REST API endpoints for enterprise credential inventory
Use the REST API to list, inspect, and export credentials associated with your enterprise.
List enterprise token inventory
Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Fine-grained access tokens for "List enterprise token inventory"
This endpoint works with the following fine-grained token types:
The fine-grained token must have the following permission set:
- "Enterprise credentials" enterprise permissions (read)
Parameters for "List enterprise token inventory"
| Name, Type, Description |
|---|
accept string Setting to |
| Name, Type, Description |
|---|
enterprise string RequiredThe slug version of the enterprise name. |
| Name, Type, Description |
|---|
per_page integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Default: |
after string A cursor, as given in the |
token_types string A comma-separated list of credential types to filter by. |
authorization_state string Filter by enterprise-access status. Can be one of: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
HTTP response status codes for "List enterprise token inventory"
| Status code | Description |
|---|---|
200 | OK |
404 | Resource not found |
422 | Validation failed |
Code samples for "List enterprise token inventory"
If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.
Request example
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentialsResponse
Status: 200[
{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
"credential_id": 246810,
"hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "oauth_app_user_token",
"display_name": "Acme Deploy",
"owner": {
"id": 2,
"login": "hubot"
},
"owner_type": "user",
"application": {
"id": 42,
"name": "Acme Deploy"
},
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-03-10T14:00:00Z",
"last_used_at": "2024-06-02T08:15:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 2,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
},
{
"id": 11,
"login": "acme-ops"
}
],
"age_days": 83,
"never_expires": true,
"past_expiration_policy": false,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": [
"read:user",
"repo"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
"credential_id": null,
"hashed_token": null,
"fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
"item_type": "credential",
"credential_type": "ssh_key",
"display_name": "laptop-2024",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2023-11-01T10:00:00Z",
"last_used_at": "2024-05-20T16:45:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 213,
"never_expires": true,
"past_expiration_policy": true,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": null,
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
"credential_id": 135790,
"hashed_token": null,
"fingerprint": null,
"item_type": "credential",
"credential_type": "fine_grained_pat",
"display_name": "release-bot",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-05-01T10:00:00Z",
"last_used_at": "2024-06-03T16:45:00Z",
"expires_at": "2024-11-01T10:00:00Z",
"next_expires_at": "2024-11-01T10:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 45,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": null,
"permissions": {
"contents": "read",
"pull_requests": "write"
},
"repository_selection": "subset"
}
]Create an enterprise token inventory export
Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.
The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Fine-grained access tokens for "Create an enterprise token inventory export"
This endpoint works with the following fine-grained token types:
The fine-grained token must have the following permission set:
- "Enterprise credentials" enterprise permissions (read)
Parameters for "Create an enterprise token inventory export"
| Name, Type, Description |
|---|
accept string Setting to |
| Name, Type, Description |
|---|
enterprise string RequiredThe slug version of the enterprise name. |
| Name, Type, Description |
|---|
token_types array of strings The credential types to include. |
authorization_state string Filter by enterprise-access status. Can be one of: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
HTTP response status codes for "Create an enterprise token inventory export"
| Status code | Description |
|---|---|
202 | Accepted |
404 | Resource not found |
422 | Validation failed |
429 | Too many requests |
500 | Internal error, for example the export job could not be enqueued. |
Code samples for "Create an enterprise token inventory export"
If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.
Request example
curl -L \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
-d '{"owner":"octocat"}'Accepted
Status: 202{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory export
Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Fine-grained access tokens for "Get an enterprise token inventory export"
This endpoint works with the following fine-grained token types:
The fine-grained token must have the following permission set:
- "Enterprise credentials" enterprise permissions (read)
Parameters for "Get an enterprise token inventory export"
| Name, Type, Description |
|---|
accept string Setting to |
| Name, Type, Description |
|---|
enterprise string RequiredThe slug version of the enterprise name. |
export_id string RequiredThe opaque id of the export, as returned when it was created. |
HTTP response status codes for "Get an enterprise token inventory export"
| Status code | Description |
|---|---|
200 | OK |
302 | The export is ready; redirects to a short-lived download URL. |
404 | Resource not found |
Code samples for "Get an enterprise token inventory export"
If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.
Request example
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_IDResponse
Status: 200{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory item
Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Fine-grained access tokens for "Get an enterprise token inventory item"
This endpoint works with the following fine-grained token types:
The fine-grained token must have the following permission set:
- "Enterprise credentials" enterprise permissions (read)
Parameters for "Get an enterprise token inventory item"
| Name, Type, Description |
|---|
accept string Setting to |
| Name, Type, Description |
|---|
enterprise string RequiredThe slug version of the enterprise name. |
inventory_id string RequiredThe opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses. |
HTTP response status codes for "Get an enterprise token inventory item"
| Status code | Description |
|---|---|
200 | OK |
404 | Resource not found |
Code samples for "Get an enterprise token inventory item"
If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.
Request example
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_IDResponse
Status: 200{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
}