Managing AI-powered code scanning across dozens of GitHub repositories just got easier. GitHub added a REST API setting for repository-wide AI Scan on November 13, 2026.
Instead of opening each repository’s settings, security teams can manage the rollout with automation. But enabling the feature does not launch a scan.
What changed?
GitHub’s public preview introduces repository_scan alongside the existing pr_scan option. Both can be read or updated through organization- and repository-level AI Scan endpoints.
GET /orgs/{org}/code-scanning/ai-scanandPATCH /orgs/{org}/code-scanning/ai-scanGET /repos/{owner}/{repo}/code-scanning/ai-scanandPATCH /repos/{owner}/{repo}/code-scanning/ai-scan
Set repository_scan to enabled or disabled using the documented API. See GitHub’s REST code-scanning documentation for authentication and request details rather than assuming a token has the necessary permissions.
Understand the policy hierarchy
- If the organization disables repository AI Scan, individual repositories cannot turn it on.
- If the organization enables it, repositories inherit that setting but can opt out.
- An enterprise policy can block enablement. GitHub returns HTTP
422when a requested change is disallowed. - If a combined update to
pr_scanandrepository_scanis blocked, neither change is applied.
Who can use it?
Organization owners and security managers manage organization-level settings; repository administrators can opt repositories out. The feature covers public organization-owned repositories and private or internal repositories with GitHub Code Security or GitHub Advanced Security. Enterprise owners must permit AI Scan through enterprise policy.
Important limitation: GitHub Enterprise Server is not supported. Enabling the setting also does not automatically scan your backlog: a user with write access must start a scan, and scans consume GitHub Code Security AI credits.
Practical takeaway
For large organizations, manage AI Scan policy alongside other repository configuration, then separately plan who will initiate scans and monitor credit consumption. Start with a small test organization before rolling out changes broadly.