---
title: "Create a push protection bypass"
method: POST
path: "/repos/{owner}/{repo}/secret-scanning/push-protection-bypasses"
tags: ["secret-scanning"]
---

# Create a push protection bypass

`POST /repos/{owner}/{repo}/secret-scanning/push-protection-bypasses`

## Request

- Base URL: `https://api.github.com`
- URL: `https://api.github.com/repos/{owner}/{repo}/secret-scanning/push-protection-bypasses`
- Auth: none declared

Creates a bypass for a previously push protected secret.

The authenticated user must be the original author of the committed secret.

OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required

## Request body

- object
  - `reason` 'false_positive' | 'used_in_tests' | 'will_fix_later', required: The reason for bypassing push protection.
  - `placeholder_id` string, required: The ID of the push protection bypass placeholder. This value is returned on any push protected routes.

## Response `200`

Response

- SecretScanningPushProtectionBypass
  - `reason` 'false_positive' | 'used_in_tests' | 'will_fix_later': The reason for bypassing push protection.
  - `expire_at` string, date-time, nullable: The time that the bypass will expire in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `token_type` string: The token type this bypass is for.

## Other responses

- `403`: User does not have enough permissions to perform this action.
- `404`: Placeholder ID not found, or push protection is disabled on this repository.
- `422`: Bad request, input data missing or incorrect.
- `503`: Service unavailable

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/998ae512e4cd?raw)