reference. Supported values: PACKAGE, ADVISORY, WEB, FIX, ARTICLE, REPORT, EVIDENCE. References with other types are ignored.\n    - **`url`** (string)\n      The reference URL\n  - **`published`** (string)\n    When the vulnerability was first published\n  - **`modified`** (string)\n    When the vulnerability was last modified\n  - **`withdrawn`** (string)\n    When the vulnerability was withdrawn. If present, the vulnerability will be marked as withdrawn.\n\n### HTTP response status codes\n\n- **202** - Sync operation accepted for asynchronous processing. Poll the returned URL for results.\n\n- **400** - Bad Request\n\n- **401** - Requires authentication\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync \\\n  -d '{\n  \"vulnerabilities\": [\n    {\n      \"id\": \"MVS-2026-001\",\n      \"schema_version\": \"1.4.0\",\n      \"summary\": \"Example vulnerability summary\",\n      \"aliases\": [\n        \"GHSA-xxxx-xxxx-xxxx\"\n      ],\n      \"affected\": [\n        {\n          \"package\": {\n            \"ecosystem\": \"npm\",\n            \"name\": \"example-package\"\n          },\n          \"ranges\": [\n            {\n              \"type\": \"SEMVER\",\n              \"events\": [\n                {\n                  \"introduced\": \"1.0.0\"\n                },\n                {\n                  \"fixed\": \"1.0.1\"\n                }\n              ]\n            }\n          ]\n        }\n      ]\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 202):**\n\n* `id`: required, string\n* `url`: required, string, format: uri\n* `status`: required, string, enum: `queued`\n\n## Get innersource vulnerability sync status for an enterprise\n\n```\nGET /enterprises/{enterprise}/innersource-vulnerabilities/sync/status/{job_id}\n```\n\nGet the status of an asynchronous innersource vulnerability sync operation for an enterprise.\nReturns 202 with a Retry-After header while the sync is still processing, or 200 with\nthe full sync results once complete.\nThis endpoint does not support OAuth apps or personal access tokens.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n- **`job_id`** (string) (required)\n  The unique identifier of the sync job.\n\n### HTTP response status codes\n\n- **200** - Sync operation completed\n\n- **202** - Sync operation is still processing\n\n- **401** - Requires authentication\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example 1: Status Code 200\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync/status/JOB_ID\n```\n\n**Response schema (Status: 200):**\n\n* one of:\n  * **External Vulnerability Sync Result**\n    * `processed`: required, integer\n    * `created`: required, integer\n    * `updated`: required, integer\n    * `withdrawn`: required, integer\n    * `errors`: required, integer\n    * `results`: required, array of objects:\n      * `external_id`: required, string\n      * `status`: required, string, enum: `created`, `updated`, `withdrawn`, `error`\n      * `ghsa_id`: string\n      * `error`: string\n  * **object**\n    * `status`: string, enum: `error`\n    * `error`: string\n\n#### Example 2: Status Code 200\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync/status/JOB_ID\n```\n\n**Response schema (Status: 200):**\n\n* one of:\n  * **External Vulnerability Sync Result**\n    * `processed`: required, integer\n    * `created`: required, integer\n    * `updated`: required, integer\n    * `withdrawn`: required, integer\n    * `errors`: required, integer\n    * `results`: required, array of objects:\n      * `external_id`: required, string\n      * `status`: required, string, enum: `created`, `updated`, `withdrawn`, `error`\n      * `ghsa_id`: string\n      * `error`: string\n  * **object**\n    * `status`: string, enum: `error`\n    * `error`: string\n\n#### Example 3: Status Code 202\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync/status/JOB_ID\n```\n\n**Response schema (Status: 202):**\n\n* `id`: required, string\n* `status`: required, string, enum: `processing`"}