---
title: "List repository security advisory comments"
method: GET
path: "/repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments"
tags: ["security-advisories"]
---

# List repository security advisory comments

`GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments`

## Request

- Base URL: `https://api.github.com`
- URL: `https://api.github.com/repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments`
- Auth: none declared

Lists comments on a repository security advisory.

Accessing internal comments requires write access to the advisory.

Callers with read-only access to the advisory receive only eligible post-publication comments. For unpublished advisories, these callers receive an empty list.

## Path parameters

- `owner` string, required
- `repo` string, required
- `ghsa_id` string, required

## Query parameters

- `since` string, date-time
- `per_page` integer
- `page` integer

## Response `200`

Response

- RepositoryAdvisoryComment[]
  - `id` integer, required: Unique identifier of the advisory comment.
  - `node_id` string, required
  - `url` string, uri, required: API URL for the advisory comment.
  - `html_url` string, uri, required: Web URL for the advisory comment.
  - `body` string, required: Contents of the advisory comment.
  - `user` NullableSimpleUser, nullable, required: A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `advisory_url` string, uri, required
  - `author_association` 'COLLABORATOR' | 'CONTRIBUTOR' | 'FIRST_TIMER' | 'FIRST_TIME_CONTRIBUTOR' | 'MANNEQUIN' | 'MEMBER' | 'NONE' | 'OWNER', required: How the author is associated with the repository.

## Other responses

- `403`: Forbidden
- `404`: Resource not found

## Changes

- **2026-10-28** `40ffa0de0018`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/github/apis/enterprise-cloud/changes/repos/:owner/:repo/security-advisories/:ghsa_id/comments/get.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) - [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) - [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/3b55ce443f5c?raw)