# Get a repository's security settings

> Get a repository's security settings: when the Code scanning check fails, dependency review and its policy, whether secrets in the history open alerts, whether it takes private vulnerability reports, its workspace's settings, and whether the paid features are on for it.

<div class="g1t-endpoint"><span class="g1t-method" data-method="get">GET</span><code>/repos/{owner}/{name}/security/settings</code></div>

- **Authentication:** Required. Send an [access token](/reference/api/#authentication) as `Authorization: Bearer`.
- **MCP tool:** [`security`](/reference/mcp/#security) with `action` `settings`, and the same inputs
- **Scope:** An access token needs [`security:read`](/guides/authentication/#scopes).

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `owner` | string | Yes | The workspace that owns the repository. |
| `name` | string | Yes | The repository's name. |

## Example request

```sh
curl https://api.g1t.sh/repos/flagon-io/hello/security/settings \
  -H "Authorization: Bearer $G1T_TOKEN"
```

## Example response

A successful request answers `200` with:

```json
{
  "settings": {
    "code_scanning_gate": "high",
    "dependency_review": true,
    "review_fail_on": "high",
    "review_deny_licenses": [
      "AGPL-3.0-only"
    ],
    "review_comment": true,
    "history_alerts": true,
    "private_vulnerability_reporting": false
  },
  "workspace": {
    "delegated_bypass": true,
    "validity_checks": true
  },
  "private": true,
  "entitled": true,
  "upkeep": true
}
```

## Errors

A failed request answers with one of these statuses and a body like `{"error": {"code": "not_found", "message": "Repository not found."}}`. See [errors](/reference/api/#errors).

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | A token is required, or the one sent is not valid. |
| 403 | `forbidden` | The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository. |
| 404 | `not_found` | It does not exist, or you cannot see it. |
| 422 | `invalid` | The input is not valid. `message` says which field and why. |