Points de terminaison d’API REST pour l’inventaire des informations d’identification d’entreprise
Utilisez l’API REST pour répertorier, inspecter et exporter les informations d’identification associées à votre entreprise.
List enterprise token inventory
Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Jetons d'accès granulaires pour «List enterprise token inventory»
Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:
- jetons d’accès utilisateur de l’application GitHub
- jetons d’accès d’installation de l’application GitHub
Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:
- "Enterprise credentials" enterprise permissions (read)
Paramètres pour «List enterprise token inventory »
| Nom, Type, Description |
|---|
accept string Setting to |
| Nom, Type, Description |
|---|
enterprise string RequisThe slug version of the enterprise name. |
| Nom, Type, Description |
|---|
per_page integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Par défaut: |
after string A cursor, as given in the |
token_types string A comma-separated list of credential types to filter by. |
authorization_state string Filter by enterprise-access status. Peut être l'un des: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
Codes d’état de réponse HTTP pour «List enterprise token inventory »
| Code de statut | Description |
|---|---|
200 | OK |
404 | Resource not found |
422 | Validation failed |
Exemples de code pour «List enterprise token inventory »
Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.
Exemple de requête
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentialsResponse
Status: 200[
{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
"credential_id": 246810,
"hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "oauth_app_user_token",
"display_name": "Acme Deploy",
"owner": {
"id": 2,
"login": "hubot"
},
"owner_type": "user",
"application": {
"id": 42,
"name": "Acme Deploy"
},
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-03-10T14:00:00Z",
"last_used_at": "2024-06-02T08:15:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 2,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
},
{
"id": 11,
"login": "acme-ops"
}
],
"age_days": 83,
"never_expires": true,
"past_expiration_policy": false,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": [
"read:user",
"repo"
],
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
"credential_id": null,
"hashed_token": null,
"fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
"item_type": "credential",
"credential_type": "ssh_key",
"display_name": "laptop-2024",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2023-11-01T10:00:00Z",
"last_used_at": "2024-05-20T16:45:00Z",
"expires_at": null,
"next_expires_at": null,
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 213,
"never_expires": true,
"past_expiration_policy": true,
"past_expiration_policy_basis": "proposed_baseline",
"expiry_unknown": false,
"scopes": null,
"permissions": null,
"repository_selection": null
},
{
"inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
"credential_id": 135790,
"hashed_token": null,
"fingerprint": null,
"item_type": "credential",
"credential_type": "fine_grained_pat",
"display_name": "release-bot",
"owner": {
"id": 3,
"login": "monalisa"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-05-01T10:00:00Z",
"last_used_at": "2024-06-03T16:45:00Z",
"expires_at": "2024-11-01T10:00:00Z",
"next_expires_at": "2024-11-01T10:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 45,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": null,
"permissions": {
"contents": "read",
"pull_requests": "write"
},
"repository_selection": "subset"
}
]Create an enterprise token inventory export
Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.
The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Jetons d'accès granulaires pour «Create an enterprise token inventory export»
Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:
- jetons d’accès utilisateur de l’application GitHub
- jetons d’accès d’installation de l’application GitHub
Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:
- "Enterprise credentials" enterprise permissions (read)
Paramètres pour «Create an enterprise token inventory export »
| Nom, Type, Description |
|---|
accept string Setting to |
| Nom, Type, Description |
|---|
enterprise string RequisThe slug version of the enterprise name. |
| Nom, Type, Description |
|---|
token_types array of strings The credential types to include. |
authorization_state string Filter by enterprise-access status. Peut être l'un des: |
owner string Filter to credentials owned by this user, given as a login. |
organization string Filter to credentials authorized to this organization in the enterprise, given as a login. |
application string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id. |
Codes d’état de réponse HTTP pour «Create an enterprise token inventory export »
| Code de statut | Description |
|---|---|
202 | Accepted |
404 | Resource not found |
422 | Validation failed |
429 | Too many requests |
500 | Internal error, for example the export job could not be enqueued. |
Exemples de code pour «Create an enterprise token inventory export »
Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.
Exemple de requête
curl -L \
-X POST \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
-d '{"owner":"octocat"}'Accepted
Status: 202{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory export
Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Jetons d'accès granulaires pour «Get an enterprise token inventory export»
Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:
- jetons d’accès utilisateur de l’application GitHub
- jetons d’accès d’installation de l’application GitHub
Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:
- "Enterprise credentials" enterprise permissions (read)
Paramètres pour «Get an enterprise token inventory export »
| Nom, Type, Description |
|---|
accept string Setting to |
| Nom, Type, Description |
|---|
enterprise string RequisThe slug version of the enterprise name. |
export_id string RequisThe opaque id of the export, as returned when it was created. |
Codes d’état de réponse HTTP pour «Get an enterprise token inventory export »
| Code de statut | Description |
|---|---|
200 | OK |
302 | The export is ready; redirects to a short-lived download URL. |
404 | Resource not found |
Exemples de code pour «Get an enterprise token inventory export »
Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.
Exemple de requête
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_IDResponse
Status: 200{
"export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
"status": "queued",
"as_of": "2026-07-30 21:00:00 UTC"
}Get an enterprise token inventory item
Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.
You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.
OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.
Jetons d'accès granulaires pour «Get an enterprise token inventory item»
Ce point de terminaison fonctionne avec les types de tokens à granularité fine suivants:
- jetons d’accès utilisateur de l’application GitHub
- jetons d’accès d’installation de l’application GitHub
Le token à granularité fine doit disposer de l’ensemble d’autorisations suivant:
- "Enterprise credentials" enterprise permissions (read)
Paramètres pour «Get an enterprise token inventory item »
| Nom, Type, Description |
|---|
accept string Setting to |
| Nom, Type, Description |
|---|
enterprise string RequisThe slug version of the enterprise name. |
inventory_id string RequisThe opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses. |
Codes d’état de réponse HTTP pour «Get an enterprise token inventory item »
| Code de statut | Description |
|---|---|
200 | OK |
404 | Resource not found |
Exemples de code pour «Get an enterprise token inventory item »
Si vous accédez à GitHub à GHE.com, remplacez api.github.com par le sous-domaine dédié de votre entreprise à api.SUBDOMAIN.ghe.com.
Exemple de requête
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2026-03-10" \
https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_IDResponse
Status: 200{
"inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
"credential_id": 987654,
"hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
"fingerprint": null,
"item_type": "credential",
"credential_type": "classic_pat",
"display_name": "ci-automation",
"owner": {
"id": 1,
"login": "octocat"
},
"owner_type": "user",
"application": null,
"credential_state": "active",
"authorization_state": "currently_authorized",
"effective_access_state": "effective",
"state_reason": null,
"created_at": "2024-01-15T09:00:00Z",
"last_used_at": "2024-06-01T12:30:00Z",
"expires_at": "2025-01-15T09:00:00Z",
"next_expires_at": "2025-01-15T09:00:00Z",
"credential_instance_count": 1,
"enterprise_authorized": false,
"authorization_count": 1,
"authorized_organizations": [
{
"id": 10,
"login": "acme-eng"
}
],
"age_days": 138,
"never_expires": false,
"past_expiration_policy": false,
"past_expiration_policy_basis": "enforced_limit",
"expiry_unknown": false,
"scopes": [
"repo",
"read:org"
],
"permissions": null,
"repository_selection": null
}