Developer platform

Connect your GitHub organization so Reagent can see where AI writes and approves code: Copilot seats and usage, AI actions in CI, and the GitHub Apps installed against the org.

Developer platform is section 07 on the Connections page. It covers source control and CI, the place where AI writes and approves code. The tile here is the org-scoped GitHub REST API. It is deliberately separate from the GitHub Copilot tile on Coding agents: that tile is device-pushed OpenTelemetry from developer machines and uses a different credential. Connect both if you want org-level seats and events from this page plus per-developer telemetry from the other.

GitHub

Connector: github-org · Auth: Personal Access Token (classic or fine-grained) plus the organization slug · Requires: any plan for the base connection; audit log and Copilot data are gated by plan, and alerts on private repositories need GitHub Advanced Security (see below)

Reagent reads your organization through the GitHub REST API: the org audit log, Copilot seats and the Copilot usage report, GitHub App installations, bot activity in CI, and the code scanning, secret scanning, and Dependabot alerts GitHub raises across your repos.

Lights up: AI Utilization in Sanctioned SaaS (Copilot usage report and Copilot seats), Server-Side CICD AI Actions (AI installs, bot commits and PRs in CI), AI App Sign-Ups & OAuth Grants (GitHub App installations). All three signals are in every template pack.

Before you start

You need any role that carries the manage integrations permission in Reagent.
Find your organization slug: the value after github.com/ in your organization's URL.
Decide between a classic and a fine-grained token. Both work. Fine-grained tokens let you set each permission to Read or Read and write.
Check your GitHub plan against the gates below before you generate the token.

Plan requirements. GitHub gates some of its REST APIs by plan tier. Where a gate applies, that part of the connection returns nothing regardless of the token.

Organization audit log API (admin actions, people added or removed, branch protection, repo visibility, secret scanning toggles): GitHub Enterprise Cloud. The web audit log works on any plan, but Reagent reads it through the API.
Code scanning, secret scanning, and Dependabot alert APIs: any plan. They return alerts only for repositories where the feature is enabled. Secret scanning and Dependabot are free for public repositories; private repositories need GitHub Advanced Security. CodeQL code scanning has the same gate.
User, repo, team, and org settings APIs: all plans (Free, Team, Enterprise).
Copilot seat data: a Copilot Business or Copilot Enterprise plan.
Not on Enterprise Cloud? You can still get event coverage through organization webhooks. Contact support to set up push-based ingestion.

Setup

In GitHub, go to Settings > Developer settings > Personal access tokens.
Choose Tokens (classic) or Fine-grained tokens.
Click Generate new token.
Name it (for example Zaun Integration) and set an expiration of at least 90 days.
Select the scopes or permissions from the tables below.
Click Generate token and copy it immediately. GitHub shows it only once.
In Reagent, open Connections, click the GitHub tile, enter the organization slug and the token, and save.

Permissions

Classic token scopes

Scope	Required	Purpose
`read:audit_log`	Yes	Read the organization audit log
`security_events`	Yes	Read code scanning, secret scanning, and Dependabot alerts org-wide
`read:org`	Yes	Org metadata; required for org-level secret scanning and Dependabot listings; also covers Copilot seats and the usage report
`repo`	Alternative	Broader scope that covers `security_events`

Fine-grained token permissions

Set Resource owner to your organization and Repository access to All repositories.

Permission	Type	Level	Purpose
`Code scanning alerts`	Repository	Read. Read and write to let Reagent dismiss or reopen alerts	CodeQL and third-party SAST findings
`Secret scanning alerts`	Repository	Read. Read and write for response actions	Exposed credentials, API keys, and tokens
`Dependabot alerts`	Repository	Read. Read and write for response actions	Vulnerable dependencies
`Audit log`	Organization	Read	Organization audit log
`Metadata`	Organization	Read	Org metadata
`Administration`	Organization	Read	Required to list secret scanning and Dependabot alerts at the org level
`GitHub Copilot Business`	Organization	Read	Copilot seat census
`View Organization Copilot Metrics`	Organization	Read	Copilot usage report

What Reagent reads

Organization audit log: user actions, permission changes, and repository events, including people added to or removed from the org, branch protection changes, repo visibility changes, and secret scanning toggles.
Copilot activity in the audit log: human Copilot use and the autonomous Copilot coding agent.
Copilot usage report and Copilot seats: org-wide and per-user rollups over 28-day and 1-day windows.
GitHub App installations against the org.
AI installs, bot commits, and bot pull requests in CI.
Code scanning alerts: CodeQL and third-party SAST findings across repos.
Secret scanning alerts: exposed credentials, API keys, and tokens.
Dependabot alerts: vulnerable dependencies, severity, and remediation status.
Alert lifecycle: with Read and write permissions, Reagent can dismiss, reopen, and track resolution of alerts as response actions.

The token is shown once. If you lose it, generate a new one and update the tile.
The token expires on the date you set. Set the expiration to at least 90 days and rotate the token before then, or use a GitHub App if you would rather not rotate.
Plan gates apply per API. A token with every scope still returns nothing for the audit log outside Enterprise Cloud. Alert APIs return alerts only for repositories where the feature is enabled, and private repositories need Advanced Security.