GitHub’s AI Scan for pull requests is now controllable through REST APIs in public preview. The useful implementation question is not whether a team should “turn on AI security” everywhere. It is whether the enterprise, organization, repository, token, CodeQL setup and review process are ready for a preview feature whose findings are informational.
What the preview exposes
GitHub’s September 10 changelog describes organization- and repository-level controls. The documented repository paths are:
GET /repos/{owner}/{repo}/code-scanning/ai-scanto read the setting.PATCH /repos/{owner}/{repo}/code-scanning/ai-scanwith{"pr_scan":"enabled"}or{"pr_scan":"disabled"}to update it./orgs/{org}/code-scanning/ai-scanfor organization-level control, as named in the changelog.
The organization setting is the upper boundary: a repository setting cannot override an organization-level disablement. GitHub says the preview is on GitHub.com for GitHub Advanced Security customers; GitHub Enterprise Server is not supported for this release.
Read the setting before changing it
The following is a documentation-derived request example. It is illustrative; it was not executed against a GitHub account in this review.
curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer <YOUR-TOKEN>" -H "X-GitHub-Api-Version: 2026-03-10" https://api.github.com/repos/OWNER/REPO/code-scanning/ai-scanThe documented successful response is small:
{"pr_scan":"enabled"}Interpret that response as an enablement state, not as proof that every pull request has been scanned or that a finding is correct. Store the repository, commit or pull-request context and the response timestamp with your own change record.
Permissions are different for read and update
| Operation | Classic token guidance | Fine-grained permission | Important failure |
|---|---|---|---|
| Read repository state | security_events for private/public repositories, or public_repo for public-only use | Code scanning alerts: read | 403 when Advanced Security is not enabled |
| Update repository state | repo for private/public repositories, or public_repo for public-only use | Administration: write | 403 for an archived repository or missing Advanced Security; 422 for validation/spam |
The REST documentation also lists GitHub App user, installation and fine-grained personal access tokens for these endpoints. Choose the least-privilege token that fits the operating model. Do not give a read-only scanner an administration write permission merely because the same job may later need to enable a setting.
Prerequisites before a pilot
- Confirm the enterprise policy allows AI security detections, the organization is enabled, and the repository has CodeQL default setup where required by the documented feature announcement.
- Confirm GitHub Advanced Security entitlement and the GitHub.com boundary. A 403 is an entitlement or repository-state signal, not a reason to retry with a broader token.
- Read the current state, record the response, and select one non-critical repository. Keep the PATCH operation behind a human approval.
- Compare the informational AI findings with the existing code-scanning and code-owner process. Do not make the AI result a merge authority without a separate policy decision.
What this does not prove
AI Scan does not replace CodeQL, code owners, branch protection or human security review. The GitHub Community announcement says findings are informational and do not block merges. Keep a review record that distinguishes an AI detection, a human disposition and the merge decision.
Failure modes and rollback
Put the response code and the feature boundary in the pilot runbook before anyone receives a write token.
| Signal | What it can mean | Safe response |
|---|---|---|
| 403 | Advanced Security is unavailable, the repository is archived, the organisation has disabled the feature, or the token lacks the required permission. | Read the organisation and repository state, check entitlement and token scope, then stop. Do not widen the token as a blind retry. |
| 404 | The owner/repository path is wrong or the endpoint is not available for that repository context. | Verify the repository, GitHub.com boundary and feature eligibility; record the request URL and response. |
| 422 | The PATCH body is invalid or GitHub rejected the request as a validation or abuse condition. | Compare the body with the current REST documentation and ask an administrator to approve the corrected request. |
| Organisation disabled | A repository-level enablement cannot override the organisation boundary. | Escalate to the organisation owner and leave the repository unchanged. |
| GitHub Enterprise Server | The September preview is described for GitHub.com, not GHES. | Keep the preview out of the GHES rollout plan until GitHub documents support. |
Record a reversible pilot
- Choose one non-critical repository and write down its current AI Scan state, Advanced Security entitlement, CodeQL setup and organisation policy.
- Use a read-only token for the inventory request. Store the repository, commit or pull-request scope, response body and timestamp in the change record.
- Have the repository owner approve one PATCH request. Keep the previous state in the record so the setting can be restored without guessing.
- Run several representative pull requests and label findings as informational until a human reviewer confirms what the result means for the repository.
- Stop the pilot if the response, entitlement or finding semantics are inconsistent. Roll back the setting and retain the evidence rather than widening the rollout.
The existing Copilot governance checklist owns model, budget and review policy. The Copilot VS Code release guide owns feature-surface context. Link to those pages when the reader needs the adjacent decision; keep this page responsible for AI Scan API enablement.
FAQ: questions readers ask
- Does AI Scan replace human code review?
- No. The preview exposes a scan setting and findings; it does not make a finding an approval authority or replace repository review rules.
- Can a repository enable AI Scan if the organisation disables it?
- No. The organisation-level boundary takes precedence, so resolve the organisation policy first.
- Is this API available on GHES?
- The September announcement describes the public preview on GitHub.com and says GHES is unsupported for this release.
Source note: The request paths, scopes, permissions, response and status codes above come from GitHub’s current REST documentation; the preview and product boundary come from GitHub’s September 10 changelog. The curl and JSON blocks are illustrative documentation examples, not an executed account test.
For adjacent governance, see the Copilot model and review checklist and the Copilot release workflow guide.
Sources: GitHub Changelog GitHub REST code-scanning documentation
