# Re-run dependency review

> Run the Dependency review check again on an open pull request's head, with the advisories known now: its status is set again and its one comment on the pull request is changed in place (or added, when it has dependency changes to show and none is there yet).

<div class="g1t-endpoint"><span class="g1t-method" data-method="post">POST</span><code>/repos/{owner}/{name}/pulls/{number}/dependency-review/rerun</code></div>

Returns the review. g1t reviews a pull request by itself when it opens and when its head moves, carrying the result over when the head's lockfile changes are the ones reviewed before. Takes the Write role. Needs the g1t plan on a private repository.

The pull request's one dependency review comment is changed in place; nothing new is posted when the review says the same.

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`security`](/reference/mcp/#security) with `action` `rerun_dependency_review`, and the same inputs
- **Scope:** An access token needs [`security:write`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `owner` | string | Yes | The workspace that owns the repository. |
| `name` | string | Yes | The repository's name. |
| `number` | integer | Yes | The pull request's number. |

## Example request

```sh
curl -X POST https://api.g1t.sh/repos/flagon-io/hello/pulls/12/dependency-review/rerun \
  -H "Authorization: Bearer $G1T_TOKEN"
```

## Example response

A successful request answers `200` with:

```json
{
  "base": "4b1d7c0e9a2f6e3d8c5b0a7f4e1d2c3b4a5f6e7d",
  "head": "9f2c4e1a7b3d5f60812a4c6e8b0d2f4a6c8e0b13",
  "changes": [
    {
      "change_type": "added",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.21",
      "vulnerabilities": [],
      "denied_license": false,
      "failing": false
    },
    {
      "change_type": "removed",
      "manifest": "package-lock.json",
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.20",
      "relationship": "direct",
      "development": false,
      "license": "MIT",
      "purl": "pkg:npm/lodash@4.17.20",
      "vulnerabilities": [],
      "denied_license": false,
      "failing": false
    }
  ],
  "passed": true,
  "headline": "2 dependency changes, none vulnerable",
  "fail_on": "high",
  "deny_licenses": []
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change, or a token without the scope it needs. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 409 | `conflict` | The request conflicts with the current state. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |