Manage AI Scan for repositories using the REST API

GitHub added a `repository_scan` setting to its AI Scan enablement REST API endpoints in public preview, letting organization owners and security managers turn AI Scan for repositories on or off at the organization and repository levels via `GET` and `PATCH /orgs/{org}/code-scanning/ai-scan` and `/repos/{owner}/{repo}/code-scanning/ai-scan`. The setting mirrors the existing `pr_scan` property: organization settings are inherited by repositories, which can opt out individually, and requests to enable AI Scan return a `422` error when an enterprise policy disallows it. Enabling the setting does not start a scan — users with write access still run scans on demand, and each scan consumes GitHub Code Security AI credits; the feature is unsupported on GitHub Enterprise Server.

Manage AI Scan for repositories using the REST API You can now turn GitHub code scanning’s AI Scan for repositories on or off with the REST API at the organization and repository levels. This public preview adds a repository scan setting to the existing AI Scan enablement endpoints. You can roll out AI Scan for repositories with scripts and infrastructure as code instead of changing settings one organization or repository at a time. Manage AI Scan for repositories at scale manage-ai-scan-for-repositories-at-scale Set the repository scan property to enabled or disabled on the AI Scan enablement endpoints https://docs.github.com/rest/code-scanning/code-scanning update-the-ai-scan-setting-for-an-organization : - GET and PATCH /orgs/{org}/code-scanning/ai-scan - GET and PATCH /repos/{owner}/{repo}/code-scanning/ai-scan The setting works the same way as the existing pr scan setting for AI Scan for pull requests: - When an organization disables AI Scan for repositories, its repositories can’t enable it - When an organization enables it, its repositories inherit the setting and can opt out individually - When an enterprise policy doesn’t allow AI Scan, requests to enable it return a 422 error You can update pr scan and repository scan in the same request. If either change is blocked, the request returns a 422 error and neither setting changes. Turning on AI Scan for repositories doesn’t start a scan. Users with write access still run scans on demand, and each scan consumes GitHub Code Security AI credits. Who can use it who-can-use-it Organization owners and security managers can manage the organization setting. Repository administrators can opt individual repositories out. AI Scan for repositories is available for public repositories owned by organizations and for private or internal repositories with GitHub Code Security or GitHub Advanced Security. Enterprise owners must first allow AI Scan in the enterprise policy. GitHub Enterprise Server isn’t supported. To get started, see REST API endpoints for code scanning https://docs.github.com/rest/code-scanning/code-scanning and AI Scan for a repository’s backlog https://docs.github.com/code-security/concepts/code-scanning/ai-scan-for-repositories . Join the discussion in the GitHub Community https://github.com/orgs/community/discussions/210998 .