Sign in
enterprise-admin

Sync innersource vulnerabilities for an enterprise

Synchronize innersource vulnerability data with the Advisory Database for an enterprise. This endpoint receives vulnerability data in OSV format and creates, updates, or withdraws innersource vulnerabilities accordingly. Dependabot alerting is triggered for created and updated vulnerabilities.

The request body accepts up to 100 vulnerabilities per call. The request is validated and then queued for asynchronous processing: a successful request returns 202 Accepted with a Location header pointing to a status URL that you poll for the final result.

Syncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see "Rate limits for the API" and "Best practices for using the REST API."

This endpoint does not support OAuth apps or personal access tokens.

post/enterprises/{enterprise}/innersource-vulnerabilities/sync

Path parameters

enterprisestring required

The slug version of the enterprise name.

Request body

idstring required

Unique identifier for the vulnerability from the external system

schema_versionstring

The OSV schema version

summarystring

A short summary of the vulnerability

detailsstring

Detailed description of the vulnerability

aliasesstring[]

IDs for the same vulnerability in other databases. Only CVE IDs are used (to populate the vulnerability's CVE identifier); other aliases are ignored.

publishedstring date-time

When the vulnerability was first published

modifiedstring date-time

When the vulnerability was last modified

withdrawnstring date-time

When the vulnerability was withdrawn. If present, the vulnerability will be marked as withdrawn.

Example request

[
  {
    "id": "MVS-2026-001",
    "schema_version": "1.4.0",
    "summary": "Example vulnerability summary",
    "aliases": [
      "CVE-2026-12345"
    ]
  }
]

Response

Sync operation accepted for asynchronous processing. Poll the returned URL for results.

idstring required

Job status ID for polling

urlstring uri required

URL to poll for sync results

status'queued' required

Initial job status

Example response

{
  "id": "external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "url": "https://api.github.com/enterprises/my-enterprise/external-vulnerabilities/sync/status/external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "queued"
}

Changes