보안 권고에 대한 REST API 엔드포인트

Sync innersource vulnerabilities for an enterprise

Synchronize innersource vulnerability data with the Advisory Database for an enterprise. This endpoint receives vulnerability data in OSV format and creates, updates, or withdraws innersource vulnerabilities accordingly. Dependabot alerting is triggered for created and updated vulnerabilities.

The request body accepts up to 100 vulnerabilities per call. The request is validated and then queued for asynchronous processing: a successful request returns 202 Accepted with a Location header pointing to a status URL that you poll for the final result.

Syncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see "Rate limits for the API" and "Best practices for using the REST API."

This endpoint does not support OAuth apps or personal access tokens.

"Sync innersource vulnerabilities for an enterprise"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

GitHub 앱 설치 액세스 토큰

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise innersource vulnerabilities" enterprise permissions (write)

"Sync innersource vulnerabilities for an enterprise"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.

이름, 유형, 설명

array

Array of vulnerabilities in OSV format to synchronize

Properties of

이름, 유형, 설명

id string 필수

Unique identifier for the vulnerability from the external system

schema_version string

The OSV schema version

summary string

A short summary of the vulnerability

details string

Detailed description of the vulnerability

aliases array of strings

IDs for the same vulnerability in other databases. Only CVE IDs are used (to populate the vulnerability's CVE identifier); other aliases are ignored.

severity array of objects

Severity information for the vulnerability

Properties of severity

이름, 유형, 설명
`type` string The type of severity scoring (e.g., CVSS_V3)
`score` string The severity score or vector string

affected array of objects

Packages and versions affected by the vulnerability

Properties of affected

이름, 유형, 설명

package object

Properties of package

이름, 유형, 설명
`ecosystem` string The package ecosystem (e.g., npm, pip, maven)
`name` string The package name

ranges array of objects

Properties of ranges

이름, 유형, 설명

type string

events array of objects

Properties of events

이름, 유형, 설명
`introduced` string The version that introduced the vulnerability
`fixed` string The version that fixed the vulnerability
`last_affected` string The last affected version
`limit` string The upper limit of the affected range

references array of objects

URLs for more information about the vulnerability

Properties of references

이름, 유형, 설명
`type` string The type of reference. Supported values: PACKAGE, ADVISORY, WEB, FIX, ARTICLE, REPORT, EVIDENCE. References with other types are ignored.
`url` string The reference URL

published string

When the vulnerability was first published

modified string

When the vulnerability was last modified

withdrawn string

When the vulnerability was withdrawn. If present, the vulnerability will be marked as withdrawn.

"Sync innersource vulnerabilities for an enterprise"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`202`	Sync operation accepted for asynchronous processing. Poll the returned URL for results.
`400`	Bad Request
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.

"Sync innersource vulnerabilities for an enterprise"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

post/enterprises/{enterprise}/innersource-vulnerabilities/sync

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync \
  -d '[{"id":"MVS-2026-001","schema_version":"1.4.0","summary":"Example vulnerability summary","aliases":["GHSA-xxxx-xxxx-xxxx"],"affected":[{"package":{"ecosystem":"npm","name":"example-package"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]}]}]'

Sync operation accepted for asynchronous processing. Poll the returned URL for results.

Status: 202

{
  "id": "external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "url": "https://api.github.com/enterprises/my-enterprise/innersource-vulnerabilities/sync/status/external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "queued"
}

Get innersource vulnerability sync status for an enterprise

Get the status of an asynchronous innersource vulnerability sync operation for an enterprise. Returns 202 with a Retry-After header while the sync is still processing, or 200 with the full sync results once complete.

This endpoint does not support OAuth apps or personal access tokens.

"Get innersource vulnerability sync status for an enterprise"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

GitHub 앱 설치 액세스 토큰

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise innersource vulnerabilities" enterprise permissions (write)

"Get innersource vulnerability sync status for an enterprise"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.
`job_id` string 필수 The unique identifier of the sync job.

"Get innersource vulnerability sync status for an enterprise"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`200`	Sync operation completed
`202`	Sync operation is still processing
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found

"Get innersource vulnerability sync status for an enterprise"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

Select the example type

get/enterprises/{enterprise}/innersource-vulnerabilities/sync/status/{job_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/innersource-vulnerabilities/sync/status/JOB_ID

Sync operation completed

Status: 200

{
  "processed": 1,
  "created": 1,
  "updated": 0,
  "withdrawn": 0,
  "errors": 0,
  "results": [
    {
      "external_id": "MVS-2026-001",
      "status": "created",
      "ghsa_id": "GHIS-xxxx-xxxx-xxxx"
    }
  ]
}