REST API endpoints for enterprise credential inventory

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"List enterprise token inventory"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise credentials" enterprise permissions (read)

"List enterprise token inventory"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.

쿼리 매개 변수
이름, 유형, 설명
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." 기본값: `30`
`after` string A cursor, as given in the `Link` header, for the next page of results.
`token_types` string A comma-separated list of credential types to filter by.
`authorization_state` string Filter by enterprise-access status. 다음 중 하나일 수 있습니다.: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

"List enterprise token inventory"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`200`	OK
`404`	Resource not found
`422`	Validation failed

"List enterprise token inventory"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

get/enterprises/{enterprise}/credentials

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials

Response

Status: 200

[
  {
    "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
    "credential_id": 987654,
    "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "classic_pat",
    "display_name": "ci-automation",
    "owner": {
      "id": 1,
      "login": "octocat"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-01-15T09:00:00Z",
    "last_used_at": "2024-06-01T12:30:00Z",
    "expires_at": "2025-01-15T09:00:00Z",
    "next_expires_at": "2025-01-15T09:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 138,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": [
      "repo",
      "read:org"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
    "credential_id": 246810,
    "hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "oauth_app_user_token",
    "display_name": "Acme Deploy",
    "owner": {
      "id": 2,
      "login": "hubot"
    },
    "owner_type": "user",
    "application": {
      "id": 42,
      "name": "Acme Deploy"
    },
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-03-10T14:00:00Z",
    "last_used_at": "2024-06-02T08:15:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 2,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      },
      {
        "id": 11,
        "login": "acme-ops"
      }
    ],
    "age_days": 83,
    "never_expires": true,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": [
      "read:user",
      "repo"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
    "credential_id": null,
    "hashed_token": null,
    "fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
    "item_type": "credential",
    "credential_type": "ssh_key",
    "display_name": "laptop-2024",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2023-11-01T10:00:00Z",
    "last_used_at": "2024-05-20T16:45:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 213,
    "never_expires": true,
    "past_expiration_policy": true,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
    "credential_id": 135790,
    "hashed_token": null,
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "fine_grained_pat",
    "display_name": "release-bot",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-05-01T10:00:00Z",
    "last_used_at": "2024-06-03T16:45:00Z",
    "expires_at": "2024-11-01T10:00:00Z",
    "next_expires_at": "2024-11-01T10:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 45,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": {
      "contents": "read",
      "pull_requests": "write"
    },
    "repository_selection": "subset"
  }
]

Create an enterprise token inventory export

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Create an enterprise token inventory export"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise credentials" enterprise permissions (read)

"Create an enterprise token inventory export"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.

본문 매개 변수
이름, 유형, 설명
`token_types` array of strings The credential types to include.
`authorization_state` string Filter by enterprise-access status. 다음 중 하나일 수 있습니다.: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

"Create an enterprise token inventory export"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`202`	Accepted
`404`	Resource not found
`422`	Validation failed
`429`	Too many requests
`500`	Internal error, for example the export job could not be enqueued.

"Create an enterprise token inventory export"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

post/enterprises/{enterprise}/credentials/exports

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
  -d '{"owner":"octocat"}'

Accepted

Status: 202

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory export

Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Get an enterprise token inventory export"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise credentials" enterprise permissions (read)

"Get an enterprise token inventory export"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.
`export_id` string 필수 The opaque id of the export, as returned when it was created.

"Get an enterprise token inventory export"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`200`	OK
`302`	The export is ready; redirects to a short-lived download URL.
`404`	Resource not found

"Get an enterprise token inventory export"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

get/enterprises/{enterprise}/credentials/exports/{export_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_ID

Response

Status: 200

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory item

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

"Get an enterprise token inventory item"에 대한 세분화된 액세스 토큰

이 엔드포인트는 다음 세분화된 토큰 형식에서 작동합니다.:

세분화된 토큰은 필수 권한 집합을 포함해야 합니다.:

"Enterprise credentials" enterprise permissions (read)

"Get an enterprise token inventory item"에 대한 매개 변수

머리글
이름, 유형, 설명
`accept` string Setting to `application/vnd.github+json` is recommended.

경로 매개 변수
이름, 유형, 설명
`enterprise` string 필수 The slug version of the enterprise name.
`inventory_id` string 필수 The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

"Get an enterprise token inventory item"에 대한 HTTP 응답 상태 코드

상태 코드	설명
`200`	OK
`404`	Resource not found

"Get an enterprise token inventory item"에 대한 코드 샘플

GitHub에 GHE.com으로 액세스하는 경우, api.github.com를 api.SUBDOMAIN.ghe.com에 해당하는 귀하의 엔터프라이즈 전용 하위 도메인으로 교체하십시오.

요청 예제

get/enterprises/{enterprise}/credentials/{inventory_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_ID

Response

Status: 200

{
  "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
  "credential_id": 987654,
  "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
  "fingerprint": null,
  "item_type": "credential",
  "credential_type": "classic_pat",
  "display_name": "ci-automation",
  "owner": {
    "id": 1,
    "login": "octocat"
  },
  "owner_type": "user",
  "application": null,
  "credential_state": "active",
  "authorization_state": "currently_authorized",
  "effective_access_state": "effective",
  "state_reason": null,
  "created_at": "2024-01-15T09:00:00Z",
  "last_used_at": "2024-06-01T12:30:00Z",
  "expires_at": "2025-01-15T09:00:00Z",
  "next_expires_at": "2025-01-15T09:00:00Z",
  "credential_instance_count": 1,
  "enterprise_authorized": false,
  "authorization_count": 1,
  "authorized_organizations": [
    {
      "id": 10,
      "login": "acme-eng"
    }
  ],
  "age_days": 138,
  "never_expires": false,
  "past_expiration_policy": false,
  "past_expiration_policy_basis": "enforced_limit",
  "expiry_unknown": false,
  "scopes": [
    "repo",
    "read:org"
  ],
  "permissions": null,
  "repository_selection": null
}

REST API endpoints for enterprise credential inventory

List enterprise token inventory

"List enterprise token inventory"에 대한 세분화된 액세스 토큰

"List enterprise token inventory"에 대한 매개 변수

"List enterprise token inventory"에 대한 HTTP 응답 상태 코드

"List enterprise token inventory"에 대한 코드 샘플

요청 예제

Response

Create an enterprise token inventory export

"Create an enterprise token inventory export"에 대한 세분화된 액세스 토큰

"Create an enterprise token inventory export"에 대한 매개 변수

"Create an enterprise token inventory export"에 대한 HTTP 응답 상태 코드

"Create an enterprise token inventory export"에 대한 코드 샘플

요청 예제

Accepted

Get an enterprise token inventory export

"Get an enterprise token inventory export"에 대한 세분화된 액세스 토큰

"Get an enterprise token inventory export"에 대한 매개 변수

"Get an enterprise token inventory export"에 대한 HTTP 응답 상태 코드

"Get an enterprise token inventory export"에 대한 코드 샘플

요청 예제

Response

Get an enterprise token inventory item

"Get an enterprise token inventory item"에 대한 세분화된 액세스 토큰

"Get an enterprise token inventory item"에 대한 매개 변수

"Get an enterprise token inventory item"에 대한 HTTP 응답 상태 코드

"Get an enterprise token inventory item"에 대한 코드 샘플

요청 예제

Response

이 문서가 도움이 되었나요?

계속 도움이 필요하세요?