---
title: "Get an enterprise token inventory item"
method: GET
path: "/enterprises/{enterprise}/credentials/{inventory_id}"
tags: ["enterprise-admin"]
---

# Get an enterprise token inventory item

`GET /enterprises/{enterprise}/credentials/{inventory_id}`

Returns a single credential from the enterprise token inventory. Use the opaque `inventory_id` returned by the list endpoint for the same enterprise.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the `read:enterprise` scope to access this endpoint.

## Path parameters

- `enterprise` string, required
- `inventory_id` string, required

## Response `200`

Response

- EnterpriseTokenInventoryItem — A credential or GitHub App installation in an enterprise's token inventory.
  - `inventory_id` string, required — Opaque identifier for retrieving this item within the enterprise. Its value can differ between responses for the same credential.
  - `credential_id` integer, nullable — The credential's ID for audit-log correlation, unique only within its `credential_type`. Null for SSH keys, GitHub App installations, and federated credentials.
  - `hashed_token` string, nullable — Base64-encoded SHA-256 hash of the token, matching `hashed_token` in audit events. Null when not reported.
  - `fingerprint` string, nullable — The SSH key's SHA-256 fingerprint, matching audit events. Null for other credential types.
  - `item_type` 'credential' | 'token_issuer_principal', required
  - `credential_type` 'classic_pat' | 'oauth_app_user_token' | 'github_app_user_token' | 'fine_grained_pat' | 'ssh_key' | 'github_app_installation' | 'federated_jti', required
  - `display_name` string, nullable
  - `owner` object, nullable
    - `id` integer
    - `login` string
    - `name` string, nullable
  - `owner_type` 'user' | 'oauth_application' | 'github_app', nullable — The type of credential owner.
  - `application` object, nullable
    - `id` integer
    - `name` string, nullable
  - `credential_state` 'active' | 'expired' | 'revoked' | 'deleted', required
  - `authorization_state` 'currently_authorized' | 'member_owned_only', required
  - `effective_access_state` 'effective' | 'not_effective' | 'unknown', required
  - `state_reason` string, nullable
  - `created_at` string, date-time, nullable
  - `last_used_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `next_expires_at` string, date-time, nullable
  - `credential_instance_count` integer, nullable
  - `enterprise_authorized` boolean, required — Whether the item is authorized directly at the enterprise level.
  - `authorization_count` integer, required — Number of authorizing organizations, plus one when `enterprise_authorized` is true.
  - `authorized_organizations` object[], required
    - `id` integer
    - `login` string
  - `age_days` integer, nullable — Age of the credential in whole days at assembly time.
  - `never_expires` boolean — Whether this is an active credential with no expiration. False for GitHub App installations and credentials with unknown expiration.
  - `past_expiration_policy` boolean, nullable — Whether the credential exceeds a configured lifetime limit or an advisory age baseline. Null when not evaluated.
  - `past_expiration_policy_basis` 'enforced_limit' | 'proposed_baseline', nullable — The basis for `past_expiration_policy`: an enforced PAT lifetime limit or an advisory age baseline.
  - `expiry_unknown` boolean — Whether the credential's expiration could not be determined.
  - `scopes` string[], nullable — OAuth scopes recorded for the token. Null when not reported for the credential type.
  - `permissions` object, nullable — Permissions by resource for fine-grained PATs and GitHub App installations. Null when not reported; an empty object means no recorded permissions.
  - `repository_selection` 'all' | 'subset' | 'none', nullable — Repository selection for the credential. Null when not reported; `none` means no repositories are selected.

## Other responses

- `404` — Resource not found

## Changes

- **2026-09-14** (2026-03-10) `e8a2cc72c9b3` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/github/apis/enterprise-cloud/changes/enterprises/:enterprise/credentials/:inventory_id/get.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/f2fe1bb39903?raw)