REST API endpoints for Dependabot runner settings

Use the REST API to get and set Dependabot runner settings.

Get repository Dependabot runner settings

Gets the runner Dependabot uses for this repository: standard GitHub-hosted runners, or labeled runners with their labels and optional runner group. The response matches the repository's code security settings page.

Labeled runners take effect only for private and internal repositories with GitHub Actions enabled. Otherwise, the response shows standard.

Repository administrators and users who can manage security products for the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) require the repo scope for both public and private repositories. GitHub App tokens and fine-grained personal access tokens require repository Administration read permission. Workflow GITHUB_TOKEN access is not supported.

Jetons d'accès granulaires pour «Get repository Dependabot runner settings»

Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:

Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:

  • "Administration" repository permissions (read)

Paramètres pour «Get repository Dependabot runner settings »

En-têtes
accept string

Setting to application/vnd.github+json is recommended.

Paramètres de chemin d’accès
owner string Requis

The account owner of the repository. The name is not case sensitive.

repo string Requis

The name of the repository without the .git extension. The name is not case sensitive.

Codes d’état de réponse HTTP pour «Get repository Dependabot runner settings »

Code de statutDescription
200

OK

401

Requires authentication

403

Forbidden

404

Resource not found

Exemples de code pour «Get repository Dependabot runner settings »

Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.

Exemple de requête

get/repos/{owner}/{repo}/dependabot/runner-settings
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/dependabot/runner-settings

Labeled runner with a runner group

Status: 200
{ "runner_type": "labeled", "runner_labels": [ "dependabot" ], "runner_group": "dependabot-runners" }

Set repository Dependabot runner settings

Sets the runner Dependabot uses for this repository. This is the same setting as on the repository's code security settings page.

labeled turns on labeled runners with exactly one runner label and an optional runner group. standard turns them off and clears the label and group.

Labeled runners are only available for private and internal repositories with GitHub Actions enabled. The response returns the settings after the change.

Repository administrators and users who can manage security products for the repository can use this endpoint, subject to enterprise policy. OAuth app tokens and personal access tokens (classic) require the repo scope. GitHub App tokens and fine-grained personal access tokens require repository Administration write permission. Workflow GITHUB_TOKEN access is not supported.

Jetons d'accès granulaires pour «Set repository Dependabot runner settings»

Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:

Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:

  • "Administration" repository permissions (write)

Paramètres pour «Set repository Dependabot runner settings »

En-têtes
accept string

Setting to application/vnd.github+json is recommended.

Paramètres de chemin d’accès
owner string Requis

The account owner of the repository. The name is not case sensitive.

repo string Requis

The name of the repository without the .git extension. The name is not case sensitive.

Paramètres du corps
runner_type string Requis

labeled for labeled runners, standard for standard GitHub-hosted runners.

Peut être l'un des: standard, labeled

runner_labels array of strings

Required for labeled. Exactly one non-blank runner label. Not allowed for standard.

runner_group string or null

Optional for labeled. Omitted, null or blank means no group. Not allowed for standard.

Codes d’état de réponse HTTP pour «Set repository Dependabot runner settings »

Code de statutDescription
200

OK

400

Bad Request

401

Requires authentication

403

Forbidden

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

Exemples de code pour «Set repository Dependabot runner settings »

Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.

Exemple de requête

put/repos/{owner}/{repo}/dependabot/runner-settings
curl -L \ -X PUT \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/dependabot/runner-settings \ -d '{"runner_type":"labeled","runner_labels":["dependabot"],"runner_group":"dependabot-runners"}'

Labeled runner with a runner group

Status: 200
{ "runner_type": "labeled", "runner_labels": [ "dependabot" ], "runner_group": "dependabot-runners" }