XRAY: Exporting GitHub Repository Scan Reports from JFrog Xray Using REST APIs

Introduction 

JFrog Xray provides advanced security scanning capabilities for Git repositories integrated from GitHub, including:

```
Vulnerability scanning (CVEs)
```

SAST (Static Application Security Testing)

```
Secrets detection
```
```
Infrastructure-as-Code (IaC) scanning
```
```
Operational risk analysis
```
```
SBOM generation
```

Although scan data is available in the JFrog Xray UI, the current workflow for retrieving repository scan information is manual. Users must navigate through Xray → Scans List → Git Repositories. From there, each repository, branch, commit, or pull request must be individually opened to review scan results and export reports.

This article demonstrates the complete workflow for generating GitHub repository scan reports using JFrog Xray REST APIs.


Workflow Overview

The reporting workflow consists of the following steps:

```
List Git repositories scanned by Xray
```
```
Retrieve branches for a repository
```
```
Retrieve commits for a branch
```
```
Identify the desired commit hash
```
```
Export scan reports for the commit
```


Step 1: List Git Repositories Scanned by Xray

The first step is identifying repositories currently scanned by JFrog Xray.

API Endpoint:

GET /xray/api/v1/git/repositories

Example Request:

curl -u <username>:<password> -X GET "https://<jfrog-url>/xray/api/v1/git/repositories" | jq

Sample Response:

{
  "page": 1,
  "limit": 2000,
  "total_count": 76,
  "repositories": [
     {
      "id": 16,
      "url": "****",
      "name": "project-examples",
      "git_project": "****",
      "git_provider": "github",
      "last_scanned_date": "2026-02-10T05:31:13Z",
      "last_scanned_commit": "2b6e3ef80472576202b78cc14568dc5450dc4d3d",
      "scanned_branches": [
        "master"
      ]
    },
    }
…
…
…
  ]
}


Step 2: Retrieve Repository Branches

Once the repository ID is identified, retrieve the available scanned branches.

API Endpoint:

GET /xray/api/v1/git/repositories/{repository_id}/branches

Example Request:

curl -u <username>:<password> -X GET "https://<jfrog-url>/xray/api/v1/git/repositories/16/branches" | jq

Sample Response:

{
  "page": 1,
  "limit": 2000,
  "total_count": 1,
  "repository_id": 16,
  "repository_url": "****",
  "repository_name": "project-examples",
  "branches": [
    {
      "name": "master",
      "last_scanned_commit": "2b6e3ef80472576202b78cc14568dc5450dc4d3d",
      "last_scanned_date": "2026-02-10T05:31:13Z",
      "scanned_commits_count": 3
    }
  ]
}



Step 3: Retrieve Commit Scan Details

The commits API retrieves the commit history for a chosen branch.

API Endpoint:

GET /xray/api/v1/git/repositories/{repository_id}/commits?branch_name={name_of_the_branch}

Example Request:

curl -u <username>:<password> -X GET \
"https://<jfrog-url>/xray/api/v1/git/repositories/16/commits?branch_name=master" | jq

Sample Response:

{
  "page": 1,
  "limit": 2000,
  "total_count": 3,
  "repository_id": 16,
  "repository_url": "****",
  "repository_name": "project-examples",
  "branch_name": "master",
  "commits": [
    {
      "hash": "2b6e3ef80472576202b78cc14568dc5450dc4d3d",
      "author": "****",
      "scan_date": "2026-02-10T05:31:13Z",
      "commit_message": "Update frogbot-scan-and-fix.yml"
    },
    {
      "hash": "16fe34dd2010e5d5e530a0863644a46d61d250e3",
      "author": "****",
      "scan_date": "2026-02-10T05:29:49Z",
      "commit_message": "Update frogbot-scan-and-fix.yml"
    },
    {
      "hash": "d7abd7813e13a2bfd79c2bcbde4232edf0c915a0",
      "author": "****",
      "scan_date": "2025-06-16T04:31:41Z",
      "commit_message": "Merge pull request #4 from ****/****-frogbot-scan-and-fix-3\n\nCreate frogbot-scan-and-fix.yml"
    }
  ]
}



Step 4: Retrieve Scan Results

After identifying a specific Commit Hash, you can pull the raw JSON scan results, including CVEs, severities, etc.

API Endpoint:

GET xray/api/v1/git/repositories/{repository_id}/commits/{commit_hash}/scan-results?branch_name={name_of_the_branch}"

Example Request:

curl -u <username>:<password> -X GET \
"https://<jfrog-url>/xray/api/v1/git/repositories/16/commits/2b6e3ef80472576202b78cc14568dc5450dc4d3d/scan-results?branch_name=master"  > xray_scan_results.json

Sample Response:

{
  "repository_id": 16,
  "repository_url": "****",
  "repository_name": "project-examples",
  "branch_name": "master",
  "commit_hash": "2b6e3ef80472576202b78cc14568dc5450dc4d3d",
  "scan_results": {
    "cves": [
      {
        "id": "XRAY-940266",
        "severity": "High",
        "severity_source": "CVE List V5",
        "jfrog_severity": "Low",
        "summary": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.",
        "cve": {
          "id": "CVE-2025-61732",
          "cvss_v3": "8.6/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "cwes": [
            {
              "id": "CWE-94"
            }
          ]
        },
        "components": [
          {
            "id": "go://github.com/golang/go:v1.24.12",
            "type": "go",
            "name": "github.com/golang/go",
            "version": "v1.24.12",
            "fixed_versions": [
              "[1.24.13]",
              "[1.25.7]"
            ]
          }
        ],



Conclusion

The JFrog Xray REST APIs provide an efficient mechanism for exporting GitHub repository scan results without manually navigating the Xray UI.

Using these APIs, teams can:

```
Automate security reporting
```
```
Export detailed scan artifacts
```

Integrate reporting into DevSecOps workflows

This approach reduces operational overhead while improving visibility and reporting consistency across GitHub repositories scanned by JFrog Xray.