ST-2026-085 · API endpoints & versions
GitHub removes seven security-enablement fields from organisation REST endpoints
GitHub removed seven legacy security-related fields from the get and update organisation REST endpoints and directs automation to Code Security configurations.
Previous state
The get and update organisation endpoints exposed seven fields controlling Advanced Security, Dependabot, dependency graph and secret-scanning defaults for new repositories.
Current state
Those fields are no longer available; organisations must manage equivalent enablement through GitHub Code Security configurations and set a default configuration for new repositories.
Affected users
Who needs to care
Organisation-management integrations and automation that read or write the removed Advanced Security, Dependabot, dependency-graph or secret-scanning fields.
Required response
What to do
Migrate policy automation to the Code Security Configurations REST API or organisation settings and replace legacy new-repository defaults with a default configuration.
Evidence boundary
What the source does not prove
The notice removes exactly seven organisation-endpoint fields. It does not disable the underlying security products or state that every repository configuration changes automatically.
Lifecycle history
Dated event sequence
- Deprecation announced
GitHub listed the seven affected fields and the Code Security configuration replacement path.
- Fields removed
The fields became unavailable on the get and update organisation endpoints.
Evidence ledger
First-party sources
- 01GitHub Changelog — Upcoming deprecation of security-related organization API fields
Official REST API deprecation and replacement notice · 2026-03-24
Open official source ↗