{"id":3018,"date":"2026-09-11T05:09:10","date_gmt":"2026-09-11T05:09:10","guid":{"rendered":"https:\/\/dmarketertayeeb.com\/blog\/github-ai-scan-pull-request-apis\/"},"modified":"2026-10-06T23:00:54","modified_gmt":"2026-10-06T23:00:54","slug":"github-ai-scan-pull-request-apis","status":"publish","type":"post","link":"https:\/\/dmarketertayeeb.com\/blog\/github-ai-scan-pull-request-apis\/","title":{"rendered":"GitHub AI Scan APIs: Endpoints, Permissions and a Safe Pull-Request Pilot"},"content":{"rendered":"\n

AI Scan\u2019s existing Security Overview Coverage view now includes pull-request status.<\/strong> UI: enabled<\/code>\/not enabled<\/code>; CSV: enabled<\/code>\/not-enabled<\/code>. Coverage shows effective repo state after policy\/settings; not-enabled rows may be ineligible, with no reason. See the October 6 changelog<\/a> and adoption guide<\/a>.<\/p>\n\n\n

What the preview exposes<\/h2>\n\n\n

The September 10 preview adds GET<\/code> and PATCH<\/code> controls at \/orgs\/{org}\/code-scanning\/ai-scan<\/code> and \/repos\/{owner}\/{repo}\/code-scanning\/ai-scan<\/code>. A repository cannot override an organization-level disabled setting. The preview is on GitHub.com for GitHub Advanced Security customers; GitHub Enterprise Server is unsupported for this release. See the API announcement<\/a>.<\/p>\n\n\n

Update older setup notes: on September 16, GitHub removed CodeQL default setup as an AI Scan prerequisite. The dated change<\/a> documents the correction.<\/p>\n\n\n

Code scanning and the effective AI Scan setting still matter; a waiting or failed CodeQL analysis does not stop AI Scan. Current AI Scan docs<\/a> describe its independent trigger.<\/p>\n\n\n

Use the existing Coverage view to audit AI Scan status<\/h2>\n\n\n

Organization: Security and quality \u2192 Coverage<\/strong>; enterprise: its Security and quality area. Org access requires repository write; enterprise access is for organization owners\/security managers. See the access guide<\/a>.<\/p>\n\n\n

    \n
  1. Save the view level, selected team or repository filters,<\/a> and export time so a later snapshot uses the same scope.<\/li>\n
  2. Click an enabled or not enabled count to filter repository rows, or use code-scanning-ai-scan-pr-scan:enabled<\/code> and code-scanning-ai-scan-pr-scan:not-enabled<\/code>. These AI Scan filters were added to Coverage.<\/a><\/li>\n
  3. Export the Coverage CSV and retain its Code Scanning AI Scan for pull requests<\/code> column. Its values are enabled<\/code> and not-enabled<\/code>. The changelog lists the new column.<\/a><\/li>\n
  4. Compare intended repositories. Not enabled may include ineligible repos without a reason; investigate before changing settings. See the adoption guide<\/a>.<\/li>\n<\/ol>\n\n\n

    For trend checks, compare like-scoped snapshots on the same reporting cadence.<\/p>\n\n\n

    Read and update the settings<\/h2>\n\n\n

    GET first. Org GET is stored state; enterprise policy applies. PATCH bodies below are illustrative, unexecuted. See REST docs<\/a>.<\/p>\n\n\n

    {\"pr_scan\":\"enabled\"}\n{\"pr_scan\":\"disabled\"}<\/code><\/pre>\n\n\n
    Permissions are different for read and update<\/h2>\n\n\n
    GitHub App user\/install tokens and fine-grained personal access tokens work; see operation scopes in REST permissions<\/a>.<\/p>\n\n\n\n
    \n\n
    Operation<\/th>Classic token scope<\/th>Fine-grained permission<\/th><\/tr><\/thead>\n
    Org GET<\/th>admin:org<\/code> or repo<\/code> (owner); write:org<\/code> (security manager)<\/td>Organization Administration: read<\/td><\/tr>\n
    Org PATCH<\/th>Same role scopes as GET<\/td>Organization Administration: write; policy allows AI Scan<\/td><\/tr>\n
    Repo GET<\/th>security_events<\/code> private\/public; public_repo<\/code> public only<\/td>Code scanning alerts: read<\/td><\/tr>\n
    Repo PATCH<\/th>repo<\/code> private\/public; public_repo<\/code> public only<\/td>Repository Administration: write<\/td><\/tr>\n<\/tbody>\n<\/table><\/div><\/figure>\n\n\n\n
    Prerequisites before a pilot<\/h2>\n\n\n
    AI Scan requires GitHub Advanced Security and GitHub Copilot licenses plus AI credits. It triggers on pull-request creation and new commits when code scanning and effective AI Scan are enabled and an eligible PR has qualifying changes in a supported language\/framework CodeQL does not cover. See AI Scan docs<\/a>.<\/p>\n\n\n
    AI Scan covers pull requests only; it does not run on fork or Dependabot pull requests. Language and framework support may change during preview. See current exclusions.<\/a><\/p>\n\n\n
    What this does not prove<\/h2>\n\n\n
    Enabled status proves configuration, not a scan or detection quality. Findings appear on pull requests, not backlog alerts; they are advisory, cannot enforce merge requirements, and may be false positives. Keep existing checks and human review. See the limitations.<\/a><\/p>\n\n\n
    Failure modes and rollback<\/h2>\n\n\n
    403: permission, Advanced Security, or archived repository; 404: missing; 422: invalid\/spam. See REST docs<\/a>.<\/p>\n\n\n
    Roll back: PATCH the prior pr_scan<\/code> value to the same route; retain approval and request history. See REST docs<\/a>.<\/p>\n\n\n
    Record a reversible pilot<\/h2>\n\n\n
      \n
    1. Choose one eligible,<\/a> non-critical repository. Save the Coverage export<\/a> with its date, team or repository filters, and organization scope.<\/li>\n
    2. GET<\/a> both levels; check policy,<\/a> licenses, credits,<\/a> eligibility.<\/a><\/li>\n
    3. Get owner<\/a> approval for one least-privilege PATCH;<\/a> record the prior value for rollback.<\/li>\n
    4. Review AI findings<\/a> with human checks; enabled status<\/a> proves configuration only.<\/li>\n<\/ol>\n\n\n
      For the adjacent governance decisions, use the Copilot model and budget review guide<\/a>. The Copilot VS Code release guide<\/a> covers the separate editor feature surface.<\/p>\n\n\n
      FAQ: questions readers ask<\/h2>\n\n\n
      Why could org GET and CSV status differ?<\/h3>\n\n\n
      Hypothetical, not observed:<\/strong> org GET may be enabled<\/code> while CSV is not-enabled<\/code>: stored org setting versus effective repo status. Check policy, repo setting\/opt-out, Code Scanning, and eligibility; don\u2019t auto-PATCH. See REST docs<\/a> and adoption guide<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
      Use GitHub AI Scan APIs safely: exact endpoints, token permissions, eligibility failures, response handling and a reversible pull-request pilot.<\/p>\n","protected":false},"author":1,"featured_media":3017,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[183,180,178],"tags":[393,319,396,426,315,422],"class_list":["post-3018","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-in-marketing","category-ai-news","category-artificial-intelligence","tag-ai-model-releases","tag-ai-workflows","tag-coding-agents","tag-content-governance","tag-developer-tools","tag-marketing-operations","has-featured-image"],"_links":{"self":[{"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/posts\/3018","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/comments?post=3018"}],"version-history":[{"count":2,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/posts\/3018\/revisions"}],"predecessor-version":[{"id":3222,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/posts\/3018\/revisions\/3222"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/media\/3017"}],"wp:attachment":[{"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/media?parent=3018"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/categories?post=3018"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmarketertayeeb.com\/blog\/wp-json\/wp\/v2\/tags?post=3018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}