---
title: "Create a repository advisory comment"
method: POST
path: "/repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments"
tags: ["security-advisories"]
---

# Create a repository advisory comment

`POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments`

## Request

- Base URL: `https://api.github.com`
- URL: `https://api.github.com/repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments`
- Auth: none declared

Creates a comment on a repository security advisory.

In order to create a comment, the authenticated user must be an advisory collaborator, security manager, or repository administrator.

## Path parameters

- `owner` string, required
- `repo` string, required
- `ghsa_id` string, required

## Request body

- object
  - `body` string, required: The contents of the comment.

## Response `201`

Response

- RepositoryAdvisoryComment: A comment on a repository security advisory.
  - `id` integer, required: Unique identifier of the advisory comment.
  - `node_id` string, required
  - `url` string, uri, required: API URL for the advisory comment.
  - `html_url` string, uri, required: Web URL for the advisory comment.
  - `body` string, required: Contents of the advisory comment.
  - `user` NullableSimpleUser, nullable, required: A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `advisory_url` string, uri, required
  - `author_association` 'COLLABORATOR' | 'CONTRIBUTOR' | 'FIRST_TIMER' | 'FIRST_TIME_CONTRIBUTOR' | 'MANNEQUIN' | 'MEMBER' | 'NONE' | 'OWNER', required: How the author is associated with the repository.

## Other responses

- `403`: Forbidden
- `404`: Resource not found
- `422`: Validation failed, or the endpoint has been spammed.

## Changes

- **2026-10-28** `40ffa0de0018`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/github/apis/enterprise-cloud/changes/repos/:owner/:repo/security-advisories/:ghsa_id/comments/post.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) - [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) - [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/3b55ce443f5c?raw)