You can now turn GitHub code scanning’s AI Scan for repositories on or off with the REST API at the organization and repository levels. This public preview adds a repository_scan setting to the existing AI Scan enablement endpoints. You can roll out AI Scan for repositories with scripts and infrastructure as code instead of changing settings one organization or repository at a time.

Manage AI Scan for repositories at scale

Set the repository_scan property to enabled or disabled on the AI Scan enablement endpoints:

  • GET and PATCH /orgs/{org}/code-scanning/ai-scan
  • GET and PATCH /repos/{owner}/{repo}/code-scanning/ai-scan

The setting works the same way as the existing pr_scan setting for AI Scan for pull requests:

  • When an organization disables AI Scan for repositories, its repositories can’t enable it
  • When an organization enables it, its repositories inherit the setting and can opt out individually
  • When an enterprise policy doesn’t allow AI Scan, requests to enable it return a 422 error

You can update pr_scan and repository_scan in the same request. If either change is blocked, the request returns a 422 error and neither setting changes.

Turning on AI Scan for repositories doesn’t start a scan. Users with write access still run scans on demand, and each scan consumes GitHub Code Security AI credits.

Who can use it

Organization owners and security managers can manage the organization setting. Repository administrators can opt individual repositories out. AI Scan for repositories is available for public repositories owned by organizations and for private or internal repositories with GitHub Code Security or GitHub Advanced Security. Enterprise owners must first allow AI Scan in the enterprise policy. GitHub Enterprise Server isn’t supported.

To get started, see REST API endpoints for code scanning and AI Scan for a repository’s backlog.

Join the discussion in the GitHub Community.