Security fix: disabled

What it means

Returned by POST /orgs/{org}/code-security/deps/findings/{id}/autofix and POST /orgs/{org}/code-security/sast/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-disabled from POST /orgs/{org}/dependency-updates/security-fixes/requests and with the type ai-fix-disabled from POST /orgs/{org}/code-security/sast/findings/{id}/ai-fix. The paths above are deprecated and keep answering autofix-disabled until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• Security fixes are turned off for this organisation (mode Off, or its limits are set to 0).

The response also carries "reason": "disabled".

What to do

Set a mode other than off, and limits above 0, with PUT /orgs/{org}/dependency-updates/security-fixes/settings or under Security › Fix › Dependency updates › Security fixes. On the deprecated PUT .../code-security/autofix/settings, raise max_open_per_repo and max_per_org_per_day above 0.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-disabled",
  "title": "Conflict",
  "status": 409,
  "detail": "...",
  "reason": "disabled"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.