---
title: "List enterprise token inventory"
method: GET
path: "/enterprises/{enterprise}/credentials"
tags: ["enterprise-admin"]
---

# List enterprise token inventory

`GET /enterprises/{enterprise}/credentials`

Lists an enterprise's credential inventory: both credentials currently authorized to access the enterprise and credentials owned by enterprise members that have no current enterprise authorization. Covers personal access tokens (classic and fine-grained), OAuth App and GitHub App user tokens, SSH keys, GitHub App installations, and federated credentials, assembled on demand from the canonical sources. Results are paginated with an opaque cursor via the `Link` header; there is no total count.

You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint.

OAuth app tokens and personal access tokens (classic) require the `read:enterprise` scope to access this endpoint.

## Path parameters

- `enterprise` string, required

## Query parameters

- `per_page` integer
- `after` string
- `token_types` string
- `authorization_state` 'currently_authorized' | 'member_owned_only'
- `owner` string
- `organization` string
- `application` string

## Response `200`

Response

- EnterpriseTokenInventoryItem[]
  - `inventory_id` string, required — Opaque identifier for retrieving this item within the enterprise. Its value can differ between responses for the same credential.
  - `credential_id` integer, nullable — The credential's ID for audit-log correlation, unique only within its `credential_type`. Null for SSH keys, GitHub App installations, and federated credentials.
  - `hashed_token` string, nullable — Base64-encoded SHA-256 hash of the token, matching `hashed_token` in audit events. Null when not reported.
  - `fingerprint` string, nullable — The SSH key's SHA-256 fingerprint, matching audit events. Null for other credential types.
  - `item_type` 'credential' | 'token_issuer_principal', required
  - `credential_type` 'classic_pat' | 'oauth_app_user_token' | 'github_app_user_token' | 'fine_grained_pat' | 'ssh_key' | 'github_app_installation' | 'federated_jti', required
  - `display_name` string, nullable
  - `owner` object, nullable
    - `id` integer
    - `login` string
    - `name` string, nullable
  - `owner_type` 'user' | 'oauth_application' | 'github_app', nullable — The type of credential owner.
  - `application` object, nullable
    - `id` integer
    - `name` string, nullable
  - `credential_state` 'active' | 'expired' | 'revoked' | 'deleted', required
  - `authorization_state` 'currently_authorized' | 'member_owned_only', required
  - `effective_access_state` 'effective' | 'not_effective' | 'unknown', required
  - `state_reason` string, nullable
  - `created_at` string, date-time, nullable
  - `last_used_at` string, date-time, nullable
  - `expires_at` string, date-time, nullable
  - `next_expires_at` string, date-time, nullable
  - `credential_instance_count` integer, nullable
  - `enterprise_authorized` boolean, required — Whether the item is authorized directly at the enterprise level.
  - `authorization_count` integer, required — Number of authorizing organizations, plus one when `enterprise_authorized` is true.
  - `authorized_organizations` object[], required
    - `id` integer
    - `login` string
  - `age_days` integer, nullable — Age of the credential in whole days at assembly time.
  - `never_expires` boolean — Whether this is an active credential with no expiration. False for GitHub App installations and credentials with unknown expiration.
  - `past_expiration_policy` boolean, nullable — Whether the credential exceeds a configured lifetime limit or an advisory age baseline. Null when not evaluated.
  - `past_expiration_policy_basis` 'enforced_limit' | 'proposed_baseline', nullable — The basis for `past_expiration_policy`: an enforced PAT lifetime limit or an advisory age baseline.
  - `expiry_unknown` boolean — Whether the credential's expiration could not be determined.
  - `scopes` string[], nullable — OAuth scopes recorded for the token. Null when not reported for the credential type.
  - `permissions` object, nullable — Permissions by resource for fine-grained PATs and GitHub App installations. Null when not reported; an empty object means no recorded permissions.
  - `repository_selection` 'all' | 'subset' | 'none', nullable — Repository selection for the credential. Null when not reported; `none` means no repositories are selected.

## Other responses

- `404` — Resource not found
- `422` — Validation failed

## Changes

- **2026-09-14** (2026-03-10) `e8a2cc72c9b3` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/github/apis/enterprise-cloud/changes/enterprises/:enterprise/credentials/get.md)

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/f2fe1bb39903?raw)