ST-2026-028 · Enforcement & amendments
GitHub removes legacy organization-level security feature fields from the REST API
GitHub removed seven organization REST fields that toggled or reported default security-feature enablement for new repositories, directing integrations to Code Security Configurations instead.
Previous state
Automation could read or update organization-level fields for Advanced Security, Dependabot, dependency graph, secret scanning and push-protection defaults.
Current state
The legacy fields are no longer available; security enablement for repositories is managed through Code Security Configurations and their REST API.
Affected users
Who needs to care
Security platform teams and automation that parse or write the removed fields on organization get/update endpoints.
Required response
What to do
Remove dependencies on the old fields, create and manage Code Security Configurations, set an appropriate default configuration for new repositories and test migration semantics.
Evidence boundary
What the source does not prove
The change replaces the listed fields, not all organization security APIs. The source does not claim that a configuration created through the new API is behaviourally identical to every legacy field combination.
Lifecycle history
Dated event sequence
- Upcoming removal announced
GitHub listed the seven fields and gave integrations four weeks to migrate.
- Fields removed
GitHub confirmed the fields were deprecated and removed from the organization endpoints.
Evidence ledger
First-party sources
- 01GitHub Changelog — Upcoming deprecation of security-related organization API fields
Official advance removal notice · 2026-03-24
Open official source ↗ - 02GitHub Changelog — Deprecation of security-related organization API fields
Official removal confirmation · 2026-04-21
Open official source ↗