GitHub adds REST endpoints to turn AI Scan for pull requests on or off across an organisation

GitHub announced a public preview of REST endpoints for code scanning's AI Scan feature on pull requests. The changelog says teams can now read and update the enablement state at two levels: /orgs/{org}/code-scanning/ai-scan for organisations and /repos/{owner}/{repo}/code-scanning/ai-scan for individual repositories, without going through the settings screens one repository at a time.

What the endpoints do

Two GET and PUT surfaces are available in the preview. The organisation-level endpoint reads and sets whether AI Scan for pull requests is enabled across the org, and the repository endpoint does the same for a single repository. GitHub says the organisation setting acts as a global control, and a repository setting can raise or narrow the scope inside that global default but cannot re-enable AI Scan on a repository where the organisation has turned it off.

That structure matches how the rest of GitHub's code scanning settings work: an admin sets a default at the top of the org, and repository owners get a bounded amount of local choice. The change here is that the same policy is now scriptable.

Availability and pricing

The preview is available on github.com only, for existing GitHub Advanced Security customers. GitHub Enterprise Server is not supported yet. The changelog does not name a target date for general availability, and does not describe any pricing change: teams that already pay for Advanced Security get the endpoints, and teams that do not are not affected.

Because it is a public preview, the response shape and endpoint paths are still subject to change before GA, so a Terraform module or a wrapper script built against the preview URL should expect to move once the paths lock in.

Where the preview lands in a real rollout

Rolling AI Scan out across a large organisation has been a two-step problem so far: decide the policy, then click through each repository to apply it. The endpoints turn the second step into a job that runs against the GitHub REST API, which is where most Advanced Security tenants already manage their code scanning defaults, secret scanning policy, and Dependabot configuration. That is the shape of change: no new capability at the scanning layer, but the policy is finally sittable next to the org's existing security scripts.

For a company that has been holding AI Scan back because the policy story was hand-managed, this is the piece that lets it turn on for every repository in the org in one commit, with per-repository exceptions written as data rather than as UI clicks. For a company that already turned it on everywhere, the same endpoints are how they audit that the setting is still what they think it is, without opening 400 repository settings screens by hand.

The bounded preview scope is worth reading in the changelog. GHAS-only, github.com-only, and PUT requests on the repository endpoint cannot override an org disable. If a team's rollout plan reads "everywhere except one repo", the org has to be enabled first, then that one repo turned off, in that order.

Source

AI Scan for pull request APIs in public preview on the GitHub Changelog.