{
  "schema_version": "1.7.0",
  "id": "x_SHAPI-github-workflow-dispatch-204-to-200",
  "modified": "2026-10-31T01:20:28Z",
  "published": "2025-12-19T00:00:00Z",
  "summary": "workflow_dispatch returns 200 with a body instead of 204",
  "details": "POST .../actions/workflows/{workflow_id}/dispatches started answering 200 OK with a JSON body (workflow run id) instead of 204 No Content. The OpenAPI schema and docs still said 204, and there was no changelog, version, or preview header. Clients that require exactly 204 treat a successful dispatch as a failure. GitHub later (2026-02-19) documented 200 as the response when return_run_details is set, and GitHub CLI v2.87.0+ sets it by default.\n\nTreat both 200 and 204 as success (any 2xx). If you want the run id, send return_run_details: true and read it from the 200 body.",
  "affected": [
    {
      "ecosystem_specific": {
        "provider": "github",
        "endpoint": {
          "method": "POST",
          "path": "/repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches"
        },
        "change_class": "status-code",
        "trigger": {
          "statusCodes": [
            204
          ],
          "newStatusCodes": [
            200
          ]
        },
        "effective_date": "2025-12-19",
        "recipe": "status-code-accept-set"
      }
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://stategraph.com/blog/github-broke-the-contract"
    },
    {
      "type": "WEB",
      "url": "https://github.blog/changelog/2026-02-19-workflow-dispatch-api-now-returns-run-ids"
    }
  ],
  "database_specific": {
    "severity": "critical",
    "status": "verified",
    "url": "https://shapi.dev/osv/github-workflow-dispatch-204-to-200.json"
  }
}