---
title: "Create an enterprise token inventory export"
method: POST
path: "/enterprises/{enterprise}/credentials/exports"
tags: ["enterprise-admin"]
---

# Create an enterprise token inventory export

`POST /enterprises/{enterprise}/credentials/exports`

Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day.

The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (`\n`) line endings. Timestamps are ISO-8601 in UTC (for example, `2026-09-15T12:00:00Z`). An empty cell means the value is null or unknown, never `false`. Multi-value cells join their entries with `; ` — this includes `scopes` and `permissions`, where each permission is encoded as a `resource:action` pair (for example, `contents:write; issues:read`). The file has one row per (credential, authorizing organization); the credential columns repeat while `organization_id` and `organization` vary, and a credential with no organization grant appears once with empty organization columns. `authorization_count` is the credential's total number of organization authorizations across the enterprise, plus one when `enterprise_authorized` is true, independent of any filters applied to the export. `credential_id` is a raw source-table id that can collide across credential types, so it is unique only together with `credential_type`, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by `fingerprint`, while GitHub App installations and federated JTIs have no unique per-row column. `owner_type` (`user`, `oauth_application`, or `github_app`) disambiguates the id space of `owner_id`. `expiry_status` is `expires`, `never`, or `unknown` — `unknown` marks a credential whose expiration could not be determined, so a blank `expires_at` is never mistaken for one that never expires.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the `read:enterprise` scope to access this endpoint.

## Path parameters

- `enterprise` string, required

## Request body

- object — Optional filters that scope the export to a subset of the inventory.
  - `token_types` string[] — The credential types to include.
  - `authorization_state` 'currently_authorized' | 'member_owned_only' — Filter by enterprise-access status.
  - `owner` string — Filter to credentials owned by this user, given as a login.
  - `organization` string — Filter to credentials authorized to this organization in the enterprise, given as a login.
  - `application` string — Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

## Response `202`

Accepted

- EnterpriseTokenInventoryExport — The status of an asynchronous enterprise token inventory CSV export.
  - `export_id` string, required — Opaque id for the export, used to poll its status.
  - `status` 'pending' | 'queued' | 'started' | 'success' | 'error', required — The state of the export job.
  - `as_of` string, nullable — When the export was requested.

## Other responses

- `404` — Resource not found
- `422` — Validation failed
- `429` — Too many requests
- `500` — Internal error, for example the export job could not be enqueued.

## Changes

- **2026-09-16** (2022-11-28) `a2954a79ff13` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/github/apis/enterprise-cloud/changes/enterprises/:enterprise/credentials/exports/post.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/668ad5094f58?raw)