PUT/orgs/{org}/code-security/configurations/{configuration_id}/defaults

Set a code security configuration as a default for an organization

Sets a code security configuration as a default to be applied to new repositories in your organization.

This configuration will be applied to the matching repository type (all, none, public, private and internal) by default when they are created.

The authenticated user must be an administrator or security manager for the organization to use this endpoint. Setting an enterprise-enforced configuration as the default also requires permission to manage the enterprise's code security settings.

A default set with this endpoint is an organization default, even if the configuration is owned or enforced by the enterprise. An enterprise-enforced configuration set as an enterprise-level default for the same repository visibility takes precedence.

OAuth app tokens and classic PATs require the write:org scope; setting an enterprise-enforced configuration as the default also requires admin:enterprise. Fine-grained PATs and GitHub App access tokens cannot perform that action.

2 parameters · 1 body field
orgstringrequired
The organization name. The name is not case sensitive.
configuration_idintegerrequired
The unique identifier of the code security configuration.
default_for_new_reposstringoptional
Specify which types of repository this security configuration should be applied to by default.
Allowed:allnoneprivate_and_internalpublic

4 status codes
200Default successfully changed.
default_for_new_reposstringoptional
Specifies which types of repository this security configuration is applied to by default.
Allowed:allnoneprivate_and_internalpublic
configurationobjectoptional
A code security configuration
403Forbidden
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed because a public default is not supported in the current environment.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 422 is returned: Validation failed because a public default is not supported in the current environment.