GIgithub
enterprise-admin

Get an enterprise token inventory item

Changed on

[!WARNING] Closing down notice: This operation is closing down and will be removed on October 2, 2026. Please migrate to the asynchronous export: use "Create an enterprise token inventory export" to start a CSV export, optionally scoped with filters such as owner or application, then "Get an enterprise token inventory export" to download it. For more information, see the changelog.

Returns a single credential from the enterprise token inventory. Use the opaque inventory_id returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

get/enterprises/{enterprise}/credentials/{inventory_id}

Request

  • Base URL
    https://api.github.com
  • URL
    https://api.github.com/enterprises/{enterprise}/credentials/{inventory_id}
  • Auth
    none declared

Path parameters

enterprisestring required

The slug version of the enterprise name.

inventory_idstring required

The opaque inventory_id returned by the list endpoint for this enterprise. Pass it unchanged. Its value can differ for the same credential between responses.

Response

Response

inventory_idstring required

Opaque identifier for retrieving this item within the enterprise. Its value can differ between responses for the same credential.

credential_idinteger nullable

The credential's ID for audit-log correlation, unique only within its credential_type. Null for SSH keys, GitHub App installations, and federated credentials.

hashed_tokenstring nullable

Base64-encoded SHA-256 hash of the token, matching hashed_token in audit events. Null when not reported.

fingerprintstring nullable

The SSH key's SHA-256 fingerprint, matching audit events. Null for other credential types.

item_type'credential' | 'token_issuer_principal' required
credential_type'classic_pat' | 'oauth_app_user_token' | 'github_app_user_token' | 'fine_grained_pat' | 'ssh_key' | 'github_app_installation' | 'federated_jti' required
display_namestring nullable
owner_type'user' | 'oauth_application' | 'github_app' nullable

The type of credential owner.

credential_state'active' | 'expired' | 'revoked' | 'deleted' required
authorization_state'currently_authorized' | 'member_owned_only' required
effective_access_state'effective' | 'not_effective' | 'unknown' required
state_reasonstring nullable
created_atstring date-time nullable
last_used_atstring date-time nullable
expires_atstring date-time nullable
next_expires_atstring date-time nullable
credential_instance_countinteger nullable
enterprise_authorizedboolean required

Whether the item is authorized directly at the enterprise level.

authorization_countinteger required

Number of authorizing organizations, plus one when enterprise_authorized is true.

age_daysinteger nullable

Age of the credential in whole days at assembly time.

never_expiresboolean

Whether this is an active credential with no expiration. False for GitHub App installations and credentials with unknown expiration.

past_expiration_policyboolean nullable

Whether the credential exceeds a configured lifetime limit or an advisory age baseline. Null when not evaluated.

past_expiration_policy_basis'enforced_limit' | 'proposed_baseline' nullable

The basis for past_expiration_policy: an enforced PAT lifetime limit or an advisory age baseline.

expiry_unknownboolean

Whether the credential's expiration could not be determined.

scopesstring[] nullable

OAuth scopes recorded for the token. Null when not reported for the credential type.

permissionsobject nullable

Permissions by resource for fine-grained PATs and GitHub App installations. Null when not reported; an empty object means no recorded permissions.

repository_selection'all' | 'subset' | 'none' nullable

Repository selection for the credential. Null when not reported; none means no repositories are selected.

Changes