GitHub AI Scan for Pull Requests Now Has a REST API

GitHub has added REST API endpoints that let teams manage AI Scan for pull requests programmatically, without touching the GitHub UI for each repository. The public preview, announced on September 10 2026, covers both organization-wide and per-repository settings. Access is limited to GitHub Advanced Security customers on github.com; GitHub Enterprise Server is not yet supported.

What happened

Detail	Value
Announcement date	September 10, 2026
Feature status	Public preview
Org-level endpoint	/orgs/{org}/code-scanning/ai-scan
Repo-level endpoint	/repos/{owner}/{repo}/code-scanning/ai-scan
Required plan	GitHub Advanced Security
Enterprise Server support	Not available

GitHub code scanning already offers AI-powered security detections when developers open pull requests. Until now, turning that feature on or off meant clicking through settings in the GitHub UI for each repository. The new API endpoints let you read and update that state in code, making bulk rollouts and automation practical for the first time.

The two endpoints cover different scopes. The organization endpoint controls whether pull request AI scans can run at all across the org. The repository endpoint lets you toggle individual repos, but only if the org-level setting is enabled. An org-wide disabled state cannot be overridden at the repository level.

Why it matters

For teams managing dozens or hundreds of repositories, manual UI configuration does not scale. A REST API means you can script a phased rollout: enable AI Scan for a pilot group of repos first, verify results, then expand. You can also wire this into existing infrastructure-as-code pipelines or workflow automation tools that already manage your GitHub org settings.

The hierarchy between org and repo settings is worth paying attention to. If your security team disables AI Scan at the org level, no individual repository owner can switch it back on. That is useful for enforcement, but it also means a misconfigured org setting can silently block scanning across the board.

Our take

This is a straightforward, useful release. API-first control over security features is what mature DevSecOps looks like, and GitHub is catching up to where teams already expect to be. The org-overrides-repo hierarchy is the right call for security tooling, even if it will catch someone off guard eventually.

The GitHub Enterprise Server exclusion is the real limiter here. A lot of regulated industries and large enterprises run on-premise GHES specifically for compliance reasons. Those teams, arguably the ones who need programmatic security config the most, will have to wait. If you are evaluating AI-assisted security tooling for your development workflow, factor in whether your GitHub deployment type is supported before planning around this feature.

Also worth noting: this is a public preview. The API shape could change before general availability. Pin your integrations loosely and watch the GitHub changelog before shipping anything production-critical against these endpoints. You can follow our AI and dev tools coverage for updates as this moves toward GA.

What to do about it

1. Confirm your GitHub plan includes Advanced Security before testing the endpoints.
2. Check your org-level AI Scan status with a GET request to /orgs/{org}/code-scanning/ai-scan.
3. Enable AI Scan for a small set of pilot repositories using the repo-level endpoint before a broader rollout.
4. Document the org-level setting in your infrastructure-as-code so future changes are tracked and auditable.
5. Leave feedback in the GitHub Community discussion to influence the GA release.

Source: GitHub Changelog