Configurations - GitHub Enterprise Server 3.21 Docs

Get code security configurations for an enterprise

Lists all code security configurations available in an enterprise.

The authenticated user must be an administrator of the enterprise in order to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Note

The enablement status will only be returned for installed security products.

Fine-grained access tokens for "Get code security configurations for an enterprise"

This endpoint does not work with GitHub App user access tokens, GitHub App installation access tokens, or fine-grained personal access tokens.

Parameters for "Get code security configurations for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Query parameters
Name, Type, Description
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Default: `30`
`before` string A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
`after` string A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."

HTTP response status codes for "Get code security configurations for an enterprise"

Status code	Description
`200`	OK
`403`	Forbidden
`404`	Resource not found

Code samples for "Get code security configurations for an enterprise"

Request example

get/enterprises/{enterprise}/code-security/configurations

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  http(s)://HOSTNAME/api/v3/enterprises/ENTERPRISE/code-security/configurations

Response

Status: 200

[
  {
    "id": 1326,
    "target_type": "enterprise",
    "name": "High risk settings",
    "description": "This is a code security configuration for octo-enterprise high risk repositories",
    "advanced_security": "enabled",
    "dependency_graph": "enabled",
    "dependabot_alerts": "enabled",
    "dependabot_security_updates": "enabled",
    "code_scanning_default_setup": "enabled",
    "code_scanning_default_setup_options": {
      "runner_type": "not_set",
      "runner_label": null
    },
    "secret_scanning": "enabled",
    "secret_scanning_push_protection": "enabled",
    "secret_scanning_validity_checks": "disabled",
    "enforcement": "enforced",
    "url": "https://HOSTNAME/enterprises/octo-enterprise/code-security/configurations/1326",
    "html_url": "https://github.com/enterprises/octo-enterprise/settings/security_analysis/configurations/1326/edit",
    "created_at": "2024-05-10T00:00:00Z",
    "updated_at": "2024-05-10T00:00:00Z"
  },
  {
    "id": 1327,
    "target_type": "enterprise",
    "name": "Low risk settings",
    "description": "This is a code security configuration for octo-enterprise low risk repositories",
    "advanced_security": "enabled",
    "dependency_graph": "enabled",
    "dependabot_alerts": "enabled",
    "dependabot_security_updates": "enabled",
    "code_scanning_default_setup": "enabled",
    "code_scanning_default_setup_options": {
      "runner_type": "not_set",
      "runner_label": null
    },
    "secret_scanning": "enabled",
    "secret_scanning_push_protection": "enabled",
    "secret_scanning_validity_checks": "disabled",
    "enforcement": "unenforced",
    "url": "https://HOSTNAME/enterprises/octo-enterprise/code-security/configurations/1327",
    "html_url": "https://github.com/enterprises/octo-enterprise/settings/security_analysis/configurations/1327/edit",
    "created_at": "2024-05-10T00:00:00Z",
    "updated_at": "2024-05-10T00:00:00Z"
  }
]

Create a code security configuration for an enterprise

Creates a code security configuration in an enterprise.

The authenticated user must be an administrator of the enterprise in order to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Note

Only installed security products may be specified in the request body. Specifying an uninstalled security product will result in a validation error.

Fine-grained access tokens for "Create a code security configuration for an enterprise"

This endpoint does not work with GitHub App user access tokens, GitHub App installation access tokens, or fine-grained personal access tokens.

Parameters for "Create a code security configuration for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Name, Type, Description

name string Required

The name of the code security configuration. Must be unique within the enterprise.

description string Required

A description of the code security configuration

advanced_security string

The enablement status of GitHub Advanced Security features. enabled will enable both Code Security and Secret Protection features.

Warning

code_security and secret_protection are deprecated values for this field. Prefer the individual code_security and secret_protection fields to set the status of these features.

Default: disabled

Can be one of: enabled, disabled, code_security, secret_protection

code_security string

The enablement status of GitHub Code Security features.

Can be one of: enabled, disabled, not_set

dependency_graph string

The enablement status of Dependency Graph. Dependency Graph is not configurable in GitHub Enterprise Server.

Default: enabled

Can be one of: enabled, disabled, not_set

dependabot_alerts string

The enablement status of Dependabot alerts

Default: disabled

Can be one of: enabled, disabled, not_set

dependabot_security_updates string

The enablement status of Dependabot security updates

Default: disabled

Can be one of: enabled, disabled, not_set

code_scanning_options object or null

Security Configuration feature options for code scanning

Properties of code_scanning_options

Name, Type, Description
`allow_advanced` boolean or null Whether to allow repos which use advanced setup

code_scanning_default_setup string

The enablement status of code scanning default setup

Default: disabled

Can be one of: enabled, disabled, not_set

code_scanning_default_setup_options object or null

Feature options for code scanning default setup

Properties of code_scanning_default_setup_options

Name, Type, Description
`runner_type` string Whether to use labeled runners or standard GitHub runners. Can be one of: `standard`, `labeled`, `not_set`
`runner_label` string or null The label of the runner to use for code scanning default setup when runner_type is 'labeled'.

code_scanning_delegated_alert_dismissal string

The enablement status of code scanning delegated alert dismissal

Default: disabled

Can be one of: enabled, disabled, not_set

secret_protection string

The enablement status of GitHub Secret Protection features.

Can be one of: enabled, disabled, not_set

secret_scanning string

The enablement status of secret scanning

Default: disabled

Can be one of: enabled, disabled, not_set

secret_scanning_push_protection string

The enablement status of secret scanning push protection

Default: disabled

Can be one of: enabled, disabled, not_set

secret_scanning_validity_checks string

The enablement status of secret scanning validity checks

Default: disabled

Can be one of: enabled, disabled, not_set

secret_scanning_non_provider_patterns string

The enablement status of secret scanning non provider patterns

Default: disabled

Can be one of: enabled, disabled, not_set

secret_scanning_delegated_alert_dismissal string

The enablement status of secret scanning delegated alert dismissal

Default: disabled

Can be one of: enabled, disabled, not_set

private_vulnerability_reporting string

The enablement status of private vulnerability reporting

Default: disabled

Can be one of: enabled, disabled, not_set

enforcement string

The enforcement status for a security configuration

Default: enforced

Can be one of: enforced, unenforced

HTTP response status codes for "Create a code security configuration for an enterprise"

Status code	Description
`201`	Successfully created code security configuration
`400`	Bad Request
`403`	Forbidden
`404`	Resource not found

Code samples for "Create a code security configuration for an enterprise"

Request example

post/enterprises/{enterprise}/code-security/configurations

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  http(s)://HOSTNAME/api/v3/enterprises/ENTERPRISE/code-security/configurations \
  -d '{"name":"High rish settings","description":"This is a code security configuration for octo-enterprise","advanced_security":"enabled","dependabot_alerts":"enabled","dependabot_security_updates":"not_set","secret_scanning":"enabled"}'

Successfully created code security configuration

Status: 201

{
  "id": 1325,
  "target_type": "enterprise",
  "name": "High risk settings",
  "description": "This is a code security configuration for octo-enterprise",
  "advanced_security": "enabled",
  "dependency_graph": "enabled",
  "dependabot_alerts": "enabled",
  "dependabot_security_updates": "not_set",
  "code_scanning_default_setup": "disabled",
  "code_scanning_delegated_alert_dismissal": "disabled",
  "secret_scanning": "enabled",
  "secret_scanning_push_protection": "disabled",
  "secret_scanning_delegated_bypass": "disabled",
  "secret_scanning_validity_checks": "disabled",
  "secret_scanning_non_provider_patterns": "disabled",
  "enforcement": "enforced",
  "url": "https://HOSTNAME/enterprises/octo-enterprise/code-security/configurations/1325",
  "html_url": "https://github.com/enterprises/octo-enterprise/settings/security_analysis/configurations/1325/edit",
  "created_at": "2024-05-01T00:00:00Z",
  "updated_at": "2024-05-01T00:00:00Z"
}

Get default code security configurations for an enterprise

Lists the default code security configurations for an enterprise.

The authenticated user must be an administrator of the enterprise in order to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Fine-grained access tokens for "Get default code security configurations for an enterprise"

This endpoint does not work with GitHub App user access tokens, GitHub App installation access tokens, or fine-grained personal access tokens.