Sign in
enterprise-admin

List enterprise token inventory

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the Link header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the read:enterprise scope to access this endpoint.

get/enterprises/{enterprise}/credentials

Path parameters

enterprisestring required

The slug version of the enterprise name.

Query parameters

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

afterstring

A cursor, as given in the Link header, for the next page of results.

token_typesstring

A comma-separated list of credential types to filter by.

authorization_state'currently_authorized' | 'member_owned_only'

Filter by enterprise-access status.

ownerstring

Filter to credentials owned by this user, given as a login.

organizationstring

Filter to credentials authorized to this organization in the enterprise, given as a login.

applicationstring

Filter to credentials for this application, given as a GitHub App slug or an OAuth App client id.

Response

Response

inventory_idstring required

Opaque identifier for retrieving this item within the enterprise. Its value can differ between responses for the same credential.

credential_idinteger nullable

The credential's ID for audit-log correlation, unique only within its credential_type. Null for SSH keys, GitHub App installations, and federated credentials.

hashed_tokenstring nullable

Base64-encoded SHA-256 hash of the token, matching hashed_token in audit events. Null when not reported.

fingerprintstring nullable

The SSH key's SHA-256 fingerprint, matching audit events. Null for other credential types.

item_type'credential' | 'token_issuer_principal' required
credential_type'classic_pat' | 'oauth_app_user_token' | 'github_app_user_token' | 'fine_grained_pat' | 'ssh_key' | 'github_app_installation' | 'federated_jti' required
display_namestring nullable
owner_type'user' | 'oauth_application' | 'github_app' nullable

The type of credential owner.

credential_state'active' | 'expired' | 'revoked' | 'deleted' required
authorization_state'currently_authorized' | 'member_owned_only' required
effective_access_state'effective' | 'not_effective' | 'unknown' required
state_reasonstring nullable
created_atstring date-time nullable
last_used_atstring date-time nullable
expires_atstring date-time nullable
next_expires_atstring date-time nullable
credential_instance_countinteger nullable
enterprise_authorizedboolean required

Whether the item is authorized directly at the enterprise level.

authorization_countinteger required

Number of authorizing organizations, plus one when enterprise_authorized is true.

age_daysinteger nullable

Age of the credential in whole days at assembly time.

never_expiresboolean

Whether this is an active credential with no expiration. False for GitHub App installations and credentials with unknown expiration.

past_expiration_policyboolean nullable

Whether the credential exceeds a configured lifetime limit or an advisory age baseline. Null when not evaluated.

past_expiration_policy_basis'enforced_limit' | 'proposed_baseline' nullable

The basis for past_expiration_policy: an enforced PAT lifetime limit or an advisory age baseline.

expiry_unknownboolean

Whether the credential's expiration could not be determined.

scopesstring[] nullable

OAuth scopes recorded for the token. Null when not reported for the credential type.

permissionsobject nullable

Permissions by resource for fine-grained PATs and GitHub App installations. Null when not reported; an empty object means no recorded permissions.

repository_selection'all' | 'subset' | 'none' nullable

Repository selection for the credential. Null when not reported; none means no repositories are selected.

Changes