Manage AI Scan for repositories using the REST API

GitHub added a repository_scan setting to the code scanning AI Scan endpoints, so you can turn AI Scan for repositories on or off through the REST API at both the organization and repository level. It's a public preview.

The setting lives on the existing GET and PATCH endpoints at /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan. Set repository_scan to enabled or disabled, so you can roll it out from scripts or infrastructure as code instead of changing each organization or repository by hand. A request like {"pr_scan":"enabled","repository_scan":"enabled"} sent to the organization endpoint returns both values back.

It follows the same rules as the existing pr_scan setting. If an organization disables it, its repositories can't turn it on. If the organization enables it, repositories inherit that and can opt out one by one. If the enterprise policy doesn't allow AI Scan, enabling it returns a 422. You can change pr_scan and repository_scan in one request, but if either change is blocked, the request returns a 422 and neither setting changes.

Turning the setting on doesn't start a scan. Users with write access still run scans on demand, and each scan uses GitHub Code Security AI credits. Organization owners and security managers can manage the organization setting, and repository administrators can opt individual repositories out. It covers public repositories owned by organizations, plus private or internal repositories with GitHub Code Security or GitHub Advanced Security. Enterprise owners have to allow AI Scan in the enterprise policy first, and GitHub Enterprise Server isn't supported.