GitHub adds REST API for managing AI Scan across repositories

GitHub announced on November 13, 2026, that it added new REST API endpoints for managing AI Scan, the code scanning feature that flags issues such as prompt injection in AI generated code, giving organizations and repositories programmatic control over the setting, as described in the GitHub changelog post.

What's changing

• New GET and PATCH endpoints now exist at /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan.
• The repository_scan setting can be set to enabled or disabled through the API or through infrastructure as code.
• An org-level disable setting overrides a repository's individual opt-in, while an org-level enable setting allows repositories to opt out individually.
• The API works on public repositories, and on private or internal repositories that have GitHub Code Security or Advanced Security.
• Enterprise owners must first authorize AI Scan in their policy settings before the API can be used, and the feature is not supported on GitHub Enterprise Server.
• Manual scans triggered by users with write access consume GitHub Code Security AI credits, and requests blocked by policy return an HTTP 422 response.

What it means for builders

For security and platform teams, the new endpoints mean AI Scan can be governed at scale through automation instead of being toggled repository by repository. Setting a single org-level policy, or wiring the repository_scan setting into infrastructure as code, lets teams enforce or permit AI focused code scanning across many repositories at once, as GitHub continues building defenses against AI generated vulnerabilities and prompt injection.

Sources

• Manage AI Scan for repositories using the REST API (GitHub, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.