GitHub API (unofficial showcase)
POST/orgs/{org}/code-security/configurations/{configuration_id}/attach

Attach a configuration to repositories

Attach a code security configuration to a set of repositories. If the repositories specified are already attached to a configuration, they will be re-attached to the provided configuration.

If insufficient GHAS licenses are available to attach the configuration to a repository, only free features will be enabled.

The authenticated user must be an administrator or security manager for the organization to use this endpoint.

Directly applying an enterprise-enforced configuration also requires permission to manage the enterprise's code security settings. Without it, the request returns 403 and no repositories change.

When applying a different configuration, repositories with active enterprise-enforced attachments are skipped unless the authenticated user can manage the enterprise's code security settings; the remaining repositories are updated. The request still returns 202 if every repository is skipped.

OAuth app tokens and classic PATs require the write:org scope. Directly applying an enterprise-enforced configuration also requires admin:enterprise and is not supported by fine-grained PATs or GitHub App access tokens.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

2 parameters · 2 body fields
orgstringrequired
The organization name. The name is not case sensitive.
configuration_idintegerrequired
The unique identifier of the code security configuration.
scopestringrequired
The type of repositories to attach the configuration to. `selected` means the configuration will be attached to only the repositories specified by `selected_repository_ids`
Allowed:allall_without_configurationspublicprivate_or_internalselected
selected_repository_idsarray<integer>optional
An array of repository IDs to attach the configuration to. You can only provide a list of repository ids when the `scope` is set to `selected`.

6 status codes
202Accepted
400Bad Request
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
403Forbidden
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
409Conflict because security configuration work is already in progress for the organization, security configuration changes are blocked for the organization, or another organization in the same enterprise is applying security configurations.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed because the body does not match the request schema, `scope` is `selected` but `selected_repository_ids` is missing or empty, or a non-empty `selected_repository_ids` array is provided for another scope.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 400 is returned: Bad Request. A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 409 is returned: Conflict because security configuration work is already in progress for the organization, security configuration changes are blocked for the organization, or another organization in the same enterprise is applying security configurations. A 422 is returned: Validation failed because the body does not match the request schema, scope is selected but selected_repository_ids is missing or empty, or a non-empty selected_repository_ids array is provided for another scope.