Skip to content
forgit api docs

Get the code security configuration associated with a repository

GET
/repos/{owner}/{repo}/code-security-configuration

Get the code security configuration that manages a repository’s code security settings.

The authenticated user must be an administrator or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json

Code security configuration associated with a repository and attachment status

object
status

The attachment status of the code security configuration on the repository.

string
Allowed values: attached attaching detached removed enforced failed updating removed_by_enterprise
configuration

A code security configuration

object
id

The ID of the code security configuration

integer
name

The name of the code security configuration. Must be unique within the organization.

string
target_type

The type of the code security configuration.

string
Allowed values: global organization enterprise
description

A description of the code security configuration

string
nullable
advanced_security

The enablement status of GitHub Advanced Security

string
Allowed values: enabled disabled code_security secret_protection
dependency_graph

The enablement status of Dependency Graph

string
Allowed values: enabled disabled not_set
dependency_graph_autosubmit_action

The enablement status of Automatic dependency submission

string
Allowed values: enabled disabled not_set
dependency_graph_autosubmit_action_options

Feature options for Automatic dependency submission

object
labeled_runners

Whether to use runners labeled with ‘dependency-submission’ or standard GitHub runners.

boolean
dependabot_alerts

The enablement status of Dependabot alerts

string
Allowed values: enabled disabled not_set
dependabot_security_updates

The enablement status of Dependabot security updates

string
Allowed values: enabled disabled not_set
dependabot_delegated_alert_dismissal

The enablement status of Dependabot delegated alert dismissal

string
nullable
Allowed values: enabled disabled not_set
code_scanning_options

Feature options for code scanning

object
allow_advanced

Whether to allow repos which use advanced setup

boolean
nullable
code_scanning_default_setup

The enablement status of code scanning default setup

string
Allowed values: enabled disabled not_set
code_scanning_default_setup_options

Feature options for code scanning default setup

object
runner_type

Whether to use labeled runners or standard GitHub runners.

string
nullable
Allowed values: standard labeled not_set
runner_label

The label of the runner to use for code scanning when runner_type is ‘labeled’.

string
nullable
code_scanning_delegated_alert_dismissal

The enablement status of code scanning delegated alert dismissal

string
Allowed values: enabled disabled not_set
secret_scanning

The enablement status of secret scanning

string
Allowed values: enabled disabled not_set
secret_scanning_push_protection

The enablement status of secret scanning push protection

string
Allowed values: enabled disabled not_set
secret_scanning_delegated_bypass

The enablement status of secret scanning delegated bypass

string
Allowed values: enabled disabled not_set
secret_scanning_delegated_bypass_options

Feature options for secret scanning delegated bypass

object
reviewers

The bypass reviewers for secret scanning delegated bypass

Array<object>
object
reviewer_id
required

The ID of the team or role selected as a bypass reviewer

integer
reviewer_type
required

The type of the bypass reviewer

string
Allowed values: TEAM ROLE
mode

The bypass mode for the reviewer

string
default: ALWAYS
Allowed values: ALWAYS EXEMPT
security_configuration_id

The ID of the security configuration associated with this bypass reviewer

integer
secret_scanning_validity_checks

The enablement status of secret scanning validity checks

string
Allowed values: enabled disabled not_set
secret_scanning_non_provider_patterns

The enablement status of secret scanning non-provider patterns

string
Allowed values: enabled disabled not_set
secret_scanning_generic_secrets

The enablement status of Copilot secret scanning

string
Allowed values: enabled disabled not_set
secret_scanning_delegated_alert_dismissal

The enablement status of secret scanning delegated alert dismissal

string
Allowed values: enabled disabled not_set
secret_scanning_extended_metadata

The enablement status of secret scanning extended metadata

string
Allowed values: enabled disabled not_set
private_vulnerability_reporting

The enablement status of private vulnerability reporting

string
Allowed values: enabled disabled not_set
enforcement

The enforcement status for a security configuration

string
Allowed values: enforced unenforced
url

The URL of the configuration

string format: uri
html_url

The URL of the configuration

string format: uri
created_at
string format: date-time
updated_at
string format: date-time
Examples
Example default 
{
  "status": "attached",
  "configuration": {
    "id": 1325,
    "target_type": "organization",
    "name": "octo-org recommended settings",
    "description": "This is a code security configuration for octo-org",
    "advanced_security": "enabled",
    "dependency_graph": "enabled",
    "dependency_graph_autosubmit_action": "enabled",
    "dependency_graph_autosubmit_action_options": {
      "labeled_runners": false
    },
    "dependabot_alerts": "enabled",
    "dependabot_security_updates": "not_set",
    "code_scanning_default_setup": "disabled",
    "code_scanning_delegated_alert_dismissal": "disabled",
    "secret_scanning": "enabled",
    "secret_scanning_push_protection": "disabled",
    "secret_scanning_delegated_bypass": "disabled",
    "secret_scanning_validity_checks": "disabled",
    "secret_scanning_non_provider_patterns": "disabled",
    "secret_scanning_generic_secrets": "disabled",
    "secret_scanning_delegated_alert_dismissal": "disabled",
    "private_vulnerability_reporting": "disabled",
    "enforcement": "enforced",
    "url": "https://api.github.com/orgs/octo-org/code-security/configurations/1325",
    "html_url": "https://github.com/organizations/octo-org/settings/security_products/configurations/edit/1325",
    "created_at": "2024-05-01T00:00:00Z",
    "updated_at": "2024-05-01T00:00:00Z"
  }
}

204

Section titled “ 204 ”

A header with no content is returned.

304

Section titled “ 304 ”

Not modified

403

Section titled “ 403 ”

Forbidden

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Section titled “ 404 ”

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}