---
title: "Create GitHub issue"
method: POST
path: "/v1/inbox/{itemId}/github-issue"
tags: ["Inbox"]
---

# Create GitHub issue

`POST /v1/inbox/{itemId}/github-issue`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/inbox/{itemId}/github-issue`
- Auth: HTTP bearer

Opens a GitHub issue in the connected repository for a code finding and records it on the item. Answers the existing issue when one was already created. An unresolved creation attempt returns 409 until reconciled. Requires inbox.write, a user token, and an admin or owner role.

## Path parameters

- `itemId` string, required

## Response `201`

The item with its GitHub issue.

- object
  - `success` true, required
  - `data` InboxItem, required
    - `assignedToUserId` string, nullable, required
    - `githubIssue` object, nullable, required
      - `createdAt` string, required
      - `number` integer, required
      - `url` string, required
    - `id` string, required
    - `organizationId` string, required
    - `priority` 'P0' | 'P1' | 'P2' | 'P3', nullable, required
    - `projectId` string, nullable, required
    - `repositoryName` string, nullable, required
    - `source` 'advisory' | 'code-audit' | 'runtime' | 'website-audit', required
    - `status` 'accepted' | 'dismissed' | 'open' | 'resolved', required
    - `summary` string, nullable, required
    - `title` string, required
    - `updatedAt` string, required
    - `version` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 breaking, 1 warning, 12 info
  - the `data/updatedAt` response's property format changed from `date-time` to no format for status `201`
  - added the new `website-audit` enum value to the `data/source` response property for the response status `201`
  - added `subschema #1, subschema #2` to the `data/githubIssue` response property `anyOf` list for the response status `201`
  - added `subschema #1, subschema #2` to the `data/priority` response property `anyOf` list for the response status `201`
  - …10 more
- **2026-09-08** `66c8f6ac2730`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/inbox/:itemId/github-issue/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)