REST API endpoints for enterprise AI controls

Get model policies for enterprise apps

Use this endpoint to retrieve Copilot model policies for enterprise apps. The response shows which model settings can be changed and which are controlled by enterprise policy.

For models whose settings can be changed, the response shows the configured setting or optional if no setting has been configured. For models controlled by enterprise policy, it shows the enterprise setting or the applicable default. These settings do not necessarily determine whether an individual user can access a model.

Enterprise owners and users with the read_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Fine-grained access tokens for "Get model policies for enterprise apps"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (read)

Parameters for "Get model policies for enterprise apps"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

HTTP response status codes for "Get model policies for enterprise apps"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`503`	Service unavailable

Code samples for "Get model policies for enterprise apps"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request examples

Select the example type

get/enterprises/{enterprise}/copilot/apps/model-policies

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/copilot/apps/model-policies

OK

Status: 200

{
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "optional",
      "enterprise_policy_state": "delegate_to_teams_and_apps",
      "editable": true
    }
  ]
}

Update model policies for enterprise apps

Use this endpoint to set Copilot model policies for enterprise apps. Set a model to enabled to configure an apps policy, or to optional to remove the stored apps policy for that model. Locked models cannot be updated.

Returns the apps policy state representation, including enterprise policy and editability. These states are not a final access decision for a user.

Enterprise owners and users with the write_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Update model policies for enterprise apps"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (write)

Parameters for "Update model policies for enterprise apps"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Name, Type, Description

models array of objects Required

Properties of models

Name, Type, Description
`model_name` string Required
`policy_state` string Required Use `optional` to remove the apps policy. Can be one of: `enabled`, `disabled`, `optional`

HTTP response status codes for "Update model policies for enterprise apps"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Update model policies for enterprise apps"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

patch/enterprises/{enterprise}/copilot/apps/model-policies

curl -L \
  -X PATCH \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/copilot/apps/model-policies \
  -d '{"models":[{"model_name":"gpt-5.6-sol","policy_state":"enabled"}]}'

OK

Status: 200

{
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "enabled",
      "enterprise_policy_state": "delegate_to_teams_and_apps",
      "editable": true
    }
  ]
}

Get model policies for an enterprise

Use this endpoint to retrieve Copilot model policies for an enterprise. For enterprises that manage Copilot through organizations, delegated models use the policy state of delegate_to_organizations.

Enterprise owners and users with the read_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Fine-grained access tokens for "Get model policies for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (read)

Parameters for "Get model policies for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

HTTP response status codes for "Get model policies for an enterprise"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`503`	Service unavailable

Code samples for "Get model policies for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

get/enterprises/{enterprise}/copilot/model-policies

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/copilot/model-policies

OK

Status: 200

{
  "default_availability": {
    "policy_state": "enabled"
  },
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "enabled"
    }
  ]
}

Update model policies for an enterprise

Use this endpoint to update Copilot model policies for an enterprise. For enterprises that manage Copilot through organizations, use delegate_to_organizations to delegate a model or default availability. Enterprises without organizations cannot use delegate_to_organizations.

Enterprise owners and users with the write_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Update model policies for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (write)

Parameters for "Update model policies for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Name, Type, Description

default_availability object

Properties of default_availability

Name, Type, Description
`policy_state` string Required `delegate_to_organizations` is only accepted for enterprises that manage Copilot through organizations. Can be one of: `enabled`, `disabled`, `delegate_to_organizations`

models array of objects

Properties of models

Name, Type, Description
`model_name` string Required
`policy_state` string Required `delegate_to_organizations` is only accepted for enterprises that manage Copilot through organizations. Can be one of: `enabled`, `disabled`, `delegate_to_teams_and_apps`, `delegate_to_organizations`

HTTP response status codes for "Update model policies for an enterprise"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Update model policies for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

patch/enterprises/{enterprise}/copilot/model-policies

curl -L \
  -X PATCH \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/copilot/model-policies \
  -d '{"default_availability":{"policy_state":"enabled"},"models":[{"model_name":"gpt-5.6-sol","policy_state":"enabled"}]}'

OK

Status: 200

{
  "default_availability": {
    "policy_state": "enabled"
  },
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "enabled"
    }
  ]
}

Get model policies for an enterprise team

Use this endpoint to retrieve Copilot model policy states for an enterprise team, along with the corresponding enterprise-level policies. The response shows which model policies the team can update based on enterprise policy and the available team policy controls.

For models the team can update, the response shows the team’s configured value or optional if the team has not set one. For locked models, it shows the enterprise’s explicit value or the applicable default availability for eligible models. These states are not a final access decision for a user.

Enterprise owners and users with the read_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:enterprise scope to use this endpoint.

Fine-grained access tokens for "Get model policies for an enterprise team"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (read)

Parameters for "Get model policies for an enterprise team"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`team_id` integer Required The unique identifier of the team.

HTTP response status codes for "Get model policies for an enterprise team"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`503`	Service unavailable

Code samples for "Get model policies for an enterprise team"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request examples

Select the example type

get/enterprises/{enterprise}/teams/{team_id}/copilot/model-policies

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/teams/TEAM_ID/copilot/model-policies

OK

Status: 200

{
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "optional",
      "enterprise_policy_state": "delegate_to_teams_and_apps",
      "editable": true
    }
  ]
}

Update model policies for an enterprise team

Use this endpoint to update Copilot model policies for an enterprise team. Only editable model policies can be updated.

Set a model to enabled to configure a team policy, or to optional to clear the team’s policy for that model. Locked models cannot be updated.

The response contains the same policy state information as the corresponding GET endpoint, including enterprise policies and whether each model policy can be updated. These states do not necessarily determine whether an individual user can access a model.

Enterprise owners and users with the write_enterprise_ai_controls permission can use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Update model policies for an enterprise team"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise AI controls" enterprise permissions (write)

Parameters for "Update model policies for an enterprise team"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`team_id` integer Required The unique identifier of the team.

Name, Type, Description

models array of objects Required

Properties of models

Name, Type, Description
`model_name` string Required
`policy_state` string Required Use `optional` to remove the team's policy. Can be one of: `enabled`, `disabled`, `optional`

HTTP response status codes for "Update model policies for an enterprise team"

Status code	Description
`200`	OK
`401`	Requires authentication
`403`	Forbidden
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.
`503`	Service unavailable

Code samples for "Update model policies for an enterprise team"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

patch/enterprises/{enterprise}/teams/{team_id}/copilot/model-policies

curl -L \
  -X PATCH \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/teams/TEAM_ID/copilot/model-policies \
  -d '{"models":[{"model_name":"gpt-5.6-sol","policy_state":"enabled"}]}'

OK

Status: 200

{
  "models": [
    {
      "model_name": "gpt-5.6-sol",
      "display_name": "OpenAI GPT-5.6 Sol",
      "policy_state": "enabled",
      "enterprise_policy_state": "delegate_to_teams_and_apps",
      "editable": true
    }
  ]
}