GitHub API (unofficial showcase)
PATCH/repos/{owner}/{repo}/dependabot/alerts/{alert_number}

Update a Dependabot alert

Updates a Dependabot alert in a repository, changing its state, dismissal details, assignees, or agent assignment. Provide state or assignees at minimum; when dismissing an alert, include dismissed_reason, and use assignees to replace or clear the existing assignments. The authenticated user needs access to repository security alerts, and OAuth app tokens or classic personal access tokens need the security_events scope, or public_repo for public repositories.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

3 parameters · 5 body fields
ownerstringrequired
The account owner of the repository. The name is not case-sensitive.
repostringrequired
The repository name without the `.git` extension. The name is not case-sensitive.
alert_numberintegerrequired
The number identifying the Dependabot alert in the repository; you can find it in the alert URL or in the `number` field returned by the alert-list operation.

Fields to update on the Dependabot alert. Provide state or assignees at minimum.

statestringrequired
The state of the Dependabot alert. A `dismissed_reason` must be provided when setting the state to `dismissed`.
Allowed:dismissedopen
dismissed_reasonstringoptional
**Required when `state` is `dismissed`.** A reason for dismissing the alert.
Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk
dismissed_commentstringoptional
An optional comment associated with dismissing the alert.
assigneesarray<string>optional
Usernames to assign to this Dependabot Alert. Pass one or more user logins to _replace_ the set of assignees on this alert. Send an empty array (`[]`) to clear all assignees from the alert. To assign an AI agent, include the bot login (for example, `copilot-swe-agent[bot]`).
agent_assignmentobjectoptional
Parameters for AI agent assignment. Only used when an agent bot login is included in `assignees`. Ignored when no agent is being assigned.

7 status codes
200Returns the updated Dependabot alert, including its state, dependency and advisory details, assignees, dismissal information, and alert timestamps.
numberintegerrequired
The security alert number.
statestringrequired
The state of the Dependabot alert.
Allowed:auto_dismisseddismissedfixedopen
dependencyobjectrequired
Details for the vulnerable dependency.
security_advisoryobjectrequired
Details for the GitHub Security Advisory.
security_vulnerabilityobjectrequired
Details pertaining to one vulnerable version range for the advisory.
urlstringrequired
The REST API URL of the alert resource.
html_urlstringrequired
The GitHub URL of the alert resource.
created_atstringrequired
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringrequired
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_atstringrequired
The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_byobjectrequired
A GitHub user.
dismissed_reasonstringrequired
The reason that the alert was dismissed.
Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk
dismissed_commentstringrequired
An optional comment associated with the alert's dismissal.
fixed_atstringrequired
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
auto_dismissed_atstringoptional
The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissal_requestobjectoptional
Information about an active dismissal request for this Dependabot alert.
assigneesarray<SimpleUser>optional
The users assigned to this alert.
400Returned when the request is invalid.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
403Returned when the authenticated user or token does not have access to repository security alerts.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Returned when the repository or Dependabot alert is not found.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
409Returned when the request conflicts with the current resource state.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
410Returned when the resource is no longer available.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Returned when validation fails or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 400 is returned for an invalid request, and a 403 when the authenticated user lacks access to repository security alerts or the token lacks the required scope. A 404 indicates that the repository or alert was not found; a 409 indicates a conflict while updating; a 410 indicates the resource is gone; and a 422 indicates validation failure or that the endpoint has been spammed. The owner and repo path parameters must identify the repository, and the alert_number path parameter must identify an alert in it. Supply state or assignees; state must be dismissed or open, dismissed_reason is required for dismissed and must be one of fix_started, inaccurate, no_bandwidth, not_used, or tolerable_risk, and dismissed_comment must not exceed 280 characters.