REST-API-Endpunkte für den Bestand von Unternehmensanmeldeinformationen

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Feinkörnige Zugriffstoken für "List enterprise token inventory"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss über den folgenden Berechtigungssatz verfügen.:

"Enterprise credentials" enterprise permissions (read)

Parameter für "List enterprise token inventory"

Header
Name, Typ, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, Typ, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name.

Abfrageparameter
Name, Typ, BESCHREIBUNG
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Standard: `30`
`after` string A cursor, as given in the `Link` header, for the next page of results.
`token_types` string A comma-separated list of credential types to filter by.
`authorization_state` string Filter by enterprise-access status. Kann eine der folgenden sein: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

HTTP-Antwortstatuscodes für "List enterprise token inventory"

Statuscode	BESCHREIBUNG
`200`	OK
`404`	Resource not found
`422`	Validation failed

Codebeispiele für "List enterprise token inventory"

Wenn Sie bei GHE.com auf GitHub zugreifen, ersetzen Sie api.github.com durch die dedizierte Unterdomäne Ihres Unternehmens unter api.SUBDOMAIN.ghe.com.

Anforderungsbeispiel

get/enterprises/{enterprise}/credentials

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials

Response

Status: 200

[
  {
    "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
    "credential_id": 987654,
    "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "classic_pat",
    "display_name": "ci-automation",
    "owner": {
      "id": 1,
      "login": "octocat"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-01-15T09:00:00Z",
    "last_used_at": "2024-06-01T12:30:00Z",
    "expires_at": "2025-01-15T09:00:00Z",
    "next_expires_at": "2025-01-15T09:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 138,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": [
      "repo",
      "read:org"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "ZmVkY2JhOTg3NjU0MzIxMA",
    "credential_id": 246810,
    "hashed_token": "B4iMbnUY6xW/eOlR2nDqA9pKz3sVt1cX8mZ0jL5wQpE=",
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "oauth_app_user_token",
    "display_name": "Acme Deploy",
    "owner": {
      "id": 2,
      "login": "hubot"
    },
    "owner_type": "user",
    "application": {
      "id": 42,
      "name": "Acme Deploy"
    },
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-03-10T14:00:00Z",
    "last_used_at": "2024-06-02T08:15:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 2,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      },
      {
        "id": 11,
        "login": "acme-ops"
      }
    ],
    "age_days": 83,
    "never_expires": true,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": [
      "read:user",
      "repo"
    ],
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "c3NoLWtleS1leGFtcGxlLTAwMQ",
    "credential_id": null,
    "hashed_token": null,
    "fingerprint": "SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8",
    "item_type": "credential",
    "credential_type": "ssh_key",
    "display_name": "laptop-2024",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2023-11-01T10:00:00Z",
    "last_used_at": "2024-05-20T16:45:00Z",
    "expires_at": null,
    "next_expires_at": null,
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 213,
    "never_expires": true,
    "past_expiration_policy": true,
    "past_expiration_policy_basis": "proposed_baseline",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": null,
    "repository_selection": null
  },
  {
    "inventory_id": "YWJjZGVmMDEyMzQ1Njc4OQ",
    "credential_id": 135790,
    "hashed_token": null,
    "fingerprint": null,
    "item_type": "credential",
    "credential_type": "fine_grained_pat",
    "display_name": "release-bot",
    "owner": {
      "id": 3,
      "login": "monalisa"
    },
    "owner_type": "user",
    "application": null,
    "credential_state": "active",
    "authorization_state": "currently_authorized",
    "effective_access_state": "effective",
    "state_reason": null,
    "created_at": "2024-05-01T10:00:00Z",
    "last_used_at": "2024-06-03T16:45:00Z",
    "expires_at": "2024-11-01T10:00:00Z",
    "next_expires_at": "2024-11-01T10:00:00Z",
    "credential_instance_count": 1,
    "enterprise_authorized": false,
    "authorization_count": 1,
    "authorized_organizations": [
      {
        "id": 10,
        "login": "acme-eng"
      }
    ],
    "age_days": 45,
    "never_expires": false,
    "past_expiration_policy": false,
    "past_expiration_policy_basis": "enforced_limit",
    "expiry_unknown": false,
    "scopes": null,
    "permissions": {
      "contents": "read",
      "pull_requests": "write"
    },
    "repository_selection": "subset"
  }
]

Create an enterprise token inventory export

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (\n) line endings. Timestamps are ISO-8601 in UTC (for example, 2026-09-15T12:00:00Z). An empty cell means the value is null or unknown, never false. Multi-value cells join their entries with ; — this includes scopes and permissions, where each permission is encoded as a resource:action pair (for example, contents:write; issues:read). The file has one row per (credential, authorizing organization); the credential columns repeat while organization_id and organization vary, and a credential with no organization grant appears once with empty organization columns. authorization_count is the credential's total number of organization authorizations across the enterprise, plus one when enterprise_authorized is true, independent of any filters applied to the export. credential_id is a raw source-table id that can collide across credential types, so it is unique only together with credential_type, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by fingerprint, while GitHub App installations and federated JTIs have no unique per-row column. owner_type (user, oauth_application, or github_app) disambiguates the id space of owner_id. expiry_status is expires, never, or unknown — unknown marks a credential whose expiration could not be determined, so a blank expires_at is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Feinkörnige Zugriffstoken für "Create an enterprise token inventory export"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss über den folgenden Berechtigungssatz verfügen.:

"Enterprise credentials" enterprise permissions (read)

Parameter für "Create an enterprise token inventory export"

Header
Name, Typ, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, Typ, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name.

Körperparameter
Name, Typ, BESCHREIBUNG
`token_types` array of strings The credential types to include.
`authorization_state` string Filter by enterprise-access status. Kann eine der folgenden sein: `currently_authorized`, `member_owned_only`
`owner` string Filter to credentials owned by this user, given as a login.
`organization` string Filter to credentials authorized to this organization in the enterprise, given as a login.
`application` string Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

HTTP-Antwortstatuscodes für "Create an enterprise token inventory export"

Statuscode	BESCHREIBUNG
`202`	Accepted
`404`	Resource not found
`422`	Validation failed
`429`	Too many requests
`500`	Internal error, for example the export job could not be enqueued.

Codebeispiele für "Create an enterprise token inventory export"

Wenn Sie bei GHE.com auf GitHub zugreifen, ersetzen Sie api.github.com durch die dedizierte Unterdomäne Ihres Unternehmens unter api.SUBDOMAIN.ghe.com.

Anforderungsbeispiel

post/enterprises/{enterprise}/credentials/exports

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports \
  -d '{"owner":"octocat"}'

Accepted

Status: 202

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory export

Returns the status of an enterprise token inventory export. Once the export is ready this redirects to a short-lived URL to download the CSV.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Feinkörnige Zugriffstoken für "Get an enterprise token inventory export"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss über den folgenden Berechtigungssatz verfügen.:

"Enterprise credentials" enterprise permissions (read)

Parameter für "Get an enterprise token inventory export"

Header
Name, Typ, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, Typ, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name.
`export_id` string Erforderlich The opaque id of the export, as returned when it was created.

HTTP-Antwortstatuscodes für "Get an enterprise token inventory export"

Statuscode	BESCHREIBUNG
`200`	OK
`302`	The export is ready; redirects to a short-lived download URL.
`404`	Resource not found

Codebeispiele für "Get an enterprise token inventory export"

Wenn Sie bei GHE.com auf GitHub zugreifen, ersetzen Sie api.github.com durch die dedizierte Unterdomäne Ihres Unternehmens unter api.SUBDOMAIN.ghe.com.

Anforderungsbeispiel

get/enterprises/{enterprise}/credentials/exports/{export_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/exports/EXPORT_ID

Response

Status: 200

{
  "export_id": "7b99499081e815c76d819dabdab70202df7fa01adf9a84803ca43963edb6a507",
  "status": "queued",
  "as_of": "2026-07-30 21:00:00 UTC"
}

Get an enterprise token inventory item

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

Feinkörnige Zugriffstoken für "Get an enterprise token inventory item"

Dieser Endpunkt funktioniert mit den folgenden differenzierten Tokentypen.:

Das differenzierte Token muss über den folgenden Berechtigungssatz verfügen.:

"Enterprise credentials" enterprise permissions (read)

Parameter für "Get an enterprise token inventory item"

Header
Name, Typ, BESCHREIBUNG
`accept` string Setting to `application/vnd.github+json` is recommended.

Pfadparameter
Name, Typ, BESCHREIBUNG
`enterprise` string Erforderlich The slug version of the enterprise name.
`inventory_id` string Erforderlich The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

HTTP-Antwortstatuscodes für "Get an enterprise token inventory item"

Statuscode	BESCHREIBUNG
`200`	OK
`404`	Resource not found

Codebeispiele für "Get an enterprise token inventory item"

Wenn Sie bei GHE.com auf GitHub zugreifen, ersetzen Sie api.github.com durch die dedizierte Unterdomäne Ihres Unternehmens unter api.SUBDOMAIN.ghe.com.

Anforderungsbeispiel

get/enterprises/{enterprise}/credentials/{inventory_id}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credentials/INVENTORY_ID

Response

Status: 200

{
  "inventory_id": "MDEyMzQ1Njc4OWFiY2RlZg",
  "credential_id": 987654,
  "hashed_token": "K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols=",
  "fingerprint": null,
  "item_type": "credential",
  "credential_type": "classic_pat",
  "display_name": "ci-automation",
  "owner": {
    "id": 1,
    "login": "octocat"
  },
  "owner_type": "user",
  "application": null,
  "credential_state": "active",
  "authorization_state": "currently_authorized",
  "effective_access_state": "effective",
  "state_reason": null,
  "created_at": "2024-01-15T09:00:00Z",
  "last_used_at": "2024-06-01T12:30:00Z",
  "expires_at": "2025-01-15T09:00:00Z",
  "next_expires_at": "2025-01-15T09:00:00Z",
  "credential_instance_count": 1,
  "enterprise_authorized": false,
  "authorization_count": 1,
  "authorized_organizations": [
    {
      "id": 10,
      "login": "acme-eng"
    }
  ],
  "age_days": 138,
  "never_expires": false,
  "past_expiration_policy": false,
  "past_expiration_policy_basis": "enforced_limit",
  "expiry_unknown": false,
  "scopes": [
    "repo",
    "read:org"
  ],
  "permissions": null,
  "repository_selection": null
}

REST-API-Endpunkte für den Bestand von Unternehmensanmeldeinformationen

List enterprise token inventory

Feinkörnige Zugriffstoken für "List enterprise token inventory"

Parameter für "List enterprise token inventory"

HTTP-Antwortstatuscodes für "List enterprise token inventory"

Codebeispiele für "List enterprise token inventory"

Anforderungsbeispiel

Response

Create an enterprise token inventory export

Feinkörnige Zugriffstoken für "Create an enterprise token inventory export"

Parameter für "Create an enterprise token inventory export"

HTTP-Antwortstatuscodes für "Create an enterprise token inventory export"

Codebeispiele für "Create an enterprise token inventory export"

Anforderungsbeispiel

Accepted

Get an enterprise token inventory export

Feinkörnige Zugriffstoken für "Get an enterprise token inventory export"

Parameter für "Get an enterprise token inventory export"

HTTP-Antwortstatuscodes für "Get an enterprise token inventory export"

Codebeispiele für "Get an enterprise token inventory export"

Anforderungsbeispiel

Response

Get an enterprise token inventory item

Feinkörnige Zugriffstoken für "Get an enterprise token inventory item"

Parameter für "Get an enterprise token inventory item"

HTTP-Antwortstatuscodes für "Get an enterprise token inventory item"

Codebeispiele für "Get an enterprise token inventory item"

Anforderungsbeispiel

Response

War dieses Dokument hilfreich?

Benötigst du weitere Hilfe?