REST API endpoints for enterprise credential inventory

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Tokens de acesso granulares para "List enterprise token inventory"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

"Enterprise credentials" enterprise permissions (read)

Parâmetros para "List enterprise token inventory"

Cabeçalhos
Nome, Tipo, Descrição
`accept` string Setting to `application/vnd.github+json` is recommended.

Parâmetros de caminho
Nome, Tipo, Descrição
`enterprise` string Obrigatório The slug version of the enterprise name.

Parâmetros de consulta
Nome, Tipo, Descrição
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Padrão: `30`
`after` string A cursor, as given in the `Link` header, for the next page of results.
`token_types` string A comma-separated list of credential types to filter by.
`authorization_state` string Filter by enterprise-access status. Pode ser um dos: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

Códigos de status de resposta HTTP para "List enterprise token inventory"

Código de status	Descrição
`200`	OK
`404`	Resource not found
`422`	Validation failed

Exemplos de código para "List enterprise token inventory"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

get/enterprises/{enterprise}/credentials

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials

Response

Status: 200

[
  {
    "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
    "credential_id": 987654,
    "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "classic_pat",
    "display_name": "ci-automation",
    "owner": {
      "id": 1,
      "login": "octocat"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-01-15T09:00:00Z",
    "last_used_at": "2024-06-01T12:30:00Z",
    "expires_at": "2025-01-15T09:00:00Z",
    "next_expires_at": "2025-01-15T09:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 138,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": [
      "repo",
      "read:org"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
    "credential_id": 246810,
    "hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "oauth_app_user_token",
    "display_name": "Acme Deploy",
    "owner": {
      "id": 2,
      "login": "hubot"
    },
    "owner_type": "user",
    "application": {
      "id": 42,
      "name": "Acme Deploy"
    },
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-03-10T14:00:00Z",
    "last_used_at": "2024-06-02T08:15:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 2,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      },
      {
        "id": 11,
        "login": "acme-ops"
      }
    ],
    "age_days": 83,
    "never_expires": true,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": [
      "read:user",
      "repo"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
    "credential_id": null,
    "hashed_token": null,
    "fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
    "item_type": "credential",
    "credential_type": "ssh_key",
    "display_name": "laptop-2024",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2023-11-01T10:00:00Z",
    "last_used_at": "2024-05-20T16:45:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 213,
    "never_expires": true,
    "past_expiration_policy": true,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
    "credential_id": 135790,
    "hashed_token": null,
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "fine_grained_pat",
    "display_name": "release-bot",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-05-01T10:00:00Z",
    "last_used_at": "2024-06-03T16:45:00Z",
    "expires_at": "2024-11-01T10:00:00Z",
    "next_expires_at": "2024-11-01T10:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 45,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": {
      "contents": "read",
      "pull_requests": "write"
    },
    "repository_selection": "subset"
  }
]

Create an enterprise token inventory export

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Tokens de acesso granulares para "Create an enterprise token inventory export"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

"Enterprise credentials" enterprise permissions (read)

Parâmetros para "Create an enterprise token inventory export"

Cabeçalhos
Nome, Tipo, Descrição
`accept` string Setting to `application/vnd.github+json` is recommended.

Parâmetros de caminho
Nome, Tipo, Descrição
`enterprise` string Obrigatório The slug version of the enterprise name.

Parâmetros do corpo
Nome, Tipo, Descrição
`token_types` array of strings The credential types to include.
`authorization_state` string Filter by enterprise-access status. Pode ser um dos: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

Códigos de status de resposta HTTP para "Create an enterprise token inventory export"

Código de status	Descrição
`202`	Accepted
`404`	Resource not found
`422`	Validation failed
`429`	Too many requests
`500`	Internal error, for example the export job could not be enqueued.

Exemplos de código para "Create an enterprise token inventory export"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

post/enterprises/{enterprise}/credentials/exports

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
  -d '{"owner":"octocat"}'

Accepted

Status: 202

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory export

Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Tokens de acesso granulares para "Get an enterprise token inventory export"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

"Enterprise credentials" enterprise permissions (read)

Parâmetros para "Get an enterprise token inventory export"

Cabeçalhos
Nome, Tipo, Descrição
`accept` string Setting to `application/vnd.github+json` is recommended.

Parâmetros de caminho
Nome, Tipo, Descrição
`enterprise` string Obrigatório The slug version of the enterprise name.
`export_id` string Obrigatório The opaque id of the export, as returned when it was created.

Códigos de status de resposta HTTP para "Get an enterprise token inventory export"

Código de status	Descrição
`200`	OK
`302`	The export is ready; redirects to a short-lived download URL.
`404`	Resource not found

Exemplos de código para "Get an enterprise token inventory export"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

get/enterprises/{enterprise}/credentials/exports/{export_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_ID

Response

Status: 200

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory item

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Tokens de acesso granulares para "Get an enterprise token inventory item"

Este endpoint funciona com os seguintes tipos de token granulares:

O token refinado deve ter os seguintes conjuntos de permissões:

"Enterprise credentials" enterprise permissions (read)

Parâmetros para "Get an enterprise token inventory item"

Cabeçalhos
Nome, Tipo, Descrição
`accept` string Setting to `application/vnd.github+json` is recommended.

Parâmetros de caminho
Nome, Tipo, Descrição
`enterprise` string Obrigatório The slug version of the enterprise name.
`inventory_id` string Obrigatório The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

Códigos de status de resposta HTTP para "Get an enterprise token inventory item"

Código de status	Descrição
`200`	OK
`404`	Resource not found

Exemplos de código para "Get an enterprise token inventory item"

Se você acessar GitHub em GHE.com, substitua api.github.com pelo subdomínio dedicado da sua empresa em api.SUBDOMAIN.ghe.com.

Exemplo de solicitação

get/enterprises/{enterprise}/credentials/{inventory_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_ID

Response

Status: 200

{
  "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
  "credential_id": 987654,
  "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
  "fingerprint": null,
  "item_type": "credential",
  "credential_type": "classic_pat",
  "display_name": "ci-automation",
  "owner": {
    "id": 1,
    "login": "octocat"
  },
  "owner_type": "user",
  "application": null,
  "credential_state": "active",
  "authorization_state": "currently_authorized",
  "effective_access_state": "effective",
  "state_reason": null,
  "created_at": "2024-01-15T09:00:00Z",
  "last_used_at": "2024-06-01T12:30:00Z",
  "expires_at": "2025-01-15T09:00:00Z",
  "next_expires_at": "2025-01-15T09:00:00Z",
  "credential_instance_count": 1,
  "enterprise_authorized": false,
  "authorization_count": 1,
  "authorized_organizations": [
    {
      "id": 10,
      "login": "acme-eng"
    }
  ],
  "age_days": 138,
  "never_expires": false,
  "past_expiration_policy": false,
  "past_expiration_policy_basis": "enforced_limit",
  "expiry_unknown": false,
  "scopes": [
    "repo",
    "read:org"
  ],
  "permissions": null,
  "repository_selection": null
}

REST API endpoints for enterprise credential inventory

List enterprise token inventory

Tokens de acesso granulares para "List enterprise token inventory"

Parâmetros para "List enterprise token inventory"

Códigos de status de resposta HTTP para "List enterprise token inventory"

Exemplos de código para "List enterprise token inventory"

Exemplo de solicitação

Response

Create an enterprise token inventory export

Tokens de acesso granulares para "Create an enterprise token inventory export"

Parâmetros para "Create an enterprise token inventory export"

Códigos de status de resposta HTTP para "Create an enterprise token inventory export"

Exemplos de código para "Create an enterprise token inventory export"

Exemplo de solicitação

Accepted

Get an enterprise token inventory export

Tokens de acesso granulares para "Get an enterprise token inventory export"

Parâmetros para "Get an enterprise token inventory export"

Códigos de status de resposta HTTP para "Get an enterprise token inventory export"

Exemplos de código para "Get an enterprise token inventory export"

Exemplo de solicitação

Response

Get an enterprise token inventory item

Tokens de acesso granulares para "Get an enterprise token inventory item"

Parâmetros para "Get an enterprise token inventory item"

Códigos de status de resposta HTTP para "Get an enterprise token inventory item"

Exemplos de código para "Get an enterprise token inventory item"

Exemplo de solicitação

Response

Este documento foi útil?

Ainda precisa de ajuda?