{"meta":{"title":"Points de terminaison d’API REST pour les avis de sécurité de référentiels","intro":"Utilisez l'API REST pour afficher et gérer les avis de sécurité du référentiel.","product":"API REST","breadcrumbs":[{"href":"/fr/enterprise-cloud@latest/rest","title":"API REST"},{"href":"/fr/enterprise-cloud@latest/rest/security-advisories","title":"Avis de sécurité"},{"href":"/fr/enterprise-cloud@latest/rest/security-advisories/repository-advisories","title":"Avis de sécurité des dépôts"}],"documentType":"article"},"body":"# Points de terminaison d’API REST pour les avis de sécurité de référentiels\n\nUtilisez l'API REST pour afficher et gérer les avis de sécurité du référentiel.\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## List repository security advisories for an organization\n\n```\nGET /orgs/{org}/security-advisories\n```\n\nLists repository security advisories for an organization.\nThe authenticated user must be an owner or security manager for the organization to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`org`** (string) (required)\n  The organization name. The name is not case sensitive.\n\n- **`direction`** (string)\n  The direction to sort the results by.\n  Default: `desc`\n  Can be one of: `asc`, `desc`\n\n- **`sort`** (string)\n  The property to sort the results by.\n  Default: `created`\n  Can be one of: `created`, `updated`, `published`\n\n- **`before`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`after`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`per_page`** (integer)\n  The number of advisories to return per page. For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`state`** (string)\n  Filter by the state of the repository advisories. Only advisories of this state will be returned.\n  Can be one of: `triage`, `draft`, `published`, `closed`\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **400** - Bad Request\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/orgs/ORG/security-advisories\n```\n\n**Response schema (Status: 200):**\n\nArray of objects:\n  * `ghsa_id`: required, string, read-only\n  * `cve_id`: required, string or null\n  * `url`: required, string, format: uri, read-only\n  * `html_url`: required, string, format: uri, read-only\n  * `summary`: required, string, maxLength: 1024\n  * `description`: required, string or null, maxLength: 65535\n  * `severity`: required, string or null, enum: `critical`, `high`, `medium`, `low`, `null`\n  * `author`: required, all of:\n    * **Simple User**\n      * `name`: string or null\n      * `email`: string or null\n      * `login`: required, string\n      * `id`: required, integer, format: int64\n      * `node_id`: required, string\n      * `avatar_url`: required, string, format: uri\n      * `gravatar_id`: required, string or null\n      * `url`: required, string, format: uri\n      * `html_url`: required, string, format: uri\n      * `followers_url`: required, string, format: uri\n      * `following_url`: required, string\n      * `gists_url`: required, string\n      * `starred_url`: required, string\n      * `subscriptions_url`: required, string, format: uri\n      * `organizations_url`: required, string, format: uri\n      * `repos_url`: required, string, format: uri\n      * `events_url`: required, string\n      * `received_events_url`: required, string, format: uri\n      * `type`: required, string\n      * `site_admin`: required, boolean\n      * `starred_at`: string\n      * `user_view_type`: string\n  * `publisher`: required, all of:\n    * **Simple User** (see above)\n  * `identifiers`: required, array of objects:\n    * `type`: required, string, enum: `CVE`, `GHSA`\n    * `value`: required, string\n  * `state`: required, string, enum: `published`, `closed`, `withdrawn`, `draft`, `triage`\n  * `created_at`: required, string or null, format: date-time, read-only\n  * `updated_at`: required, string or null, format: date-time, read-only\n  * `published_at`: required, string or null, format: date-time, read-only\n  * `closed_at`: required, string or null, format: date-time, read-only\n  * `withdrawn_at`: required, string or null, format: date-time, read-only\n  * `submission`: required, object or null, read-only:\n    * `accepted`: required, boolean, read-only\n  * `vulnerabilities`: required, array of objects or null:\n    * `package`: required, object or null:\n      * `ecosystem`: required, string, enum: `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `go`, `rust`, `erlang`, `actions`, `pub`, `other`, `swift`\n      * `name`: required, string or null\n    * `vulnerable_version_range`: required, string or null\n    * `patched_versions`: required, string or null\n    * `vulnerable_functions`: required, array of string or null\n  * `cvss_severities`: object or null:\n    * `cvss_v3`: object or null:\n      * `vector_string`: required, string or null\n      * `score`: required, number or null, read-only, minimum: 0, maximum: 10\n    * `cvss_v4`: object or null:\n      * `vector_string`: required, string or null\n      * `score`: required, number or null, read-only, minimum: 0, maximum: 10\n  * `cwes`: required, array of objects or null:\n    * `cwe_id`: required, string\n    * `name`: required, string, read-only\n  * `cwe_ids`: required, array of string or null\n  * `credits`: required, array of objects or null:\n    * `login`: string\n    * `type`: string, enum: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n  * `credits_detailed`: required, array of objects or null:\n    * `user`: required, `Simple User` (see above)\n    * `type`: required, string, enum: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n    * `state`: required, string, enum: `accepted`, `declined`, `pending`\n  * `collaborating_users`: required, array of `Simple User` or null (see above)\n  * `collaborating_teams`: required, array of `Team` or null:\n    * `id`: required, integer\n    * `node_id`: required, string\n    * `name`: required, string\n    * `slug`: required, string\n    * `description`: required, string or null\n    * `privacy`: string\n    * `notification_setting`: string\n    * `permission`: required, string\n    * `permissions`: object:\n      * `pull`: required, boolean\n      * `triage`: required, boolean\n      * `push`: required, boolean\n      * `maintain`: required, boolean\n      * `admin`: required, boolean\n    * `url`: required, string, format: uri\n    * `html_url`: required, string, format: uri\n    * `members_url`: required, string\n    * `repositories_url`: required, string, format: uri\n    * `type`: required, string, enum: `enterprise`, `organization`\n    * `access_source`: string, enum: `direct`, `organization`, `enterprise`\n    * `organization_id`: integer\n    * `enterprise_id`: integer\n    * `parent`: required, any of:\n      * **null**\n      * **Team Simple**\n        * `id`: required, integer\n        * `node_id`: required, string\n        * `url`: required, string, format: uri\n        * `members_url`: required, string\n        * `name`: required, string\n        * `description`: required, string or null\n        * `permission`: required, string\n        * `privacy`: string\n        * `notification_setting`: string\n        * `html_url`: required, string, format: uri\n        * `repositories_url`: required, string, format: uri\n        * `slug`: required, string\n        * `ldap_dn`: string\n        * `type`: required, string, enum: `enterprise`, `organization`\n        * `organization_id`: integer\n        * `enterprise_id`: integer\n  * `private_fork`: required, all of:\n    * **Simple Repository**\n      * `id`: required, integer, format: int64\n      * `node_id`: required, string\n      * `name`: required, string\n      * `full_name`: required, string\n      * `owner`: required, `Simple User` (see above)\n      * `private`: required, boolean\n      * `html_url`: required, string, format: uri\n      * `description`: required, string or null\n      * `fork`: required, boolean\n      * `url`: required, string, format: uri\n      * `archive_url`: required, string\n      * `assignees_url`: required, string\n      * `blobs_url`: required, string\n      * `branches_url`: required, string\n      * `collaborators_url`: required, string\n      * `comments_url`: required, string\n      * `commits_url`: required, string\n      * `compare_url`: required, string\n      * `contents_url`: required, string\n      * `contributors_url`: required, string, format: uri\n      * `deployments_url`: required, string, format: uri\n      * `downloads_url`: required, string, format: uri\n      * `events_url`: required, string, format: uri\n      * `forks_url`: required, string, format: uri\n      * `git_commits_url`: required, string\n      * `git_refs_url`: required, string\n      * `git_tags_url`: required, string\n      * `issue_comment_url`: required, string\n      * `issue_events_url`: required, string\n      * `issues_url`: required, string\n      * `keys_url`: required, string\n      * `labels_url`: required, string\n      * `languages_url`: required, string, format: uri\n      * `merges_url`: required, string, format: uri\n      * `milestones_url`: required, string\n      * `notifications_url`: required, string\n      * `pulls_url`: required, string\n      * `releases_url`: required, string\n      * `stargazers_url`: required, string, format: uri\n      * `statuses_url`: required, string\n      * `subscribers_url`: required, string, format: uri\n      * `subscription_url`: required, string, format: uri\n      * `tags_url`: required, string, format: uri\n      * `teams_url`: required, string, format: uri\n      * `trees_url`: required, string\n      * `hooks_url`: required, string, format: uri\n\n## List repository security advisories\n\n```\nGET /repos/{owner}/{repo}/security-advisories\n```\n\nLists security advisories in a repository.\nThe authenticated user can access unpublished security advisories from a repository if they are a security manager or administrator of that repository, or if they are a collaborator on any security advisory.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`direction`** (string)\n  The direction to sort the results by.\n  Default: `desc`\n  Can be one of: `asc`, `desc`\n\n- **`sort`** (string)\n  The property to sort the results by.\n  Default: `created`\n  Can be one of: `created`, `updated`, `published`\n\n- **`before`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`after`** (string)\n  A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see \"Using pagination in the REST API.\"\n\n- **`per_page`** (integer)\n  The number of advisories to return per page. For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`state`** (string)\n  Filter by state of the repository advisories. Only advisories of this state will be returned.\n  Can be one of: `triage`, `draft`, `published`, `closed`\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **400** - Bad Request\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [List repository security advisories for an organization](#list-repository-security-advisories-for-an-organization).\n\n## Create a repository security advisory\n\n```\nPOST /repos/{owner}/{repo}/security-advisories\n```\n\nCreates a new repository security advisory.\nIn order to create a draft repository security advisory, the authenticated user must be a security manager or administrator of that repository.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n#### Body parameters\n\n- **`summary`** (string) (required)\n  A short summary of the advisory.\n\n- **`description`** (string) (required)\n  A detailed description of what the advisory impacts.\n\n- **`cve_id`** (string or null)\n  The Common Vulnerabilities and Exposures (CVE) ID.\n\n- **`vulnerabilities`** (array of objects) (required)\n  A product affected by the vulnerability detailed in a repository security advisory.\n  - **`package`** (object) (required)\n    The name of the package affected by the vulnerability.\n    - **`ecosystem`** (string) (required)\n      The package's language or package management ecosystem.\n      Can be one of: `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `go`, `rust`, `erlang`, `actions`, `pub`, `other`, `swift`\n    - **`name`** (string or null)\n      The unique package name within its ecosystem.\n  - **`vulnerable_version_range`** (string or null)\n    The range of the package versions affected by the vulnerability.\n  - **`patched_versions`** (string or null)\n    The package version(s) that resolve the vulnerability.\n  - **`vulnerable_functions`** (array of strings or null)\n    The functions in the package that are affected.\n\n- **`cwe_ids`** (array of strings or null)\n  A list of Common Weakness Enumeration (CWE) IDs.\n\n- **`credits`** (array of objects or null)\n  A list of users receiving credit for their participation in the security advisory.\n  - **`login`** (string) (required)\n    The username of the user credited.\n  - **`type`** (string) (required)\n    The type of credit the user is receiving.\n    Can be one of: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n\n- **`severity`** (string or null)\n  The severity of the advisory. You must choose between setting this field or cvss_vector_string.\n  Can be one of: `critical`, `high`, `medium`, `low`, `null`\n\n- **`cvss_vector_string`** (string or null)\n  The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or severity.\n\n- **`start_private_fork`** (boolean)\n  Whether to create a temporary private fork of the repository to collaborate on a fix.\n  Default: `false`\n\n### HTTP response status codes\n\n- **201** - Created\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories \\\n  -d '{\n  \"summary\": \"A new important advisory\",\n  \"description\": \"A more in-depth description of what the problem is.\",\n  \"severity\": \"high\",\n  \"cve_id\": null,\n  \"vulnerabilities\": [\n    {\n      \"package\": {\n        \"name\": \"a-package\",\n        \"ecosystem\": \"npm\"\n      },\n      \"vulnerable_version_range\": \"< 1.0.0\",\n      \"patched_versions\": \"1.0.0\",\n      \"vulnerable_functions\": [\n        \"important_function\"\n      ]\n    }\n  ],\n  \"cwe_ids\": [\n    \"CWE-1101\",\n    \"CWE-20\"\n  ],\n  \"credits\": [\n    {\n      \"login\": \"monalisa\",\n      \"type\": \"reporter\"\n    },\n    {\n      \"login\": \"octocat\",\n      \"type\": \"analyst\"\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 201):**\n\n* `ghsa_id`: required, string, read-only\n* `cve_id`: required, string or null\n* `url`: required, string, format: uri, read-only\n* `html_url`: required, string, format: uri, read-only\n* `summary`: required, string, maxLength: 1024\n* `description`: required, string or null, maxLength: 65535\n* `severity`: required, string or null, enum: `critical`, `high`, `medium`, `low`, `null`\n* `author`: required, all of:\n  * **Simple User**\n    * `name`: string or null\n    * `email`: string or null\n    * `login`: required, string\n    * `id`: required, integer, format: int64\n    * `node_id`: required, string\n    * `avatar_url`: required, string, format: uri\n    * `gravatar_id`: required, string or null\n    * `url`: required, string, format: uri\n    * `html_url`: required, string, format: uri\n    * `followers_url`: required, string, format: uri\n    * `following_url`: required, string\n    * `gists_url`: required, string\n    * `starred_url`: required, string\n    * `subscriptions_url`: required, string, format: uri\n    * `organizations_url`: required, string, format: uri\n    * `repos_url`: required, string, format: uri\n    * `events_url`: required, string\n    * `received_events_url`: required, string, format: uri\n    * `type`: required, string\n    * `site_admin`: required, boolean\n    * `starred_at`: string\n    * `user_view_type`: string\n* `publisher`: required, all of:\n  * **Simple User** (see above)\n* `identifiers`: required, array of objects:\n  * `type`: required, string, enum: `CVE`, `GHSA`\n  * `value`: required, string\n* `state`: required, string, enum: `published`, `closed`, `withdrawn`, `draft`, `triage`\n* `created_at`: required, string or null, format: date-time, read-only\n* `updated_at`: required, string or null, format: date-time, read-only\n* `published_at`: required, string or null, format: date-time, read-only\n* `closed_at`: required, string or null, format: date-time, read-only\n* `withdrawn_at`: required, string or null, format: date-time, read-only\n* `submission`: required, object or null, read-only:\n  * `accepted`: required, boolean, read-only\n* `vulnerabilities`: required, array of objects or null:\n  * `package`: required, object or null:\n    * `ecosystem`: required, string, enum: `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `go`, `rust`, `erlang`, `actions`, `pub`, `other`, `swift`\n    * `name`: required, string or null\n  * `vulnerable_version_range`: required, string or null\n  * `patched_versions`: required, string or null\n  * `vulnerable_functions`: required, array of string or null\n* `cvss_severities`: object or null:\n  * `cvss_v3`: object or null:\n    * `vector_string`: required, string or null\n    * `score`: required, number or null, read-only, minimum: 0, maximum: 10\n  * `cvss_v4`: object or null:\n    * `vector_string`: required, string or null\n    * `score`: required, number or null, read-only, minimum: 0, maximum: 10\n* `cwes`: required, array of objects or null:\n  * `cwe_id`: required, string\n  * `name`: required, string, read-only\n* `cwe_ids`: required, array of string or null\n* `credits`: required, array of objects or null:\n  * `login`: string\n  * `type`: string, enum: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n* `credits_detailed`: required, array of objects or null:\n  * `user`: required, `Simple User` (see above)\n  * `type`: required, string, enum: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n  * `state`: required, string, enum: `accepted`, `declined`, `pending`\n* `collaborating_users`: required, array of `Simple User` or null (see above)\n* `collaborating_teams`: required, array of `Team` or null:\n  * `id`: required, integer\n  * `node_id`: required, string\n  * `name`: required, string\n  * `slug`: required, string\n  * `description`: required, string or null\n  * `privacy`: string\n  * `notification_setting`: string\n  * `permission`: required, string\n  * `permissions`: object:\n    * `pull`: required, boolean\n    * `triage`: required, boolean\n    * `push`: required, boolean\n    * `maintain`: required, boolean\n    * `admin`: required, boolean\n  * `url`: required, string, format: uri\n  * `html_url`: required, string, format: uri\n  * `members_url`: required, string\n  * `repositories_url`: required, string, format: uri\n  * `type`: required, string, enum: `enterprise`, `organization`\n  * `access_source`: string, enum: `direct`, `organization`, `enterprise`\n  * `organization_id`: integer\n  * `enterprise_id`: integer\n  * `parent`: required, any of:\n    * **null**\n    * **Team Simple**\n      * `id`: required, integer\n      * `node_id`: required, string\n      * `url`: required, string, format: uri\n      * `members_url`: required, string\n      * `name`: required, string\n      * `description`: required, string or null\n      * `permission`: required, string\n      * `privacy`: string\n      * `notification_setting`: string\n      * `html_url`: required, string, format: uri\n      * `repositories_url`: required, string, format: uri\n      * `slug`: required, string\n      * `ldap_dn`: string\n      * `type`: required, string, enum: `enterprise`, `organization`\n      * `organization_id`: integer\n      * `enterprise_id`: integer\n* `private_fork`: required, all of:\n  * **Simple Repository**\n    * `id`: required, integer, format: int64\n    * `node_id`: required, string\n    * `name`: required, string\n    * `full_name`: required, string\n    * `owner`: required, `Simple User` (see above)\n    * `private`: required, boolean\n    * `html_url`: required, string, format: uri\n    * `description`: required, string or null\n    * `fork`: required, boolean\n    * `url`: required, string, format: uri\n    * `archive_url`: required, string\n    * `assignees_url`: required, string\n    * `blobs_url`: required, string\n    * `branches_url`: required, string\n    * `collaborators_url`: required, string\n    * `comments_url`: required, string\n    * `commits_url`: required, string\n    * `compare_url`: required, string\n    * `contents_url`: required, string\n    * `contributors_url`: required, string, format: uri\n    * `deployments_url`: required, string, format: uri\n    * `downloads_url`: required, string, format: uri\n    * `events_url`: required, string, format: uri\n    * `forks_url`: required, string, format: uri\n    * `git_commits_url`: required, string\n    * `git_refs_url`: required, string\n    * `git_tags_url`: required, string\n    * `issue_comment_url`: required, string\n    * `issue_events_url`: required, string\n    * `issues_url`: required, string\n    * `keys_url`: required, string\n    * `labels_url`: required, string\n    * `languages_url`: required, string, format: uri\n    * `merges_url`: required, string, format: uri\n    * `milestones_url`: required, string\n    * `notifications_url`: required, string\n    * `pulls_url`: required, string\n    * `releases_url`: required, string\n    * `stargazers_url`: required, string, format: uri\n    * `statuses_url`: required, string\n    * `subscribers_url`: required, string, format: uri\n    * `subscription_url`: required, string, format: uri\n    * `tags_url`: required, string, format: uri\n    * `teams_url`: required, string, format: uri\n    * `trees_url`: required, string\n    * `hooks_url`: required, string, format: uri\n\n## Privately report a security vulnerability\n\n```\nPOST /repos/{owner}/{repo}/security-advisories/reports\n```\n\nReport a security vulnerability to the maintainers of the repository.\nSee \"Privately reporting a security vulnerability\" for more information about private vulnerability reporting.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n#### Body parameters\n\n- **`summary`** (string) (required)\n  A short summary of the advisory.\n\n- **`description`** (string) (required)\n  A detailed description of what the advisory impacts.\n\n- **`vulnerabilities`** (array of objects or null)\n  An array of products affected by the vulnerability detailed in a repository security advisory.\n  - **`package`** (object) (required)\n    The name of the package affected by the vulnerability.\n    - **`ecosystem`** (string) (required)\n      The package's language or package management ecosystem.\n      Can be one of: `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `go`, `rust`, `erlang`, `actions`, `pub`, `other`, `swift`\n    - **`name`** (string or null)\n      The unique package name within its ecosystem.\n  - **`vulnerable_version_range`** (string or null)\n    The range of the package versions affected by the vulnerability.\n  - **`patched_versions`** (string or null)\n    The package version(s) that resolve the vulnerability.\n  - **`vulnerable_functions`** (array of strings or null)\n    The functions in the package that are affected.\n\n- **`cwe_ids`** (array of strings or null)\n  A list of Common Weakness Enumeration (CWE) IDs.\n\n- **`severity`** (string or null)\n  The severity of the advisory. You must choose between setting this field or cvss_vector_string.\n  Can be one of: `critical`, `high`, `medium`, `low`, `null`\n\n- **`cvss_vector_string`** (string or null)\n  The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or severity.\n\n- **`start_private_fork`** (boolean)\n  Whether to create a temporary private fork of the repository to collaborate on a fix.\n  Default: `false`\n\n### HTTP response status codes\n\n- **201** - Created\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/reports \\\n  -d '{\n  \"summary\": \"A newly discovered vulnerability\",\n  \"description\": \"A more in-depth description of what the problem is.\",\n  \"severity\": \"high\",\n  \"vulnerabilities\": [\n    {\n      \"package\": {\n        \"name\": \"a-package\",\n        \"ecosystem\": \"npm\"\n      },\n      \"vulnerable_version_range\": \"< 1.0.0\",\n      \"patched_versions\": \"1.0.0\",\n      \"vulnerable_functions\": [\n        \"important_function\"\n      ]\n    }\n  ],\n  \"cwe_ids\": [\n    \"CWE-123\"\n  ]\n}'\n```\n\n**Response schema (Status: 201):**\n\nSame response schema as [Create a repository security advisory](#create-a-repository-security-advisory).\n\n## Get a repository security advisory\n\n```\nGET /repos/{owner}/{repo}/security-advisories/{ghsa_id}\n```\n\nGet a repository security advisory using its GitHub Security Advisory (GHSA) identifier.\nAnyone can access any published security advisory on a public repository.\nThe authenticated user can access an unpublished security advisory from a repository if they are a security manager or administrator of that repository, or if they are a\ncollaborator on the security advisory.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`ghsa_id`** (string) (required)\n  The GHSA (GitHub Security Advisory) identifier of the advisory.\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create a repository security advisory](#create-a-repository-security-advisory).\n\n## Update a repository security advisory\n\n```\nPATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id}\n```\n\nUpdate a repository security advisory using its GitHub Security Advisory (GHSA) identifier.\nIn order to update any security advisory, the authenticated user must be a security manager or administrator of that repository,\nor a collaborator on the repository security advisory.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`ghsa_id`** (string) (required)\n  The GHSA (GitHub Security Advisory) identifier of the advisory.\n\n#### Body parameters\n\n- **`summary`** (string)\n  A short summary of the advisory.\n\n- **`description`** (string)\n  A detailed description of what the advisory impacts.\n\n- **`cve_id`** (string or null)\n  The Common Vulnerabilities and Exposures (CVE) ID.\n\n- **`vulnerabilities`** (array of objects)\n  A product affected by the vulnerability detailed in a repository security advisory.\n  - **`package`** (object) (required)\n    The name of the package affected by the vulnerability.\n    - **`ecosystem`** (string) (required)\n      The package's language or package management ecosystem.\n      Can be one of: `rubygems`, `npm`, `pip`, `maven`, `nuget`, `composer`, `go`, `rust`, `erlang`, `actions`, `pub`, `other`, `swift`\n    - **`name`** (string or null)\n      The unique package name within its ecosystem.\n  - **`vulnerable_version_range`** (string or null)\n    The range of the package versions affected by the vulnerability.\n  - **`patched_versions`** (string or null)\n    The package version(s) that resolve the vulnerability.\n  - **`vulnerable_functions`** (array of strings or null)\n    The functions in the package that are affected.\n\n- **`cwe_ids`** (array of strings or null)\n  A list of Common Weakness Enumeration (CWE) IDs.\n\n- **`credits`** (array of objects or null)\n  A list of users receiving credit for their participation in the security advisory.\n  - **`login`** (string) (required)\n    The username of the user credited.\n  - **`type`** (string) (required)\n    The type of credit the user is receiving.\n    Can be one of: `analyst`, `finder`, `reporter`, `coordinator`, `remediation_developer`, `remediation_reviewer`, `remediation_verifier`, `tool`, `sponsor`, `other`\n\n- **`severity`** (string or null)\n  The severity of the advisory. You must choose between setting this field or cvss_vector_string.\n  Can be one of: `critical`, `high`, `medium`, `low`, `null`\n\n- **`cvss_vector_string`** (string or null)\n  The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or severity.\n\n- **`state`** (string)\n  The state of the advisory.\n  Can be one of: `published`, `closed`, `draft`\n\n- **`collaborating_users`** (array of strings or null)\n  A list of usernames who have been granted write access to the advisory.\n\n- **`collaborating_teams`** (array of strings or null)\n  A list of team slugs which have been granted write access to the advisory.\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Updating the severity and state.\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PATCH \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID \\\n  -d '{\n  \"severity\": \"critical\",\n  \"state\": \"published\"\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create a repository security advisory](#create-a-repository-security-advisory).\n\n#### To add a credit to an advisory, send the whole array of values.\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PATCH \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID \\\n  -d '{\n  \"credits\": [\n    {\n      \"login\": \"monauser\",\n      \"type\": \"remediation_developer\"\n    }\n  ]\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Create a repository security advisory](#create-a-repository-security-advisory).\n\n## Request a CVE for a repository security advisory\n\n```\nPOST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve\n```\n\nIf you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see \"Requesting a CVE identification number.\"\nYou may request a CVE for public repositories, but cannot do so for private repositories.\nIn order to request a CVE for a repository security advisory, the authenticated user must be a security manager or administrator of that repository.\nOAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:write scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`ghsa_id`** (string) (required)\n  The GHSA (GitHub Security Advisory) identifier of the advisory.\n\n### HTTP response status codes\n\n- **202** - Accepted\n\n- **400** - Bad Request\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID/cve\n```\n\n**Response schema (Status: 202):**\n\nobject\n\n## Create a temporary private fork\n\n```\nPOST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/forks\n```\n\nCreate a temporary private fork to collaborate on fixing a security vulnerability in your repository.\nNote\n\nForking a repository happens asynchronously. You may have to wait up to 5 minutes before you can access the fork.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`ghsa_id`** (string) (required)\n  The GHSA (GitHub Security Advisory) identifier of the advisory.\n\n### HTTP response status codes\n\n- **202** - Accepted\n\n- **400** - Bad Request\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/repos/OWNER/REPO/security-advisories/GHSA_ID/forks\n```\n\n**Response schema (Status: 202):**\n\n* `id`: required, integer, format: int64\n* `node_id`: required, string\n* `name`: required, string\n* `full_name`: required, string\n* `owner`: required, `Simple User`:\n  * `name`: string or null\n  * `email`: string or null\n  * `login`: required, string\n  * `id`: required, integer, format: int64\n  * `node_id`: required, string\n  * `avatar_url`: required, string, format: uri\n  * `gravatar_id`: required, string or null\n  * `url`: required, string, format: uri\n  * `html_url`: required, string, format: uri\n  * `followers_url`: required, string, format: uri\n  * `following_url`: required, string\n  * `gists_url`: required, string\n  * `starred_url`: required, string\n  * `subscriptions_url`: required, string, format: uri\n  * `organizations_url`: required, string, format: uri\n  * `repos_url`: required, string, format: uri\n  * `events_url`: required, string\n  * `received_events_url`: required, string, format: uri\n  * `type`: required, string\n  * `site_admin`: required, boolean\n  * `starred_at`: string\n  * `user_view_type`: string\n* `private`: required, boolean\n* `html_url`: required, string, format: uri\n* `description`: required, string or null\n* `fork`: required, boolean\n* `url`: required, string, format: uri\n* `archive_url`: required, string\n* `assignees_url`: required, string\n* `blobs_url`: required, string\n* `branches_url`: required, string\n* `collaborators_url`: required, string\n* `comments_url`: required, string\n* `commits_url`: required, string\n* `compare_url`: required, string\n* `contents_url`: required, string\n* `contributors_url`: required, string, format: uri\n* `deployments_url`: required, string, format: uri\n* `downloads_url`: required, string, format: uri\n* `events_url`: required, string, format: uri\n* `forks_url`: required, string, format: uri\n* `git_commits_url`: required, string\n* `git_refs_url`: required, string\n* `git_tags_url`: required, string\n* `git_url`: required, string\n* `issue_comment_url`: required, string\n* `issue_events_url`: required, string\n* `issues_url`: required, string\n* `keys_url`: required, string\n* `labels_url`: required, string\n* `languages_url`: required, string, format: uri\n* `merges_url`: required, string, format: uri\n* `milestones_url`: required, string\n* `notifications_url`: required, string\n* `pulls_url`: required, string\n* `releases_url`: required, string\n* `ssh_url`: required, string\n* `stargazers_url`: required, string, format: uri\n* `statuses_url`: required, string\n* `subscribers_url`: required, string, format: uri\n* `subscription_url`: required, string, format: uri\n* `tags_url`: required, string, format: uri\n* `teams_url`: required, string, format: uri\n* `trees_url`: required, string\n* `clone_url`: required, string\n* `mirror_url`: required, string or null, format: uri\n* `hooks_url`: required, string, format: uri\n* `svn_url`: required, string, format: uri\n* `homepage`: required, string or null, format: uri\n* `language`: required, string or null\n* `forks_count`: required, integer\n* `stargazers_count`: required, integer\n* `watchers_count`: required, integer\n* `size`: required, integer\n* `default_branch`: required, string\n* `open_issues_count`: required, integer\n* `is_template`: boolean\n* `topics`: array of string\n* `has_issues`: required, boolean\n* `has_projects`: required, boolean\n* `has_wiki`: required, boolean\n* `has_pages`: required, boolean\n* `has_discussions`: required, boolean\n* `has_pull_requests`: boolean\n* `pull_request_creation_policy`: string, enum: `all`, `collaborators_only`\n* `archived`: required, boolean\n* `disabled`: required, boolean\n* `visibility`: string\n* `pushed_at`: required, string, format: date-time\n* `created_at`: required, string, format: date-time\n* `updated_at`: required, string, format: date-time\n* `permissions`: object:\n  * `admin`: required, boolean\n  * `maintain`: boolean\n  * `push`: required, boolean\n  * `triage`: boolean\n  * `pull`: required, boolean\n* `allow_rebase_merge`: boolean\n* `template_repository`: any of:\n  * **null**\n  * **Repository**\n    * `id`: required, integer, format: int64\n    * `node_id`: required, string\n    * `name`: required, string\n    * `full_name`: required, string\n    * `license`: required, any of:\n      * **null**\n      * **License Simple**\n        * `key`: required, string\n        * `name`: required, string\n        * `url`: required, string or null, format: uri\n        * `spdx_id`: required, string or null\n        * `node_id`: required, string\n        * `html_url`: string, format: uri\n    * `forks`: required, integer\n    * `permissions`: object:\n      * `admin`: required, boolean\n      * `pull`: required, boolean\n      * `triage`: boolean\n      * `push`: required, boolean\n      * `maintain`: boolean\n    * `owner`: required, `Simple User` (see above)\n    * `private`: required, boolean, default: `false`\n    * `html_url`: required, string, format: uri\n    * `description`: required, string or null\n    * `fork`: required, boolean\n    * `url`: required, string, format: uri\n    * `archive_url`: required, string\n    * `assignees_url`: required, string\n    * `blobs_url`: required, string\n    * `branches_url`: required, string\n    * `collaborators_url`: required, string\n    * `comments_url`: required, string\n    * `commits_url`: required, string\n    * `compare_url`: required, string\n    * `contents_url`: required, string\n    * `contributors_url`: required, string, format: uri\n    * `deployments_url`: required, string, format: uri\n    * `downloads_url`: required, string, format: uri\n    * `events_url`: required, string, format: uri\n    * `forks_url`: required, string, format: uri\n    * `git_commits_url`: required, string\n    * `git_refs_url`: required, string\n    * `git_tags_url`: required, string\n    * `git_url`: required, string\n    * `issue_comment_url`: required, string\n    * `issue_events_url`: required, string\n    * `issues_url`: required, string\n    * `keys_url`: required, string\n    * `labels_url`: required, string\n    * `languages_url`: required, string, format: uri\n    * `merges_url`: required, string, format: uri\n    * `milestones_url`: required, string\n    * `notifications_url`: required, string\n    * `pulls_url`: required, string\n    * `releases_url`: required, string\n    * `ssh_url`: required, string\n    * `stargazers_url`: required, string, format: uri\n    * `statuses_url`: required, string\n    * `subscribers_url`: required, string, format: uri\n    * `subscription_url`: required, string, format: uri\n    * `tags_url`: required, string, format: uri\n    * `teams_url`: required, string, format: uri\n    * `trees_url`: required, string\n    * `clone_url`: required, string\n    * `mirror_url`: required, string or null, format: uri\n    * `hooks_url`: required, string, format: uri\n    * `svn_url`: required, string, format: uri\n    * `homepage`: required, string or null, format: uri\n    * `language`: required, string or null\n    * `forks_count`: required, integer\n    * `stargazers_count`: required, integer\n    * `watchers_count`: required, integer\n    * `size`: required, integer\n    * `default_branch`: required, string\n    * `open_issues_count`: required, integer\n    * `is_template`: boolean, default: `false`\n    * `topics`: array of string\n    * `has_issues`: required, boolean, default: `true`\n    * `has_projects`: required, boolean, default: `true`\n    * `has_wiki`: required, boolean, default: `true`\n    * `has_pages`: required, boolean\n    * `has_discussions`: boolean, default: `false`\n    * `has_pull_requests`: boolean, default: `true`\n    * `pull_request_creation_policy`: string, enum: `all`, `collaborators_only`\n    * `archived`: required, boolean, default: `false`\n    * `disabled`: required, boolean\n    * `visibility`: string, default: `\"public\"`\n    * `pushed_at`: required, string or null, format: date-time\n    * `created_at`: required, string or null, format: date-time\n    * `updated_at`: required, string or null, format: date-time\n    * `allow_rebase_merge`: boolean, default: `true`\n    * `temp_clone_token`: string\n    * `allow_squash_merge`: boolean, default: `true`\n    * `allow_auto_merge`: boolean, default: `false`\n    * `delete_branch_on_merge`: boolean, default: `false`\n    * `allow_update_branch`: boolean, default: `false`\n    * `squash_merge_commit_title`: string, enum: `PR_TITLE`, `COMMIT_OR_PR_TITLE`\n    * `squash_merge_commit_message`: string, enum: `PR_BODY`, `COMMIT_MESSAGES`, `BLANK`\n    * `merge_commit_title`: string, enum: `PR_TITLE`, `MERGE_MESSAGE`\n    * `merge_commit_message`: string, enum: `PR_BODY`, `PR_TITLE`, `BLANK`\n    * `allow_merge_commit`: boolean, default: `true`\n    * `allow_forking`: boolean\n    * `web_commit_signoff_required`: boolean, default: `false`\n    * `open_issues`: required, integer\n    * `watchers`: required, integer\n    * `starred_at`: string\n    * `anonymous_access_enabled`: boolean\n    * `code_search_index_status`: object:\n      * `lexical_search_ok`: boolean\n      * `lexical_commit_sha`: string\n* `temp_clone_token`: string or null\n* `allow_squash_merge`: boolean\n* `allow_auto_merge`: boolean\n* `delete_branch_on_merge`: boolean\n* `allow_merge_commit`: boolean\n* `allow_update_branch`: boolean\n* `squash_merge_commit_title`: string, enum: `PR_TITLE`, `COMMIT_OR_PR_TITLE`\n* `squash_merge_commit_message`: string, enum: `PR_BODY`, `COMMIT_MESSAGES`, `BLANK`\n* `merge_commit_title`: string, enum: `PR_TITLE`, `MERGE_MESSAGE`\n* `merge_commit_message`: string, enum: `PR_BODY`, `PR_TITLE`, `BLANK`\n* `allow_forking`: boolean\n* `web_commit_signoff_required`: boolean\n* `subscribers_count`: required, integer\n* `network_count`: required, integer\n* `license`: required, any of:\n  * **null**\n  * **License Simple** (see above)\n* `organization`: any of:\n  * **null**\n  * **Simple User** (see above)\n* `parent`: `Repository` (see above)\n* `source`: `Repository` (see above)\n* `forks`: required, integer\n* `master_branch`: string\n* `open_issues`: required, integer\n* `watchers`: required, integer\n* `anonymous_access_enabled`: boolean, default: `true`\n* `code_of_conduct`: `Code Of Conduct Simple`:\n  * `url`: required, string, format: uri\n  * `key`: required, string\n  * `name`: required, string\n  * `html_url`: required, string or null, format: uri\n* `security_and_analysis`: object or null:\n  * `advanced_security`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `code_security`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `dependabot_security_updates`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_push_protection`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_non_provider_patterns`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_ai_detection`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_validity_checks`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_delegated_alert_dismissal`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_delegated_bypass`: object:\n    * `status`: string, enum: `enabled`, `disabled`\n  * `secret_scanning_delegated_bypass_options`: object:\n    * `reviewers`: array of objects:\n      * `reviewer_id`: required, integer\n      * `reviewer_type`: required, string, enum: `TEAM`, `ROLE`\n      * `mode`: string, enum: `ALWAYS`, `EXEMPT`, default: `\"ALWAYS\"`\n* `custom_properties`: object, additional properties allowed"}