# POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve

**Resource:** [security-advisories](../resources/security-advisories.md)
**Request a CVE for a repository security advisory**
**Operation ID:** `security-advisories/create-repository-advisory-cve-request`

If you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see "[Requesting a CVE identification number](https://docs.github.com/code-security/security-advisories/repository-security-advisories/publishing-a-repository-security-advisory#requesting-a-cve-identification-number-optional)."

You may request a CVE for public repositories, but cannot do so for private repositories.

In order to request a CVE for a repository security advisory, the authenticated user must be a security manager or administrator of that repository.

OAuth app tokens and personal access tokens (classic) need the `repo` or `repository_advisories:write` scope to use this endpoint.

## Responses

| Status | Description |
|--------|-------------|
| 202 | (reference) |
| 400 | (reference) |
| 403 | (reference) |
| 404 | (reference) |
| 422 | (reference) |

