Attach a configuration to repositories

Attach a code security configuration to a set of repositories. If the repositories specified are already attached to a configuration, they will be re-attached to the provided configuration.

If insufficient GHAS licenses are available to attach the configuration to a repository, only free features will be enabled.

The authenticated user must be an administrator or security manager for the organization to use this endpoint.

Directly applying an enterprise-enforced configuration also requires permission to manage the enterprise's code security settings. Without it, the request returns 403 and no repositories change.

When applying a different configuration, repositories with active enterprise-enforced attachments are skipped unless the authenticated user can manage the enterprise's code security settings; the remaining repositories are updated. The request still returns 202 if every repository is skipped.

OAuth app tokens and classic PATs require the write:org scope. Directly applying an enterprise-enforced configuration also requires admin:enterprise and is not supported by fine-grained PATs or GitHub App access tokens.