GitHub announced a public preview of AI Scan APIs on September 10, giving Advanced Security customers a programmatic way to manage AI-powered security scanning across repositories at both organizational and individual repository levels. The new APIs allow teams to enable or disable AI-powered security detection without manually configuring each repository through the user interface, making it easier to roll out the feature selectively across an organization.

What Are GitHub AI Scan APIs and How Do They Work?

The AI Scan APIs operate at two levels: organization-wide settings and individual repository settings. Teams can read and change enablement through two endpoints: /orgs/{org}/code-scanning/ai-scan for organization-level controls and /repos/{owner}/{repo}/code-scanning/ai-scan for repository-specific settings. This hierarchical structure means that an organization can set a baseline policy, and individual repositories cannot override a disabled organization-level setting, ensuring consistent security governance across teams.

The scanner works alongside CodeQL, GitHub's existing code analysis tool, to supplement security coverage. When the AI scanner finds potential issues, those findings appear directly on pull requests rather than as backlog alerts in the repository. However, the findings are advisory in nature; they do not block merges and cannot yet enforce merge requirements through rulesets. This means teams can review AI-flagged issues without disrupting their development workflow.

Who Can Use This Feature and What Are the Requirements?

The API preview is currently available only on github.com for GitHub Advanced Security customers; GitHub Enterprise Server is excluded from this initial release. To use the feature, teams must have both Advanced Security and Copilot licenses, and usage consumes AI credits from their Copilot allocation. Additional prerequisites include enterprise permission, organization opt-in, and CodeQL default setup enabled.

The limitation to Advanced Security customers reflects GitHub's positioning of AI scanning as a premium capability. Organizations considering adoption should verify they have the necessary licensing in place before planning a rollout.

How to Pilot AI Scan APIs Safely in Your Organization

• Start with a small test set: Begin by enabling AI scanning on a handful of repositories rather than rolling out organization-wide immediately. This allows your team to assess detection quality and false positive rates before broader adoption.
• Test policy precedence carefully: Verify that disabling scans at the organization level actually prevents a repository setting from re-enabling them. Document both settings when investigating missing results to ensure the hierarchy works as expected.
• Separate configuration from effectiveness: Use controlled pull requests with known security issues and safe counterparts to assess which findings are useful and which are false positives. A successful settings update alone does not prove detection quality.
• Track usage and impact separately: Monitor AI findings, review effort, and credit consumption independently during the pilot phase. This data helps your team determine whether the added security signal justifies broader use across the organization.
• Retain existing security checks: Keep release gates explicit by maintaining existing security and regression checks alongside the AI scanner. Do not replace your current processes until you have confidence in the new tool.

What Limitations Should Teams Know About?

The AI Scan feature comes with several important constraints that teams should understand before deployment. Full repository scans are unsupported; the scanner only analyzes code changes in pull requests. False positives are possible, which is why the advisory nature of findings and the pilot approach are important. The findings cannot yet be used to enforce merge requirements through GitHub's ruleset system, meaning teams cannot make AI-flagged issues mandatory blockers for code merging.

These limitations suggest the feature is still maturing. Teams should view this as a supplementary security tool rather than a replacement for existing code review processes or automated security gates. The public preview status means GitHub is actively gathering feedback and may expand capabilities in future releases.

Why Does This Matter for Development Teams?

The API-driven approach addresses a real operational challenge: managing AI-powered tools across dozens or hundreds of repositories. Previously, teams would need to configure each repository individually through the GitHub interface, a tedious and error-prone process. By exposing these controls through APIs, GitHub enables infrastructure teams and platform engineers to automate rollouts, enforce consistent policies, and integrate AI scanning into their existing repository onboarding workflows.

This is particularly valuable for large organizations with strict security governance requirements. A central team can now define organization-level policies that apply automatically to new repositories, reducing the burden on individual teams while maintaining security standards. The hierarchical permission model also prevents accidental misconfiguration at the repository level.

The feature remains in public preview as of September 11, 2026, meaning GitHub is still refining the APIs based on customer feedback. Teams interested in testing the feature should plan pilots carefully, document their findings, and provide feedback to GitHub to help shape the final product.