REST API endpoints for enterprise credential inventory

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Детализированные токены доступа для «List enterprise token inventory»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

"Enterprise credentials" enterprise permissions (read)

Параметры для «List enterprise token inventory»

Заголовки
Имя., Тип, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Параметры пути
Имя., Тип, Description
`enterprise` string Обязательное поле The slug version of the enterprise name.

Параметры запроса
Имя., Тип, Description
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." По умолчанию.: `30`
`after` string A cursor, as given in the `Link` header, for the next page of results.
`token_types` string A comma-separated list of credential types to filter by.
`authorization_state` string Filter by enterprise-access status. Возможные значения: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

HTTP-коды статуса ответа для «List enterprise token inventory»

Код состояния	Description
`200`	OK
`404`	Resource not found
`422`	Validation failed

Примеры кода для «List enterprise token inventory»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/enterprises/{enterprise}/credentials

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials

Response

Status: 200

[
  {
    "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
    "credential_id": 987654,
    "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "classic_pat",
    "display_name": "ci-automation",
    "owner": {
      "id": 1,
      "login": "octocat"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-01-15T09:00:00Z",
    "last_used_at": "2024-06-01T12:30:00Z",
    "expires_at": "2025-01-15T09:00:00Z",
    "next_expires_at": "2025-01-15T09:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 138,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": [
      "repo",
      "read:org"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
    "credential_id": 246810,
    "hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "oauth_app_user_token",
    "display_name": "Acme Deploy",
    "owner": {
      "id": 2,
      "login": "hubot"
    },
    "owner_type": "user",
    "application": {
      "id": 42,
      "name": "Acme Deploy"
    },
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-03-10T14:00:00Z",
    "last_used_at": "2024-06-02T08:15:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 2,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      },
      {
        "id": 11,
        "login": "acme-ops"
      }
    ],
    "age_days": 83,
    "never_expires": true,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": [
      "read:user",
      "repo"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
    "credential_id": null,
    "hashed_token": null,
    "fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
    "item_type": "credential",
    "credential_type": "ssh_key",
    "display_name": "laptop-2024",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2023-11-01T10:00:00Z",
    "last_used_at": "2024-05-20T16:45:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 213,
    "never_expires": true,
    "past_expiration_policy": true,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
    "credential_id": 135790,
    "hashed_token": null,
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "fine_grained_pat",
    "display_name": "release-bot",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-05-01T10:00:00Z",
    "last_used_at": "2024-06-03T16:45:00Z",
    "expires_at": "2024-11-01T10:00:00Z",
    "next_expires_at": "2024-11-01T10:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 45,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": {
      "contents": "read",
      "pull_requests": "write"
    },
    "repository_selection": "subset"
  }
]

Create an enterprise token inventory export

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Детализированные токены доступа для «Create an enterprise token inventory export»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

"Enterprise credentials" enterprise permissions (read)

Параметры для «Create an enterprise token inventory export»

Заголовки
Имя., Тип, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Параметры пути
Имя., Тип, Description
`enterprise` string Обязательное поле The slug version of the enterprise name.

Параметры запроса
Имя., Тип, Description
`token_types` array of strings The credential types to include.
`authorization_state` string Filter by enterprise-access status. Возможные значения: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

HTTP-коды статуса ответа для «Create an enterprise token inventory export»

Код состояния	Description
`202`	Accepted
`404`	Resource not found
`422`	Validation failed
`429`	Too many requests
`500`	Internal error, for example the export job could not be enqueued.

Примеры кода для «Create an enterprise token inventory export»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

post/enterprises/{enterprise}/credentials/exports

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
  -d '{"owner":"octocat"}'

Accepted

Status: 202

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory export

Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Детализированные токены доступа для «Get an enterprise token inventory export»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

"Enterprise credentials" enterprise permissions (read)

Параметры для «Get an enterprise token inventory export»

Заголовки
Имя., Тип, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Параметры пути
Имя., Тип, Description
`enterprise` string Обязательное поле The slug version of the enterprise name.
`export_id` string Обязательное поле The opaque id of the export, as returned when it was created.

HTTP-коды статуса ответа для «Get an enterprise token inventory export»

Код состояния	Description
`200`	OK
`302`	The export is ready; redirects to a short-lived download URL.
`404`	Resource not found

Примеры кода для «Get an enterprise token inventory export»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/enterprises/{enterprise}/credentials/exports/{export_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_ID

Response

Status: 200

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory item

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Детализированные токены доступа для «Get an enterprise token inventory item»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

"Enterprise credentials" enterprise permissions (read)

Параметры для «Get an enterprise token inventory item»

Заголовки
Имя., Тип, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Параметры пути
Имя., Тип, Description
`enterprise` string Обязательное поле The slug version of the enterprise name.
`inventory_id` string Обязательное поле The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

HTTP-коды статуса ответа для «Get an enterprise token inventory item»

Код состояния	Description
`200`	OK
`404`	Resource not found

Примеры кода для «Get an enterprise token inventory item»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/enterprises/{enterprise}/credentials/{inventory_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_ID

Response

Status: 200

{
  "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
  "credential_id": 987654,
  "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
  "fingerprint": null,
  "item_type": "credential",
  "credential_type": "classic_pat",
  "display_name": "ci-automation",
  "owner": {
    "id": 1,
    "login": "octocat"
  },
  "owner_type": "user",
  "application": null,
  "credential_state": "active",
  "authorization_state": "currently_authorized",
  "effective_access_state": "effective",
  "state_reason": null,
  "created_at": "2024-01-15T09:00:00Z",
  "last_used_at": "2024-06-01T12:30:00Z",
  "expires_at": "2025-01-15T09:00:00Z",
  "next_expires_at": "2025-01-15T09:00:00Z",
  "credential_instance_count": 1,
  "enterprise_authorized": false,
  "authorization_count": 1,
  "authorized_organizations": [
    {
      "id": 10,
      "login": "acme-eng"
    }
  ],
  "age_days": 138,
  "never_expires": false,
  "past_expiration_policy": false,
  "past_expiration_policy_basis": "enforced_limit",
  "expiry_unknown": false,
  "scopes": [
    "repo",
    "read:org"
  ],
  "permissions": null,
  "repository_selection": null
}

REST API endpoints for enterprise credential inventory

List enterprise token inventory

Детализированные токены доступа для «List enterprise token inventory»

Параметры для «List enterprise token inventory»

HTTP-коды статуса ответа для «List enterprise token inventory»

Примеры кода для «List enterprise token inventory»

Пример запроса

Response

Create an enterprise token inventory export

Детализированные токены доступа для «Create an enterprise token inventory export»

Параметры для «Create an enterprise token inventory export»

HTTP-коды статуса ответа для «Create an enterprise token inventory export»

Примеры кода для «Create an enterprise token inventory export»

Пример запроса

Accepted

Get an enterprise token inventory export

Детализированные токены доступа для «Get an enterprise token inventory export»

Параметры для «Get an enterprise token inventory export»

HTTP-коды статуса ответа для «Get an enterprise token inventory export»

Примеры кода для «Get an enterprise token inventory export»

Пример запроса

Response

Get an enterprise token inventory item

Детализированные токены доступа для «Get an enterprise token inventory item»

Параметры для «Get an enterprise token inventory item»

HTTP-коды статуса ответа для «Get an enterprise token inventory item»

Примеры кода для «Get an enterprise token inventory item»

Пример запроса

Response

Была ли эта документация полезной?

По-прежнему нужна помощь?