GitHub: Update a code security configuration

GitHub codeSecurity.codeSecurityUpdateConfiguration: arguments, response, policy and SDK examples.

← Code security operations · Get started

Operation github.code_security_update_configuration

Provider route: PATCH /orgs/{org}/code-security/configurations/{configuration_id}. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["codeSecurity"]["codeSecurityUpdateConfiguration"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.codeSecurity.codeSecurityUpdateConfiguration(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.code_security.code_security_update_configuration(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.org`	string	Required within parent
`path.configuration_id`	integer	Required within parent
`body`	object	Required within parent	Additional keys: not allowed
`body.advanced_security`	string	Optional	The enablement status of GitHub Advanced Security features. `enabled` will enable both Code Security and Secret Protection features. > [!WARNING] > `code_security` and `secret_protection` are deprecated values for this field. Prefer the individual `code_security` and `secret_protection` fields to set the status of these features. One of: enabled, disabled, code_security, secret_protection
`body.code_scanning_default_setup`	string	Optional	The enablement status of code scanning default setup One of: enabled, disabled, not_set
`body.code_scanning_default_setup_options`	Model	Optional	Expand Create a code security configuration — request body — body code scanning default setup options
`body.code_scanning_delegated_alert_dismissal`	string	Optional	The enablement status of code scanning delegated alert dismissal Default: disabled One of: enabled, disabled, not_set
`body.code_scanning_options`	Model	Optional	Expand Create a code security configuration — request body — body code scanning options
`body.code_security`	string	Optional	The enablement status of GitHub Code Security features. One of: enabled, disabled, not_set
`body.dependabot_alerts`	string	Optional	The enablement status of Dependabot alerts One of: enabled, disabled, not_set
`body.dependabot_delegated_alert_dismissal`	string	Optional	The enablement status of Dependabot delegated alert dismissal. Requires Dependabot alerts to be enabled. One of: enabled, disabled, not_set
`body.dependabot_reachability`	string	Optional	The enablement status of reachability analysis for Dependabot. Only available for organizations with access to reachability analysis. Requires Dependabot alerts to be enabled when set to `enabled`. Must be `disabled` when Dependabot alerts is `disabled`. `not_set` leaves existing repository settings unchanged. Omit this field to preserve the configuration’s current value. One of: enabled, disabled, not_set
`body.dependabot_security_updates`	string	Optional	The enablement status of Dependabot security updates One of: enabled, disabled, not_set
`body.dependency_graph`	string	Optional	The enablement status of Dependency Graph One of: enabled, disabled, not_set
`body.dependency_graph_autosubmit_action`	string	Optional	The enablement status of Automatic dependency submission One of: enabled, disabled, not_set
`body.dependency_graph_autosubmit_action_options`	object	Optional	Feature options for Automatic dependency submission
`body.dependency_graph_autosubmit_action_options.labeled_runners`	boolean	Optional	Whether to use runners labeled with ‘dependency-submission’ or standard GitHub runners.
`body.description`	string	Optional	A description of the code security configuration Maximum length: 255
`body.enforcement`	string	Optional	The enforcement status for a security configuration One of: enforced, unenforced
`body.name`	string	Optional	The name of the code security configuration. Must be unique within the organization.
`body.private_vulnerability_reporting`	string	Optional	The enablement status of private vulnerability reporting One of: enabled, disabled, not_set
`body.secret_protection`	string	Optional	The enablement status of GitHub Secret Protection features. One of: enabled, disabled, not_set
`body.secret_scanning`	string	Optional	The enablement status of secret scanning One of: enabled, disabled, not_set
`body.secret_scanning_delegated_alert_dismissal`	string	Optional	The enablement status of secret scanning delegated alert dismissal One of: enabled, disabled, not_set
`body.secret_scanning_delegated_bypass`	string	Optional	The enablement status of secret scanning delegated bypass One of: enabled, disabled, not_set
`body.secret_scanning_delegated_bypass_options`	Model	Optional	Expand Create a code security configuration — request body — body secret scanning delegated bypass options
`body.secret_scanning_extended_metadata`	string	Optional	The enablement status of secret scanning extended metadata One of: enabled, disabled, not_set
`body.secret_scanning_generic_secrets`	string	Optional	The enablement status of Copilot secret scanning One of: enabled, disabled, not_set
`body.secret_scanning_generic_secrets_push_protection`	string	Optional	The enablement status of generic secrets push protection One of: enabled, disabled, not_set
`body.secret_scanning_non_provider_patterns`	string	Optional	The enablement status of secret scanning non-provider patterns One of: enabled, disabled, not_set
`body.secret_scanning_push_protection`	string	Optional	The enablement status of secret scanning push protection One of: enabled, disabled, not_set
`body.secret_scanning_validity_checks`	string	Optional	The enablement status of secret scanning validity checks One of: enabled, disabled, not_set

Referenced models: Create a code security configuration — request body — body code scanning default setup options, Create a code security configuration — request body — body code scanning options, Create a code security configuration — request body — body secret scanning delegated bypass options

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	Model	Alternative	Expand Get a code security configuration — response body
`$ (anyOf 2)`	null	Alternative

Referenced models: Get a code security configuration — response body

Schemas

Get a code security configuration — response body

Field	Type	Presence	Description and constraints
`$`	object	Root	A code security configuration
`advanced_security`	string	Optional	The enablement status of GitHub Advanced Security Known values: enabled, disabled, code_security, secret_protection
`code_scanning_default_setup`	string	Optional	The enablement status of code scanning default setup Known values: enabled, disabled, not_set
`code_scanning_default_setup_options`	JSON	Optional
`code_scanning_default_setup_options (anyOf 1)`	object	Alternative	Feature options for code scanning default setup
`code_scanning_default_setup_options (anyOf 1).runner_label`	JSON	Optional
`code_scanning_default_setup_options (anyOf 1).runner_label (anyOf 1)`	string	Alternative	The label of the runner to use for code scanning when runner_type is 'labeled'.
`code_scanning_default_setup_options (anyOf 1).runner_label (anyOf 2)`	null	Alternative
`code_scanning_default_setup_options (anyOf 1).runner_type`	JSON	Optional
`code_scanning_default_setup_options (anyOf 1).runner_type (anyOf 1)`	string	Alternative	Whether to use labeled runners or standard GitHub runners. Known values: standard, labeled, not_set
`code_scanning_default_setup_options (anyOf 1).runner_type (anyOf 2)`	null	Alternative
`code_scanning_default_setup_options (anyOf 2)`	null	Alternative
`code_scanning_delegated_alert_dismissal`	string	Optional	The enablement status of code scanning delegated alert dismissal Known values: enabled, disabled, not_set
`code_scanning_options`	JSON	Optional
`code_scanning_options (anyOf 1)`	object	Alternative	Feature options for code scanning
`code_scanning_options (anyOf 1).allow_advanced`	JSON	Optional
`code_scanning_options (anyOf 1).allow_advanced (anyOf 1)`	boolean	Alternative	Whether to allow repos which use advanced setup
`code_scanning_options (anyOf 1).allow_advanced (anyOf 2)`	null	Alternative
`code_scanning_options (anyOf 2)`	null	Alternative
`created_at`	string	Optional	Format: date-time
`dependabot_alerts`	string	Optional	The enablement status of Dependabot alerts Known values: enabled, disabled, not_set
`dependabot_delegated_alert_dismissal`	JSON	Optional
`dependabot_delegated_alert_dismissal (anyOf 1)`	string	Alternative	The enablement status of Dependabot delegated alert dismissal Known values: enabled, disabled, not_set
`dependabot_delegated_alert_dismissal (anyOf 2)`	null	Alternative
`dependabot_reachability`	string	Optional	The enablement status of reachability analysis for Dependabot. Only returned for organizations and enterprises with access to reachability analysis. Known values: enabled, disabled, not_set
`dependabot_security_updates`	string	Optional	The enablement status of Dependabot security updates Known values: enabled, disabled, not_set
`dependency_graph`	string	Optional	The enablement status of Dependency Graph Known values: enabled, disabled, not_set
`dependency_graph_autosubmit_action`	string	Optional	The enablement status of Automatic dependency submission Known values: enabled, disabled, not_set
`dependency_graph_autosubmit_action_options`	object	Optional	Feature options for Automatic dependency submission
`dependency_graph_autosubmit_action_options.labeled_runners`	boolean	Optional	Whether to use runners labeled with 'dependency-submission' or standard GitHub runners.
`description`	JSON	Optional
`description (anyOf 1)`	string	Alternative	A description of the code security configuration
`description (anyOf 2)`	null	Alternative
`enforcement`	string	Optional	The enforcement status for a security configuration Known values: enforced, unenforced, enterprise_enforced
`html_url`	string	Optional	The URL of the configuration Format: uri
`id`	JSON	Optional
`id (anyOf 1)`	integer	Alternative	The ID of the code security configuration
`id (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`name`	string	Optional	The name of the code security configuration. Must be unique within the organization.
`private_vulnerability_reporting`	string	Optional	The enablement status of private vulnerability reporting Known values: enabled, disabled, not_set
`secret_scanning`	string	Optional	The enablement status of secret scanning Known values: enabled, disabled, not_set
`secret_scanning_delegated_alert_dismissal`	string	Optional	The enablement status of secret scanning delegated alert dismissal Known values: enabled, disabled, not_set
`secret_scanning_delegated_bypass`	string	Optional	The enablement status of secret scanning delegated bypass Known values: enabled, disabled, not_set
`secret_scanning_delegated_bypass_options`	object	Optional	Feature options for secret scanning delegated bypass
`secret_scanning_delegated_bypass_options.reviewers`	array	Optional	The bypass reviewers for secret scanning delegated bypass
`secret_scanning_delegated_bypass_options.reviewers[]`	object	Each item
`secret_scanning_delegated_bypass_options.reviewers[].mode`	string	Optional	The bypass mode for the reviewer Known values: ALWAYS, EXEMPT Default: ALWAYS
`secret_scanning_delegated_bypass_options.reviewers[].reviewer_id`	JSON	Required within parent
`secret_scanning_delegated_bypass_options.reviewers[].reviewer_id (anyOf 1)`	integer	Alternative	The ID of the team or role selected as a bypass reviewer
`secret_scanning_delegated_bypass_options.reviewers[].reviewer_id (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`secret_scanning_delegated_bypass_options.reviewers[].reviewer_type`	string	Required within parent	The type of the bypass reviewer Known values: TEAM, ROLE
`secret_scanning_delegated_bypass_options.reviewers[].security_configuration_id`	JSON	Optional
`secret_scanning_delegated_bypass_options.reviewers[].security_configuration_id (anyOf 1)`	integer	Alternative	The ID of the security configuration associated with this bypass reviewer
`secret_scanning_delegated_bypass_options.reviewers[].security_configuration_id (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`secret_scanning_extended_metadata`	string	Optional	The enablement status of secret scanning extended metadata Known values: enabled, disabled, not_set
`secret_scanning_generic_secrets`	string	Optional	The enablement status of Copilot secret scanning Known values: enabled, disabled, not_set
`secret_scanning_generic_secrets_push_protection`	string	Optional	The enablement status of generic secrets push protection Known values: enabled, disabled, not_set
`secret_scanning_non_provider_patterns`	string	Optional	The enablement status of secret scanning non-provider patterns Known values: enabled, disabled, not_set
`secret_scanning_push_protection`	string	Optional	The enablement status of secret scanning push protection Known values: enabled, disabled, not_set
`secret_scanning_validity_checks`	string	Optional	The enablement status of secret scanning validity checks Known values: enabled, disabled, not_set
`target_type`	string	Optional	The type of the code security configuration. Known values: global, organization, enterprise
`updated_at`	string	Optional	Format: date-time
`url`	string	Optional	The URL of the configuration Format: uri

Create a code security configuration — request body — body code scanning default setup options

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	object	Alternative	Feature options for code scanning default setup
`$ (anyOf 1).runner_label`	JSON	Optional
`$ (anyOf 1).runner_label (anyOf 1)`	string	Alternative	The label of the runner to use for code scanning default setup when runner_type is 'labeled'.
`$ (anyOf 1).runner_label (anyOf 2)`	null	Alternative
`$ (anyOf 1).runner_type`	string	Optional	Whether to use labeled runners or standard GitHub runners. One of: standard, labeled, not_set
`$ (anyOf 2)`	null	Alternative

Create a code security configuration — request body — body code scanning options

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	object	Alternative	Security Configuration feature options for code scanning
`$ (anyOf 1).allow_advanced`	JSON	Optional
`$ (anyOf 1).allow_advanced (anyOf 1)`	boolean	Alternative	Whether to allow repos which use advanced setup
`$ (anyOf 1).allow_advanced (anyOf 2)`	null	Alternative
`$ (anyOf 2)`	null	Alternative

Create a code security configuration — request body — body secret scanning delegated bypass options

Field	Type	Presence	Description and constraints
`$`	object	Root	Feature options for secret scanning delegated bypass
`reviewers`	array	Optional	The bypass reviewers for secret scanning delegated bypass
`reviewers[]`	object	Each item
`reviewers[].mode`	string	Optional	The bypass mode for the reviewer Default: ALWAYS One of: ALWAYS, EXEMPT
`reviewers[].reviewer_id`	integer	Required within parent	The ID of the team or role selected as a bypass reviewer
`reviewers[].reviewer_type`	string	Required within parent	The type of the bypass reviewer One of: TEAM, ROLE

Policy, approvals and errors

SDK function policy ID: github.code_security_update_configuration. Catalog operation: code-security/update-configuration. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

No-content response statuses: [204]

Official provider source

Report an issue with this page