---
title: "Create a code security configuration"
method: POST
path: "/orgs/{org}/code-security/configurations"
tags: ["code-security"]
---

# Create a code security configuration

`POST /orgs/{org}/code-security/configurations`

Creates a code security configuration in an organization.

The authenticated user must be an administrator or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `write:org` scope to use this endpoint.

## Path parameters

- `org` string, required

## Request body

- object
  - `name` string, required — The name of the code security configuration. Must be unique within the organization.
  - `description` string — A description of the code security configuration
  - `advanced_security` 'enabled' | 'disabled' | 'code_security' | 'secret_protection' — The enablement status of GitHub Advanced Security features. `enabled` will enable both Code Security and Secret Protection features. > [!WARNING] > `code_security` and `secret_protection` are deprecated values for this field. Prefer the individual `code_security` and `secret_protection` fields to set the status of these features.
  - `code_security` 'enabled' | 'disabled' | 'not_set' — The enablement status of GitHub Code Security features.
  - `dependency_graph` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependency Graph
  - `dependency_graph_autosubmit_action` 'enabled' | 'disabled' | 'not_set' — The enablement status of Automatic dependency submission
  - `dependency_graph_autosubmit_action_options` object — Feature options for Automatic dependency submission
    - `labeled_runners` boolean — Whether to use runners labeled with 'dependency-submission' or standard GitHub runners.
  - `dependabot_alerts` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependabot alerts
  - `dependabot_security_updates` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependabot security updates
  - `dependabot_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependabot delegated alert dismissal. Requires Dependabot alerts to be enabled.
  - `code_scanning_options` CodeScanningOptions, nullable — Security Configuration feature options for code scanning
    - `allow_advanced` boolean, nullable — Whether to allow repos which use advanced setup
  - `code_scanning_default_setup` 'enabled' | 'disabled' | 'not_set' — The enablement status of code scanning default setup
  - `code_scanning_default_setup_options` CodeScanningDefaultSetupOptions, nullable — Feature options for code scanning default setup
    - `runner_type` 'standard' | 'labeled' | 'not_set' — Whether to use labeled runners or standard GitHub runners.
    - `runner_label` string, nullable — The label of the runner to use for code scanning default setup when runner_type is 'labeled'.
  - `code_scanning_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set' — The enablement status of code scanning delegated alert dismissal
  - `secret_protection` 'enabled' | 'disabled' | 'not_set' — The enablement status of GitHub Secret Protection features.
  - `secret_scanning` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning
  - `secret_scanning_push_protection` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning push protection
  - `secret_scanning_delegated_bypass` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning delegated bypass
  - `secret_scanning_delegated_bypass_options` object — Feature options for secret scanning delegated bypass
    - `reviewers` object[] — The bypass reviewers for secret scanning delegated bypass
      - `reviewer_id` integer, required — The ID of the team or role selected as a bypass reviewer
      - `reviewer_type` 'TEAM' | 'ROLE', required — The type of the bypass reviewer
      - `mode` 'ALWAYS' | 'EXEMPT' — The bypass mode for the reviewer
  - `secret_scanning_validity_checks` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning validity checks
  - `secret_scanning_non_provider_patterns` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning non provider patterns
  - `secret_scanning_generic_secrets` 'enabled' | 'disabled' | 'not_set' — The enablement status of Copilot secret scanning
  - `secret_scanning_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning delegated alert dismissal
  - `secret_scanning_extended_metadata` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning extended metadata
  - `private_vulnerability_reporting` 'enabled' | 'disabled' | 'not_set' — The enablement status of private vulnerability reporting
  - `enforcement` 'enforced' | 'unenforced' — The enforcement status for a security configuration

## Response `201`

Successfully created code security configuration

- CodeSecurityConfiguration — A code security configuration
  - `id` integer — The ID of the code security configuration
  - `name` string — The name of the code security configuration. Must be unique within the organization.
  - `target_type` 'global' | 'organization' | 'enterprise' — The type of the code security configuration.
  - `description` string, nullable — A description of the code security configuration
  - `advanced_security` 'enabled' | 'disabled' | 'code_security' | 'secret_protection' — The enablement status of GitHub Advanced Security
  - `dependency_graph` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependency Graph
  - `dependency_graph_autosubmit_action` 'enabled' | 'disabled' | 'not_set' — The enablement status of Automatic dependency submission
  - `dependency_graph_autosubmit_action_options` object — Feature options for Automatic dependency submission
    - `labeled_runners` boolean — Whether to use runners labeled with 'dependency-submission' or standard GitHub runners.
  - `dependabot_alerts` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependabot alerts
  - `dependabot_security_updates` 'enabled' | 'disabled' | 'not_set' — The enablement status of Dependabot security updates
  - `dependabot_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set', nullable — The enablement status of Dependabot delegated alert dismissal
  - `code_scanning_options` object, nullable — Feature options for code scanning
    - `allow_advanced` boolean, nullable — Whether to allow repos which use advanced setup
  - `code_scanning_default_setup` 'enabled' | 'disabled' | 'not_set' — The enablement status of code scanning default setup
  - `code_scanning_default_setup_options` object, nullable — Feature options for code scanning default setup
    - `runner_type` 'standard' | 'labeled' | 'not_set', nullable — Whether to use labeled runners or standard GitHub runners.
    - `runner_label` string, nullable — The label of the runner to use for code scanning when runner_type is 'labeled'.
  - `code_scanning_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set' — The enablement status of code scanning delegated alert dismissal
  - `secret_scanning` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning
  - `secret_scanning_push_protection` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning push protection
  - `secret_scanning_delegated_bypass` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning delegated bypass
  - `secret_scanning_delegated_bypass_options` object — Feature options for secret scanning delegated bypass
    - `reviewers` object[] — The bypass reviewers for secret scanning delegated bypass
      - `reviewer_id` integer, required — The ID of the team or role selected as a bypass reviewer
      - `reviewer_type` 'TEAM' | 'ROLE', required — The type of the bypass reviewer
      - `mode` 'ALWAYS' | 'EXEMPT' — The bypass mode for the reviewer
      - `security_configuration_id` integer — The ID of the security configuration associated with this bypass reviewer
  - `secret_scanning_validity_checks` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning validity checks
  - `secret_scanning_non_provider_patterns` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning non-provider patterns
  - `secret_scanning_generic_secrets` 'enabled' | 'disabled' | 'not_set' — The enablement status of Copilot secret scanning
  - `secret_scanning_delegated_alert_dismissal` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning delegated alert dismissal
  - `secret_scanning_extended_metadata` 'enabled' | 'disabled' | 'not_set' — The enablement status of secret scanning extended metadata
  - `private_vulnerability_reporting` 'enabled' | 'disabled' | 'not_set' — The enablement status of private vulnerability reporting
  - `enforcement` 'enforced' | 'unenforced' — The enforcement status for a security configuration
  - `url` string, uri — The URL of the configuration
  - `html_url` string, uri — The URL of the configuration
  - `created_at` string, date-time
  - `updated_at` string, date-time

---

[API](https://skmtc.net/github/apis/github-v3-rest-api.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api/versions/a367f7028301/schema)