curl -X PATCH 'https://api.github.com/repos/example-owner/example-repo/code-scanning/default-setup' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

# PATCH /repos/{owner}/{repo}/code-scanning/default-setup (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Update a code scanning default setup configuration

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X PATCH 'https://api.github.com/repos/example-owner/example-repo/code-scanning/default-setup' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| state | body | string | No | The desired state of code scanning default setup. |
| runner_type | body | string | No | Runner type to be used. |
| runner_label | body | string | No | Runner label to be used if the runner type is labeled. |
| query_suite | body | string | No | CodeQL query suite to be used. |
| threat_model | body | string | No | Threat model to be used for code scanning analysis. Use `remote` to analyze o... |
| languages | body | string[] | No | CodeQL languages to be analyzed. |

## Response example
{}

---
Need an API key? Get one at https://github.com/settings/tokens

PATCH

PATCH /repos/{owner}/{repo}/code-scanning/default-setup — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Update a code scanning default setup configuration

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 357 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X PATCH 'https://api.github.com/repos/example-owner/example-repo/code-scanning/default-setup' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
state	body	string	No	The desired state of code scanning default setup.
runner_type	body	string	No	Runner type to be used.
runner_label	body	string	No	Runner label to be used if the runner type is labeled.
query_suite	body	string	No	CodeQL query suite to be used.
threat_model	body	string	No	Threat model to be used for code scanning analysis. Use `remote` to analyze only network sources and `remote_and_local` to include local sources like filesystem access, command-line arguments, database reads, environment variable and standard input.
languages	body	string[]	No	CodeQL languages to be analyzed.

Response 200 OK

{}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.