REST API endpoints for enterprise credential inventory
Use the REST API to list, inspect, and export credentials associated with your enterprise.
List enterprise token inventory
Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
“List enterprise token inventory”的细粒度访问令牌
此端点支持以下精细令牌类型:
细粒度令牌必须具有以下权限集:
- "Enterprise credentials" enterprise permissions (read)
“”List enterprise token inventory 的参数
| 名称, 类型, 说明 |
|---|
accept string Setting to |
| 名称, 类型, 说明 |
|---|
enterprise string 必须The slug version of the enterprise name. |
| 名称, 类型, 说明 |
|---|
per_page integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." 默认: |
after string A cursor, as given in the |
token_types string A comma-separated list of credential types to filter by. |
authorization_state string Filter by enterprise-access status. 可以是以下选项之一: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
“List enterprise token inventory”的 HTTP 响应状态代码
| 状态代码 | 说明 |
|---|---|
200 | OK |
404 | Resource not found |
422 | Validation failed |
“List enterprise token inventory”的代码示例
如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。
请求示例
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentialsResponse
Status: 200[
{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
"credential_id": 246810,
"hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "oauth_app_user_token",
"display_name": "Acme Deploy",
"owner": {
"id": 2,
"login": "hubot"
},
"owner_type": "user",
"application": {
"id": 42,
"name": "Acme Deploy"
},
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-03-10T14:00:00Z",
"last_used_at": "2024-06-02T08:15:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 2,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
},
{
"id": 11,
"login": "acme-ops"
}
],
"age_days": 83,
"never_expires": true,
"past_expiration_policy": false,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": [
"read:user",
"repo"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
"credential_id": null,
"hashed_token": null,
"fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
"item_type": "credential",
"credential_type": "ssh_key",
"display_name": "laptop-2024",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2023-11-01T10:00:00Z",
"last_used_at": "2024-05-20T16:45:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 213,
"never_expires": true,
"past_expiration_policy": true,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": null,
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
"credential_id": 135790,
"hashed_token": null,
"fingerprint": null,
"item_type": "credential",
"credential_type": "fine_grained_pat",
"display_name": "release-bot",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-05-01T10:00:00Z",
"last_used_at": "2024-06-03T16:45:00Z",
"expires_at": "2024-11-01T10:00:00Z",
"next_expires_at": "2024-11-01T10:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 45,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": null,
"permissions": {
"contents": "read",
"pull_requests": "write"
},
"repository_selection": "subset"
}
]Create an enterprise token inventory export
Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.
The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
“Create an enterprise token inventory export”的细粒度访问令牌
此端点支持以下精细令牌类型:
细粒度令牌必须具有以下权限集:
- "Enterprise credentials" enterprise permissions (read)
“”Create an enterprise token inventory export 的参数
| 名称, 类型, 说明 |
|---|
accept string Setting to |
| 名称, 类型, 说明 |
|---|
enterprise string 必须The slug version of the enterprise name. |
| 名称, 类型, 说明 |
|---|
token_types array of strings The credential types to include. |
authorization_state string Filter by enterprise-access status. 可以是以下选项之一: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
“Create an enterprise token inventory export”的 HTTP 响应状态代码
| 状态代码 | 说明 |
|---|---|
202 | Accepted |
404 | Resource not found |
422 | Validation failed |
429 | Too many requests |
500 | Internal error, for example the export job could not be enqueued. |
“Create an enterprise token inventory export”的代码示例
如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。
请求示例
curl -L \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
-d '{"owner":"octocat"}'Accepted
Status: 202{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory export
Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
“Get an enterprise token inventory export”的细粒度访问令牌
此端点支持以下精细令牌类型:
细粒度令牌必须具有以下权限集:
- "Enterprise credentials" enterprise permissions (read)
“”Get an enterprise token inventory export 的参数
| 名称, 类型, 说明 |
|---|
accept string Setting to |
| 名称, 类型, 说明 |
|---|
enterprise string 必须The slug version of the enterprise name. |
export_id string 必须The opaque id of the export, as returned when it was created. |
“Get an enterprise token inventory export”的 HTTP 响应状态代码
| 状态代码 | 说明 |
|---|---|
200 | OK |
302 | The export is ready; redirects to a short-lived download URL. |
404 | Resource not found |
“Get an enterprise token inventory export”的代码示例
如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。
请求示例
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_IDResponse
Status: 200{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory item
Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
“Get an enterprise token inventory item”的细粒度访问令牌
此端点支持以下精细令牌类型:
细粒度令牌必须具有以下权限集:
- "Enterprise credentials" enterprise permissions (read)
“”Get an enterprise token inventory item 的参数
| 名称, 类型, 说明 |
|---|
accept string Setting to |
| 名称, 类型, 说明 |
|---|
enterprise string 必须The slug version of the enterprise name. |
inventory_id string 必须The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses. |
“Get an enterprise token inventory item”的 HTTP 响应状态代码
| 状态代码 | 说明 |
|---|---|
200 | OK |
404 | Resource not found |
“Get an enterprise token inventory item”的代码示例
如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。
请求示例
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_IDResponse
Status: 200{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
}