GitHub Adds REST APIs for AI Scan Pull Request Configuration

GitHub Enables Programmatic Control of AI Security Scanning

GitHub has released REST API endpoints that allow organizations to programmatically configure AI Scan for pull requests, eliminating the need to manually adjust settings through the web interface for each repository. The new endpoints operate at both organization and repository levels, giving teams granular control over where AI-powered security detections run.

According to GitHub's changelog, the public preview introduces two primary API endpoints: /orgs/{org}/code-scanning/ai-scan for organization-wide settings and /repos/{owner}/{repo}/code-scanning/ai-scan for individual repository configuration. Both endpoints support read and update operations, allowing administrators to check current status and modify enablement settings programmatically.

How the Configuration Hierarchy Works

The API implements a hierarchical permission model. Organization-level settings determine whether AI Scan for pull requests can operate across any repositories within that organization. Repository-level settings then provide granular control, allowing teams to enable or disable scanning for specific repositories.

Critically, repository settings cannot override an organization-level disabled state. If AI Scan is turned off at the organization level, individual repositories cannot independently enable the feature, ensuring centralized governance of security tooling.

Why It Matters

Programmatic configuration addresses a significant operational challenge for enterprises managing hundreds or thousands of repositories. Manual UI-based configuration doesn't scale, and this API release enables infrastructure-as-code approaches to security tooling deployment. Organizations can now integrate AI Scan enablement into their repository provisioning workflows, apply consistent security policies across development teams, and audit scanning coverage through automated scripts rather than manual reviews.

Availability and Requirements

The public preview is currently available on github.com exclusively for GitHub Advanced Security customers. GitHub Enterprise Server does not support this release. Organizations interested in testing the new endpoints can access documentation on AI Scan security detections through GitHub's official resources.

GitHub is soliciting feedback through its Community discussion forum, where users can share implementation experiences and suggest improvements before the feature reaches general availability.

These details were first reported in GitHub's official changelog.