GitHub

GitHub Dependabot API

Endpoints to manage Dependabot.

GitHub OpenAPI
Business capability
Vulnerability Management BC-620.40

Operations 25

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /enterprises/{enterprise}/dependabot/alerts List Dependabot alerts across an enterprise · List Dependabot alerts for an enterprise #
Ask an LLM
“Which vulnerable dependencies are open across every repo in our enterprise?”
“Can I see only critical Dependabot alerts enterprise-wide?”
Tell an agent
List open Dependabot alerts for enterprise {enterprise}.
Show {severity} severity Dependabot alerts across enterprise {enterprise} in the {ecosystem} ecosystem.
GET /enterprises/{enterprise}/dependabot/repository-access Lists the repositories Dependabot can access in an enterprise #
PATCH /enterprises/{enterprise}/dependabot/repository-access Updates Dependabot's repository access list for an enterprise #
PUT /enterprises/{enterprise}/dependabot/repository-access/default-level Set the default repository access level for Dependabot in an enterprise #
GET /orgs/{org}/dependabot/alerts List Dependabot alerts for an organization · List Dependabot alerts for an organization #
Ask an LLM
“What Dependabot security alerts are open across my organization's repos?”
“Can I find every org alert affecting one specific package?”
Tell an agent
List Dependabot alerts across the {org} organization.
Show {state} org-level Dependabot alerts in {org} for package {package}.
GET /orgs/{org}/dependabot/repository-access Lists the repositories Dependabot can access in an organization #
PATCH /orgs/{org}/dependabot/repository-access Updates Dependabot's repository access list for an organization #
PUT /orgs/{org}/dependabot/repository-access/default-level Set the default repository access level for Dependabot #
GET /orgs/{org}/dependabot/secrets List an organization's Dependabot secrets · List organization secrets #
Ask an LLM
“What Dependabot secrets has my organization defined?”
“Can I see org Dependabot secret names without exposing their values?”
Tell an agent
List the Dependabot secrets in organization {org}.
Show all org-level Dependabot secret names for {org}.
GET /orgs/{org}/dependabot/secrets/public-key Get the org key for encrypting Dependabot secrets · Get an organization public key #
Ask an LLM
“Which public key do I encrypt an organization Dependabot secret with?”
“Where do I get the key_id to send with a new org secret?”
Tell an agent
Get the Dependabot secrets public key for organization {org}.
Fetch the encryption key and key ID for {org}'s Dependabot secrets.
GET /orgs/{org}/dependabot/secrets/{secret_name} Get one organization Dependabot secret · Get an organization secret #
Ask an LLM
“When was an org Dependabot secret last updated and who can use it?”
“Can I check the visibility of a single organization Dependabot secret?”
Tell an agent
Get the org Dependabot secret {secret_name} in {org}.
Show visibility and update time for organization secret {secret_name} in {org}.
PUT /orgs/{org}/dependabot/secrets/{secret_name} Create or update an org Dependabot secret · Create or update an organization secret #
Ask an LLM
“How do I add a private registry token as a Dependabot secret for my whole org?”
“Can I make an org Dependabot secret available to only selected repositories?”
Tell an agent
Save org Dependabot secret {secret_name} in {org} with encrypted value {encrypted_value}, key {key_id}, visibility {visibility}.
Set organization secret {secret_name} in {org} to {visibility} visibility for repos {selected_repository_ids}.
DELETE /orgs/{org}/dependabot/secrets/{secret_name} Delete an organization Dependabot secret · Delete an organization secret #
Ask an LLM
“How can I remove an organization-level Dependabot secret?”
“What scope does my token need to delete an org Dependabot secret?”
Tell an agent destructive · confirm first
Delete org Dependabot secret {secret_name} from {org}.
Remove the organization secret {secret_name} used by Dependabot in {org}.
GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories List repos allowed to use an org Dependabot secret · List selected repositories for an organization secret #
Ask an LLM
“Which repositories can use an org Dependabot secret set to selected visibility?”
“Can I see the allow-list of repos for a Dependabot secret?”
Tell an agent
List repositories selected for org secret {secret_name} in {org}.
Show which repos may read Dependabot secret {secret_name} in the {org} organization.
PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories Replace the repo list for an org Dependabot secret · Set selected repositories for an organization secret #
Ask an LLM
“Can I overwrite the full set of repositories allowed to use an org Dependabot secret?”
“Does setting selected repositories replace the existing list?”
Tell an agent
Replace the repositories for org secret {secret_name} in {org} with {selected_repository_ids}.
Set exactly repos {selected_repository_ids} as the allow-list for Dependabot secret {secret_name} in {org}.
PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id} Add a repo to an org Dependabot secret · Add selected repository to an organization secret #
Ask an LLM
“How do I let one more repository use an org Dependabot secret?”
“Does adding a single repo to a secret work when visibility isn't selected?”
Tell an agent
Add repository {repository_id} to org secret {secret_name} in {org}.
Allow repo ID {repository_id} to use Dependabot secret {secret_name} in the {org} organization.
DELETE /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id} Remove a repo from an org Dependabot secret · Remove selected repository from an organization secret #
Ask an LLM
“Can I stop one repository from using an org Dependabot secret?”
“How do I take a repo off a Dependabot secret's allow-list?”
Tell an agent destructive · confirm first
Remove repository {repository_id} from org secret {secret_name} in {org}.
Revoke repo ID {repository_id}'s access to Dependabot secret {secret_name} in the {org} organization.
GET /repos/{owner}/{repo}/dependabot/alerts List Dependabot alerts for a repository · List Dependabot alerts for a repository #
Ask an LLM
“Which vulnerable dependencies has Dependabot flagged in my repository?”
“Can I see only high and critical alerts for one manifest file?”
Tell an agent
List Dependabot alerts for {owner}/{repo}.
Show {severity} alerts in {owner}/{repo} for manifest {manifest}.
GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number} Get one Dependabot alert · Get a Dependabot alert #
Ask an LLM
“What vulnerability and package does a specific Dependabot alert refer to?”
“Can I pull the details of a single alert by its number?”
Tell an agent
Get Dependabot alert #{alert_number} in {owner}/{repo}.
Show the vulnerable package and advisory for alert {alert_number} of {owner}/{repo}.
PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number} Dismiss or reopen a Dependabot alert · Update a Dependabot alert #
Ask an LLM
“How do I dismiss a Dependabot alert as a false positive?”
“Is a reason required when I dismiss an alert?”
Tell an agent
Dismiss alert #{alert_number} in {owner}/{repo} with reason {dismissed_reason}.
Set Dependabot alert {alert_number} in {owner}/{repo} to state {state}.
GET /repos/{owner}/{repo}/dependabot/secrets List a repository's Dependabot secrets · List repository secrets #
Ask an LLM
“What Dependabot secrets are configured on this repository?”
“Can I list repo-level Dependabot secrets without seeing their values?”
Tell an agent
List the Dependabot secrets in repository {owner}/{repo}.
Show all repo-level Dependabot secret names for {owner}/{repo}.
GET /repos/{owner}/{repo}/dependabot/secrets/public-key Get the repo key for encrypting Dependabot secrets · Get a repository public key #
Ask an LLM
“Which public key should I use to encrypt a repository Dependabot secret?”
“Can someone with only read access get a repo's Dependabot public key?”
Tell an agent
Get the Dependabot secrets public key for repository {owner}/{repo}.
Fetch the repository-level encryption key and key ID used for Dependabot secrets on {owner}/{repo}.
GET /repos/{owner}/{repo}/dependabot/secrets/{secret_name} Get one repository Dependabot secret · Get a repository secret #
Ask an LLM
“When was a repository's Dependabot secret created or last changed?”
“Does a given repo Dependabot secret exist?”
Tell an agent
Get the repo Dependabot secret {secret_name} in {owner}/{repo}.
Show metadata for repository secret {secret_name} on {owner}/{repo}.
PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name} Create or update a repo Dependabot secret · Create or update a repository secret #
Ask an LLM
“How do I give Dependabot a registry credential for just one repository?”
“What encryption does a repository Dependabot secret need before upload?”
Tell an agent
Save repo Dependabot secret {secret_name} in {owner}/{repo} with encrypted value {encrypted_value} and key {key_id}.
Update repository secret {secret_name} on {owner}/{repo} to new encrypted value {encrypted_value}.
DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name} Delete a repository Dependabot secret · Delete a repository secret #
Ask an LLM
“How can I remove a Dependabot secret from a single repository?”
“What token scope is needed to delete a repo Dependabot secret?”
Tell an agent destructive · confirm first
Delete repo Dependabot secret {secret_name} from {owner}/{repo}.
Remove the repository secret {secret_name} used by Dependabot on {owner}/{repo}.

Documentation

📖
Documentation
https://docs.github.com/en/rest/apps
📖
Documentation
https://docs.github.com/en/rest/codes-of-conduct/codes-of-conduct
📖
Documentation
https://docs.github.com/en/rest/emojis
📖
Documentation
https://docs.github.com/en/rest/gitignore
📖
Documentation
https://docs.github.com/en/rest/apps/installations
📖
Documentation
https://docs.github.com/en/rest/enterprise-admin
📖
Documentation
https://docs.github.com/en/rest/activity/events
📖
Documentation
https://docs.github.com/en/rest/orgs
📖
Documentation
https://docs.github.com/en/rest/rate-limit
📖
Documentation
https://docs.github.com/en/enterprise-cloud@latest/rest/scim
📖
Documentation
https://docs.github.com/en/rest/using-the-rest-api/getting-started-with-the-rest-api
📖
Documentation
https://docs.github.com/en/rest/teams
📖
Documentation
https://docs.github.com/en/rest/meta/meta
📖
Documentation
https://docs.github.com/en/rest/actions
📖
Documentation
https://docs.github.com/en/rest/branches
📖
Documentation
https://docs.github.com/en/rest/code-scanning
📖
Documentation
https://docs.github.com/en/rest/collaborators
📖
Documentation
https://docs.github.com/en/rest/dependabot
📖
Documentation
https://docs.github.com/en/rest/webhooks
📖
Documentation
https://docs.github.com/en/rest/pulls
📖
Documentation
https://docs.github.com/en/rest/git/tags
📖
Documentation
https://docs.github.com/en/rest/repos/autolinks
📖
Documentation
https://docs.github.com/en/rest/collaborators/invitations

Specifications

⚙
OpenAPI
https://artifacts.apis.io/github/openapi/github-dependabot-api-openapi.yml
⚙
AsyncAPI
https://artifacts.apis.io/github/asyncapi/github-webhooks-asyncapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-minimal-repository-schema.json
📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-dependabot-alert-with-repository-schema.json
📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-dependabot-alert-schema.json
📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-organization-dependabot-secret-schema.json
📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-dependabot-secret-schema.json
📊
JSONSchema
https://artifacts.apis.io/github/json-schema/github-dependabot-public-key-schema.json

Other Resources

🔗
Reference
https://docs.github.com/en/webhooks/webhook-events-and-payloads

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/github:github-dependabot-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

github-dependabot-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Github Dependabot API
  version: 1.1.4
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  x-refined-note:
  - x-github-plan differs across the merged source definitions and was not carried
  - x-github-release differs across the merged source definitions and was not carried
  description: 'Operations tagged dependabot across 2 of this provider''s published API definitions: github-openapi.json, github-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.github.com
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:


# --- truncated at 32 KB (240 KB total) ---
# Full source: https://artifacts.apis.io/github/openapi/github-dependabot-api-openapi.yml