Configurations

Use the REST API to create and manage security configurations for your organization.

Note

Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.

Get code security configurations for an enterprise

GET /enterprises/{enterprise}/code-security/configurations

Lists all code security configurations available in an enterprise.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations

Response schema (Status: 200):

Array of objects:

Create a code security configuration for an enterprise

POST /enterprises/{enterprise}/code-security/configurations

Creates a code security configuration in an enterprise.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for a code security configuration

Request:

curl -L \
  -X POST \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations \
  -d '{
  "name": "High rish settings",
  "description": "This is a code security configuration for octo-enterprise",
  "advanced_security": "enabled",
  "dependabot_alerts": "enabled",
  "dependabot_security_updates": "not_set",
  "secret_scanning": "enabled"
}'

Response schema (Status: 201):

Get default code security configurations for an enterprise

GET /enterprises/{enterprise}/code-security/configurations/defaults

Lists the default code security configurations for an enterprise.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/defaults

Response schema (Status: 200):

Array of objects:

Retrieve a code security configuration of an enterprise

GET /enterprises/{enterprise}/code-security/configurations/{configuration_id}

Gets a code security configuration available in an enterprise.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID

Response schema (Status: 200):

Same response schema as Create a code security configuration for an enterprise.

Update a custom code security configuration for an enterprise

PATCH /enterprises/{enterprise}/code-security/configurations/{configuration_id}

Updates a code security configuration in an enterprise.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for updating a code security configuration

Request:

curl -L \
  -X PATCH \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID \
  -d '{
  "name": "octo-enterprise recommended settings v2",
  "secret_scanning": "disabled",
  "code_scanning_default_setup": "enabled"
}'

Response schema (Status: 200):

Same response schema as Create a code security configuration for an enterprise.

Delete a code security configuration for an enterprise

DELETE /enterprises/{enterprise}/code-security/configurations/{configuration_id}

Deletes a code security configuration from an enterprise.
Repositories attached to the configuration will retain their settings but will no longer be associated with
the configuration.
The authenticated user must be an administrator for the enterprise to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X DELETE \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID

Response schema (Status: 204):

Attach an enterprise configuration to repositories

POST /enterprises/{enterprise}/code-security/configurations/{configuration_id}/attach

Attaches an enterprise code security configuration to repositories. If the repositories specified are already attached to a configuration, they will be re-attached to the provided configuration.
If insufficient GHAS licenses are available to attach the configuration to a repository, only free features will be enabled.
The authenticated user must be an administrator for the enterprise to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for attaching a configuration to some repositories

Request:

curl -L \
  -X POST \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID/attach \
  -d '{
  "scope": "all"
}'

Response schema (Status: 202):

object

Set a code security configuration as a default for an enterprise

PUT /enterprises/{enterprise}/code-security/configurations/{configuration_id}/defaults

Sets a code security configuration as a default to be applied to new repositories in your enterprise.
This configuration will be applied by default to the matching repository type when created, but only for organizations within the enterprise that do not already have a default code security configuration set.
The authenticated user must be an administrator for the enterprise to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Set this configuration to be enabled by default on all new repositories.

Request:

curl -L \
  -X PUT \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID/defaults \
  -d '{
  "default_for_new_repos": "all"
}'

Response schema (Status: 200):

Get repositories associated with an enterprise code security configuration

GET /enterprises/{enterprise}/code-security/configurations/{configuration_id}/repositories

Lists the repositories associated with an enterprise code security configuration in an organization.
The authenticated user must be an administrator of the enterprise in order to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/enterprises/ENTERPRISE/code-security/configurations/CONFIGURATION_ID/repositories

Response schema (Status: 200):

Array of objects:

Get code security configurations for an organization

GET /orgs/{org}/code-security/configurations

Lists all code security configurations available in an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/code-security/configurations

Response schema (Status: 200):

Same response schema as Get code security configurations for an enterprise.

Create a code security configuration

POST /orgs/{org}/code-security/configurations

Creates a code security configuration in an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the write:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for a code security configuration

Request:

curl -L \
  -X POST \
  https://api.github.com/orgs/ORG/code-security/configurations \
  -d '{
  "name": "octo-org recommended settings",
  "description": "This is a code security configuration for octo-org",
  "advanced_security": "enabled",
  "dependabot_alerts": "enabled",
  "dependabot_security_updates": "not_set",
  "secret_scanning": "enabled"
}'

Response schema (Status: 201):

Same response schema as Create a code security configuration for an enterprise.

Get default code security configurations

GET /orgs/{org}/code-security/configurations/defaults

Lists the default code security configurations for an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/code-security/configurations/defaults

Response schema (Status: 200):

Same response schema as Get default code security configurations for an enterprise.

Detach configurations from repositories

DELETE /orgs/{org}/code-security/configurations/detach

Detach code security configuration(s) from a set of repositories.
Repositories will retain their settings but will no longer be associated with the configuration.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
Repositories with active enterprise-enforced attachments are skipped unless the authenticated user can manage the enterprise's code security settings; the rest are detached. Inactive enterprise-enforced attachments, such as failed attachments, are detached. The request still returns 204 if every repository is skipped.
OAuth app tokens and classic PATs require the write:org scope. Managing enterprise-enforced configurations also requires admin:enterprise and is not supported by fine-grained PATs or GitHub App access tokens.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for detaching repositories from configurations.

Request:

curl -L \
  -X DELETE \
  https://api.github.com/orgs/ORG/code-security/configurations/detach \
  -d '{
  "selected_repository_ids": [
    32,
    91
  ]
}'

Response schema (Status: 204):

Get a code security configuration

GET /orgs/{org}/code-security/configurations/{configuration_id}

Gets a code security configuration available in an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the write:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID

Response schema (Status: 200):

Same response schema as Create a code security configuration for an enterprise.

Update a code security configuration

PATCH /orgs/{org}/code-security/configurations/{configuration_id}

Updates a code security configuration in an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the write:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for updating a code security configuration

Request:

curl -L \
  -X PATCH \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID \
  -d '{
  "name": "octo-org recommended settings v2",
  "secret_scanning": "disabled",
  "code_scanning_default_setup": "enabled"
}'

Response schema (Status: 200):

Same response schema as Create a code security configuration for an enterprise.

Delete a code security configuration

DELETE /orgs/{org}/code-security/configurations/{configuration_id}

Deletes the desired code security configuration from an organization.
Repositories attached to the configuration will retain their settings but will no longer be associated with
the configuration.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the write:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X DELETE \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID

Response schema (Status: 204):

Attach a configuration to repositories

POST /orgs/{org}/code-security/configurations/{configuration_id}/attach

Attach a code security configuration to a set of repositories. If the repositories specified are already attached to a configuration, they will be re-attached to the provided configuration.
If insufficient GHAS licenses are available to attach the configuration to a repository, only free features will be enabled.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
Directly applying an enterprise-enforced configuration also requires permission to manage the enterprise's code security settings. Without it, the request returns 403 and no repositories change.
When applying a different configuration, repositories with active enterprise-enforced attachments are skipped unless the authenticated user can manage the enterprise's code security settings; the remaining repositories are updated. The request still returns 202 if every repository is skipped.
OAuth app tokens and classic PATs require the write:org scope. Directly applying an enterprise-enforced configuration also requires admin:enterprise and is not supported by fine-grained PATs or GitHub App access tokens.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example for attaching a configuration to some repositories

Request:

curl -L \
  -X POST \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID/attach \
  -d '{
  "scope": "selected",
  "selected_repository_ids": [
    32,
    91
  ]
}'

Response schema (Status: 202):

Same response schema as Attach an enterprise configuration to repositories.

Set a code security configuration as a default for an organization

PUT /orgs/{org}/code-security/configurations/{configuration_id}/defaults

Sets a code security configuration as a default to be applied to new repositories in your organization.
This configuration will be applied to the matching repository type (all, none, public, private and internal) by default when they are created.
The authenticated user must be an administrator or security manager for the organization to use this endpoint. Setting an enterprise-enforced configuration as the default also requires permission to manage the enterprise's code security settings.
A default set with this endpoint is an organization default, even if the configuration is owned or enforced by the enterprise. An enterprise-enforced configuration set as an enterprise-level default for the same repository visibility takes precedence.
OAuth app tokens and classic PATs require the write:org scope; setting an enterprise-enforced configuration as the default also requires admin:enterprise. Fine-grained PATs and GitHub App access tokens cannot perform that action.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Set this configuration to be enabled by default on all new repositories.

Request:

curl -L \
  -X PUT \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID/defaults \
  -d '{
  "default_for_new_repos": "all"
}'

Response schema (Status: 200):

Same response schema as Set a code security configuration as a default for an enterprise.

Get repositories associated with a code security configuration

GET /orgs/{org}/code-security/configurations/{configuration_id}/repositories

Lists the repositories associated with a code security configuration in an organization.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the read:org scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/code-security/configurations/CONFIGURATION_ID/repositories

Response schema (Status: 200):

Same response schema as Get repositories associated with an enterprise code security configuration.

Get the code security configuration associated with a repository

GET /repos/{owner}/{repo}/code-security-configuration

Get the code security configuration that manages a repository's code security settings.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/code-security-configuration

Response schema (Status: 200):