---
title: "Request a CVE for a repository security advisory"
method: POST
path: "/repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve"
tags: ["security-advisories"]
---

# Request a CVE for a repository security advisory

`POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve`

## Request

- Base URL: `https://api.github.com`
- URL: `https://api.github.com/repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve`
- Auth: none declared

If you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see "[Requesting a CVE identification number](https://docs.github.com/code-security/security-advisories/repository-security-advisories/publishing-a-repository-security-advisory#requesting-a-cve-identification-number-optional)."

You may request a CVE for public repositories, but cannot do so for private repositories.

In order to request a CVE for a repository security advisory, the authenticated user must be a security manager or administrator of that repository.

OAuth app tokens and personal access tokens (classic) need the `repo` or `repository_advisories:write` scope to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required
- `ghsa_id` string, required

## Response `202`

Accepted

- object

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Resource not found
- `422`: Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.dev/github/apis/rest.md) · [All operations](https://skmtc.dev/github/apis/rest/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/rest/revisions/309e30296b21?raw)