REST API endpoints for enterprise credential inventory

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"List enterprise token inventory" のきめ細かいアクセストークン

このエンドポイントは、次の粒度の細かいトークンの種類で動作します:

粒度の細かいトークンには次のアクセス許可セットが設定されている必要があります:

"Enterprise credentials" enterprise permissions (read)

"List enterprise token inventory" のパラメーター

ヘッダー
名前, タイプ, 説明
`accept` string Setting to `application/vnd.github+json` is recommended.

パスパラメーター
名前, タイプ, 説明
`enterprise` string 必須 The slug version of the enterprise name.

クエリパラメーター
名前, タイプ, 説明
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." デフォルト: `30`
`after` string A cursor, as given in the `Link` header, for the next page of results.
`token_types` string A comma-separated list of credential types to filter by.
`authorization_state` string Filter by enterprise-access status. 次のいずれかにできます: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

"List enterprise token inventory" の HTTP 応答状態コード

状態コード	説明
`200`	OK
`404`	Resource not found
`422`	Validation failed

"List enterprise token inventory" のコードサンプル

GHE.com でGitHubにアクセスする場合は、api.github.com を、api.SUBDOMAIN.ghe.com にある企業の専用サブドメインに置き換えます。

要求の例

get/enterprises/{enterprise}/credentials

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials

Response

Status: 200

[
  {
    "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
    "credential_id": 987654,
    "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "classic_pat",
    "display_name": "ci-automation",
    "owner": {
      "id": 1,
      "login": "octocat"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-01-15T09:00:00Z",
    "last_used_at": "2024-06-01T12:30:00Z",
    "expires_at": "2025-01-15T09:00:00Z",
    "next_expires_at": "2025-01-15T09:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 138,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": [
      "repo",
      "read:org"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
    "credential_id": 246810,
    "hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "oauth_app_user_token",
    "display_name": "Acme Deploy",
    "owner": {
      "id": 2,
      "login": "hubot"
    },
    "owner_type": "user",
    "application": {
      "id": 42,
      "name": "Acme Deploy"
    },
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-03-10T14:00:00Z",
    "last_used_at": "2024-06-02T08:15:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 2,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      },
      {
        "id": 11,
        "login": "acme-ops"
      }
    ],
    "age_days": 83,
    "never_expires": true,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": [
      "read:user",
      "repo"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
    "credential_id": null,
    "hashed_token": null,
    "fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
    "item_type": "credential",
    "credential_type": "ssh_key",
    "display_name": "laptop-2024",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2023-11-01T10:00:00Z",
    "last_used_at": "2024-05-20T16:45:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 213,
    "never_expires": true,
    "past_expiration_policy": true,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
    "credential_id": 135790,
    "hashed_token": null,
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "fine_grained_pat",
    "display_name": "release-bot",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-05-01T10:00:00Z",
    "last_used_at": "2024-06-03T16:45:00Z",
    "expires_at": "2024-11-01T10:00:00Z",
    "next_expires_at": "2024-11-01T10:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 45,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": {
      "contents": "read",
      "pull_requests": "write"
    },
    "repository_selection": "subset"
  }
]

Create an enterprise token inventory export

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Create an enterprise token inventory export" のきめ細かいアクセストークン

このエンドポイントは、次の粒度の細かいトークンの種類で動作します:

粒度の細かいトークンには次のアクセス許可セットが設定されている必要があります:

"Enterprise credentials" enterprise permissions (read)

"Create an enterprise token inventory export" のパラメーター

ヘッダー
名前, タイプ, 説明
`accept` string Setting to `application/vnd.github+json` is recommended.

パスパラメーター
名前, タイプ, 説明
`enterprise` string 必須 The slug version of the enterprise name.

ボディパラメータ
名前, タイプ, 説明
`token_types` array of strings The credential types to include.
`authorization_state` string Filter by enterprise-access status. 次のいずれかにできます: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

"Create an enterprise token inventory export" の HTTP 応答状態コード

状態コード	説明
`202`	Accepted
`404`	Resource not found
`422`	Validation failed
`429`	Too many requests
`500`	Internal error, for example the export job could not be enqueued.

"Create an enterprise token inventory export" のコードサンプル

GHE.com でGitHubにアクセスする場合は、api.github.com を、api.SUBDOMAIN.ghe.com にある企業の専用サブドメインに置き換えます。

要求の例

post/enterprises/{enterprise}/credentials/exports

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
  -d '{"owner":"octocat"}'

Accepted

Status: 202

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory export

Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Get an enterprise token inventory export" のきめ細かいアクセストークン

このエンドポイントは、次の粒度の細かいトークンの種類で動作します:

粒度の細かいトークンには次のアクセス許可セットが設定されている必要があります:

"Enterprise credentials" enterprise permissions (read)

"Get an enterprise token inventory export" のパラメーター

ヘッダー
名前, タイプ, 説明
`accept` string Setting to `application/vnd.github+json` is recommended.

パスパラメーター
名前, タイプ, 説明
`enterprise` string 必須 The slug version of the enterprise name.
`export_id` string 必須 The opaque id of the export, as returned when it was created.

"Get an enterprise token inventory export" の HTTP 応答状態コード

状態コード	説明
`200`	OK
`302`	The export is ready; redirects to a short-lived download URL.
`404`	Resource not found

"Get an enterprise token inventory export" のコードサンプル

GHE.com でGitHubにアクセスする場合は、api.github.com を、api.SUBDOMAIN.ghe.com にある企業の専用サブドメインに置き換えます。

要求の例

get/enterprises/{enterprise}/credentials/exports/{export_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_ID

Response

Status: 200

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory item

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Get an enterprise token inventory item" のきめ細かいアクセストークン

このエンドポイントは、次の粒度の細かいトークンの種類で動作します:

粒度の細かいトークンには次のアクセス許可セットが設定されている必要があります:

"Enterprise credentials" enterprise permissions (read)

"Get an enterprise token inventory item" のパラメーター

ヘッダー
名前, タイプ, 説明
`accept` string Setting to `application/vnd.github+json` is recommended.

パスパラメーター
名前, タイプ, 説明
`enterprise` string 必須 The slug version of the enterprise name.
`inventory_id` string 必須 The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

"Get an enterprise token inventory item" の HTTP 応答状態コード

状態コード	説明
`200`	OK
`404`	Resource not found

"Get an enterprise token inventory item" のコードサンプル

GHE.com でGitHubにアクセスする場合は、api.github.com を、api.SUBDOMAIN.ghe.com にある企業の専用サブドメインに置き換えます。

要求の例

get/enterprises/{enterprise}/credentials/{inventory_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_ID

Response

Status: 200

{
  "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
  "credential_id": 987654,
  "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
  "fingerprint": null,
  "item_type": "credential",
  "credential_type": "classic_pat",
  "display_name": "ci-automation",
  "owner": {
    "id": 1,
    "login": "octocat"
  },
  "owner_type": "user",
  "application": null,
  "credential_state": "active",
  "authorization_state": "currently_authorized",
  "effective_access_state": "effective",
  "state_reason": null,
  "created_at": "2024-01-15T09:00:00Z",
  "last_used_at": "2024-06-01T12:30:00Z",
  "expires_at": "2025-01-15T09:00:00Z",
  "next_expires_at": "2025-01-15T09:00:00Z",
  "credential_instance_count": 1,
  "enterprise_authorized": false,
  "authorization_count": 1,
  "authorized_organizations": [
    {
      "id": 10,
      "login": "acme-eng"
    }
  ],
  "age_days": 138,
  "never_expires": false,
  "past_expiration_policy": false,
  "past_expiration_policy_basis": "enforced_limit",
  "expiry_unknown": false,
  "scopes": [
    "repo",
    "read:org"
  ],
  "permissions": null,
  "repository_selection": null
}

REST API endpoints for enterprise credential inventory

List enterprise token inventory

"List enterprise token inventory" のきめ細かいアクセストークン

"List enterprise token inventory" のパラメーター

"List enterprise token inventory" の HTTP 応答状態コード

"List enterprise token inventory" のコードサンプル

要求の例

Response

Create an enterprise token inventory export

"Create an enterprise token inventory export" のきめ細かいアクセストークン

"Create an enterprise token inventory export" のパラメーター

"Create an enterprise token inventory export" の HTTP 応答状態コード

"Create an enterprise token inventory export" のコードサンプル

要求の例

Accepted

Get an enterprise token inventory export

"Get an enterprise token inventory export" のきめ細かいアクセストークン

"Get an enterprise token inventory export" のパラメーター

"Get an enterprise token inventory export" の HTTP 応答状態コード

"Get an enterprise token inventory export" のコードサンプル

要求の例

Response

Get an enterprise token inventory item

"Get an enterprise token inventory item" のきめ細かいアクセストークン

"Get an enterprise token inventory item" のパラメーター

"Get an enterprise token inventory item" の HTTP 応答状態コード

"Get an enterprise token inventory item" のコードサンプル

要求の例

Response

このドキュメントは役に立ちましたか?

まだ助けが必要ですか？