curl -X POST 'https://api.github.com/enterprises/example-enterprise/code-security/configurations' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "example-name"
}'

# POST /enterprises/{enterprise}/code-security/configurations (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Create a code security configuration for an enterprise

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X POST 'https://api.github.com/enterprises/example-enterprise/code-security/configurations' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "example-name"
}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| enterprise | path | string | Yes | The slug version of the enterprise name. |
| name | body | string | Yes | The name of the code security configuration. Must be unique within the enterp... |
| description | body | string | No | A description of the code security configuration |
| advanced_security | body | string | No | The enablement status of GitHub Advanced Security features. `enabled` will en... |
| code_security | body | string | No | The enablement status of GitHub Code Security features. |
| dependency_graph | body | string | No | The enablement status of Dependency Graph |
| dependency_graph_autosubmit_action | body | string | No | The enablement status of Automatic dependency submission |
| dependency_graph_autosubmit_action_options | body | object | No | Feature options for Automatic dependency submission |
Other params: dependabot_alerts, dependabot_security_updates, code_scanning_options, code_scanning_default_setup, code_scanning_default_setup_options, code_scanning_delegated_alert_dismissal, secret_protection, secret_scanning, secret_scanning_push_protection, secret_scanning_validity_checks, secret_scanning_non_provider_patterns, secret_scanning_generic_secrets, secret_scanning_delegated_alert_dismissal, secret_scanning_extended_metadata, private_vulnerability_reporting, enforcement

## Response example
{"id":0,"name":"string"}

---
Need an API key? Get one at https://github.com/settings/tokens

POST

POST /enterprises/{enterprise}/code-security/configurations — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Create a code security configuration for an enterprise

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 372 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X POST 'https://api.github.com/enterprises/example-enterprise/code-security/configurations' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{  "name": "example-name"}'

Parameters

Name	In	Type	Required	Description
enterprise	path	string	Yes	The slug version of the enterprise name.
name	body	string	Yes	The name of the code security configuration. Must be unique within the enterprise.
description	body	string	No	A description of the code security configuration
advanced_security	body	string	No	The enablement status of GitHub Advanced Security features. `enabled` will enable both Code Security and Secret Protection features. > [!WARNING] > `code_security` and `secret_protection` are deprecated values for this field. Prefer the individual `code_security` and `secret_protection` fields to set the status of these features.
code_security	body	string	No	The enablement status of GitHub Code Security features.
dependency_graph	body	string	No	The enablement status of Dependency Graph
dependency_graph_autosubmit_action	body	string	No	The enablement status of Automatic dependency submission
dependency_graph_autosubmit_action_options	body	object	No	Feature options for Automatic dependency submission
dependabot_alerts	body	string	No	The enablement status of Dependabot alerts
dependabot_security_updates	body	string	No	The enablement status of Dependabot security updates
code_scanning_options	body	object	No	Security Configuration feature options for code scanning
code_scanning_default_setup	body	string	No	The enablement status of code scanning default setup
code_scanning_default_setup_options	body	object	No	Feature options for code scanning default setup
code_scanning_delegated_alert_dismissal	body	string	No	The enablement status of code scanning delegated alert dismissal
secret_protection	body	string	No	The enablement status of GitHub Secret Protection features.
secret_scanning	body	string	No	The enablement status of secret scanning
secret_scanning_push_protection	body	string	No	The enablement status of secret scanning push protection
secret_scanning_validity_checks	body	string	No	The enablement status of secret scanning validity checks
secret_scanning_non_provider_patterns	body	string	No	The enablement status of secret scanning non provider patterns
secret_scanning_generic_secrets	body	string	No	The enablement status of Copilot secret scanning
secret_scanning_delegated_alert_dismissal	body	string	No	The enablement status of secret scanning delegated alert dismissal
secret_scanning_extended_metadata	body	string	No	The enablement status of secret scanning extended metadata
private_vulnerability_reporting	body	string	No	The enablement status of private vulnerability reporting
enforcement	body	string	No	The enforcement status for a security configuration

Response 200 OK

{
  "id": 0,
  "name": "string",
  "target_type": "global",
  "description": "string",
  "advanced_security": "enabled",
  "dependency_graph": "enabled",
  "dependency_graph_autosubmit_action": "enabled",
  "dependency_graph_autosubmit_action_options": {
    "labeled_runners": true
  },
  "dependabot_alerts": "enabled",
  "dependabot_security_updates": "enabled",
  "dependabot_delegated_alert_dismissal": "enabled",
  "code_scanning_options": {
    "allow_advanced": true
  },
  "code_scanning_default_setup": "enabled",
  "code_scanning_default_setup_options": {
    "runner_type": "standard",
    "runner_label": "string"
  },
  "code_scanning_delegated_alert_dismissal": "enabled",
  "secret_scanning": "enabled",
  "secret_scanning_push_protection": "enabled",
  "secret_scanning_delegated_bypass": "enabled",
  "secret_scanning_delegated_bypass_options": {
    "reviewers": [
      {
        "reviewer_id": 0,
        "reviewer_type": "TEAM",
        "mode": "ALWAYS",
        "security_configuration_id": 0
      }
    ]
  },
  "secret_scanning_validity_checks": "enabled",
  "secret_scanning_non_provider_patterns": "enabled",
  "secret_scanning_generic_secrets": "enabled",
  "secret_scanning_delegated_alert_dismissal": "enabled",
  "secret_scanning_extended_metadata": "enabled",
  "private_vulnerability_reporting": "enabled",
  "enforcement": "enforced",
  "url": "https://example.com",
  "html_url": "https://example.com",
  "created_at": "2026-09-03T00:00:00Z",
  "updated_at": "2026-09-03T00:00:00Z"
}

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.