REST API endpoints for enterprise credential inventory
Use the REST API to list, inspect, and export credentials associated with your enterprise.
List enterprise token inventory
Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Tokens de acceso granulares para "List enterprise token inventory"
Este punto de conexión funciona con los siguientes tipos de token pormenorizados:
- tokens de acceso de usuario de la aplicación de GitHub
- Token de acceso a la instalación de la aplicación de GitHub
El token pormenorizado debe tener el siguiente conjunto de permisos:
- "Enterprise credentials" enterprise permissions (read)
Parámetros para "List enterprise token inventory"
| Nombre, Tipo, Descripción |
|---|
accept string Setting to |
| Nombre, Tipo, Descripción |
|---|
enterprise string ObligatorioThe slug version of the enterprise name. |
| Nombre, Tipo, Descripción |
|---|
per_page integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Valor predeterminado: |
after string A cursor, as given in the |
token_types string A comma-separated list of credential types to filter by. |
authorization_state string Filter by enterprise-access status. Puede ser uno de los siguientes: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
Códigos de estado de respuesta HTTP para "List enterprise token inventory"
| código de estado | Descripción |
|---|---|
200 | OK |
404 | Resource not found |
422 | Validation failed |
Ejemplos de código para "List enterprise token inventory"
Si accede a GitHub en GHE.com, reemplace api.github.com por el subdominio dedicado de la empresa en api.SUBDOMAIN.ghe.com.
Ejemplo de solicitud
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentialsResponse
Status: 200[
{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
"credential_id": 246810,
"hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "oauth_app_user_token",
"display_name": "Acme Deploy",
"owner": {
"id": 2,
"login": "hubot"
},
"owner_type": "user",
"application": {
"id": 42,
"name": "Acme Deploy"
},
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-03-10T14:00:00Z",
"last_used_at": "2024-06-02T08:15:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 2,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
},
{
"id": 11,
"login": "acme-ops"
}
],
"age_days": 83,
"never_expires": true,
"past_expiration_policy": false,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": [
"read:user",
"repo"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
"credential_id": null,
"hashed_token": null,
"fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
"item_type": "credential",
"credential_type": "ssh_key",
"display_name": "laptop-2024",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2023-11-01T10:00:00Z",
"last_used_at": "2024-05-20T16:45:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 213,
"never_expires": true,
"past_expiration_policy": true,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": null,
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
"credential_id": 135790,
"hashed_token": null,
"fingerprint": null,
"item_type": "credential",
"credential_type": "fine_grained_pat",
"display_name": "release-bot",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-05-01T10:00:00Z",
"last_used_at": "2024-06-03T16:45:00Z",
"expires_at": "2024-11-01T10:00:00Z",
"next_expires_at": "2024-11-01T10:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 45,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": null,
"permissions": {
"contents": "read",
"pull_requests": "write"
},
"repository_selection": "subset"
}
]Create an enterprise token inventory export
Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.
The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Tokens de acceso granulares para "Create an enterprise token inventory export"
Este punto de conexión funciona con los siguientes tipos de token pormenorizados:
- tokens de acceso de usuario de la aplicación de GitHub
- Token de acceso a la instalación de la aplicación de GitHub
El token pormenorizado debe tener el siguiente conjunto de permisos:
- "Enterprise credentials" enterprise permissions (read)
Parámetros para "Create an enterprise token inventory export"
| Nombre, Tipo, Descripción |
|---|
accept string Setting to |
| Nombre, Tipo, Descripción |
|---|
enterprise string ObligatorioThe slug version of the enterprise name. |
| Nombre, Tipo, Descripción |
|---|
token_types array of strings The credential types to include. |
authorization_state string Filter by enterprise-access status. Puede ser uno de los siguientes: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
Códigos de estado de respuesta HTTP para "Create an enterprise token inventory export"
| código de estado | Descripción |
|---|---|
202 | Accepted |
404 | Resource not found |
422 | Validation failed |
429 | Too many requests |
500 | Internal error, for example the export job could not be enqueued. |
Ejemplos de código para "Create an enterprise token inventory export"
Si accede a GitHub en GHE.com, reemplace api.github.com por el subdominio dedicado de la empresa en api.SUBDOMAIN.ghe.com.
Ejemplo de solicitud
curl -L \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
-d '{"owner":"octocat"}'Accepted
Status: 202{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory export
Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Tokens de acceso granulares para "Get an enterprise token inventory export"
Este punto de conexión funciona con los siguientes tipos de token pormenorizados:
- tokens de acceso de usuario de la aplicación de GitHub
- Token de acceso a la instalación de la aplicación de GitHub
El token pormenorizado debe tener el siguiente conjunto de permisos:
- "Enterprise credentials" enterprise permissions (read)
Parámetros para "Get an enterprise token inventory export"
| Nombre, Tipo, Descripción |
|---|
accept string Setting to |
| Nombre, Tipo, Descripción |
|---|
enterprise string ObligatorioThe slug version of the enterprise name. |
export_id string ObligatorioThe opaque id of the export, as returned when it was created. |
Códigos de estado de respuesta HTTP para "Get an enterprise token inventory export"
| código de estado | Descripción |
|---|---|
200 | OK |
302 | The export is ready; redirects to a short-lived download URL. |
404 | Resource not found |
Ejemplos de código para "Get an enterprise token inventory export"
Si accede a GitHub en GHE.com, reemplace api.github.com por el subdominio dedicado de la empresa en api.SUBDOMAIN.ghe.com.
Ejemplo de solicitud
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_IDResponse
Status: 200{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory item
Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Tokens de acceso granulares para "Get an enterprise token inventory item"
Este punto de conexión funciona con los siguientes tipos de token pormenorizados:
- tokens de acceso de usuario de la aplicación de GitHub
- Token de acceso a la instalación de la aplicación de GitHub
El token pormenorizado debe tener el siguiente conjunto de permisos:
- "Enterprise credentials" enterprise permissions (read)
Parámetros para "Get an enterprise token inventory item"
| Nombre, Tipo, Descripción |
|---|
accept string Setting to |
| Nombre, Tipo, Descripción |
|---|
enterprise string ObligatorioThe slug version of the enterprise name. |
inventory_id string ObligatorioThe opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses. |
Códigos de estado de respuesta HTTP para "Get an enterprise token inventory item"
| código de estado | Descripción |
|---|---|
200 | OK |
404 | Resource not found |
Ejemplos de código para "Get an enterprise token inventory item"
Si accede a GitHub en GHE.com, reemplace api.github.com por el subdominio dedicado de la empresa en api.SUBDOMAIN.ghe.com.
Ejemplo de solicitud
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_IDResponse
Status: 200{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
}