---
title: "List organization Actions policies"
method: GET
path: "/orgs/{org}/actions/policies"
tags: ["actions"]
---

# List organization Actions policies

`GET /orgs/{org}/actions/policies`

List all Actions policies for an organization.

## Path parameters

- `org` string, required

## Query parameters

- `per_page` integer
- `page` integer
- `has_parents` boolean

## Response `200`

Response

- object
  - `total_count` integer, required — The total number of Actions policies.
  - `policies` ActionsPolicy[], required — An array of Actions policies.
    - `id` integer, required — The ID of the policy
    - `name` string, required — The name of the policy
    - `target` 'actions', required — The target of the policy
    - `source_type` 'Repository' | 'Organization' | 'Enterprise', required — The type of the source of the policy
    - `source` string, required — The name of the source
    - `enforcement` 'disabled' | 'active' | 'evaluate', required — The enforcement level of the ruleset. `evaluate` allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (`evaluate` is only available with GitHub Enterprise).
    - `conditions` union — When workflow path targeting is available, detailed responses represent an omitted stored workflow condition as `workflow_path` with `include` set to `["~ALL"]` and `exclude` set to `[]`. When workflow path targeting is unavailable, an omitted stored condition remains omitted.
      - union — Conditions for a repository Actions policy. The object may be empty to preserve or use the default workflow targeting, or contain only `workflow_path`.
        - object
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `workflow_path` object, required
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
      - union — Conditions for an organization Actions policy. The conditions object should contain one of `repository_name`, `repository_id`, or `repository_property`, and may also contain `workflow_path`.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `repository_name` object, required
            - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories.
            - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.
            - `protected` boolean — Whether renaming of target repositories is prevented.
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `repository_id` object, required
            - `repository_ids` integer[] — The repository IDs that the ruleset applies to. One of these IDs must match for the condition to pass.
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `repository_property` object, required
            - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
      - union — Conditions for an enterprise Actions policy. The conditions object supports one organization target (`organization_name`, `organization_id`, or `organization_property`) combined with one repository target (`repository_name` or `repository_property`), and may also contain `workflow_path`.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_name` object, required
            - `include` string[] — Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all organizations and ~EMUS to target all enterprise managed user accounts.
            - `exclude` string[] — Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.
          - `repository_name` object, required
            - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories.
            - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.
            - `protected` boolean — Whether renaming of target repositories is prevented.
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_name` object, required
            - `include` string[] — Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all organizations and ~EMUS to target all enterprise managed user accounts.
            - `exclude` string[] — Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.
          - `repository_property` object, required
            - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_id` object, required
            - `organization_ids` integer[] — The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.
          - `repository_name` object, required
            - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories.
            - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.
            - `protected` boolean — Whether renaming of target repositories is prevented.
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_id` object, required
            - `organization_ids` integer[] — The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.
          - `repository_property` object, required
            - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_property` object, required
            - `include` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `repository_name` object, required
            - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories.
            - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.
            - `protected` boolean — Whether renaming of target repositories is prevented.
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
        - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.
          - `organization_property` object, required
            - `include` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `repository_property` object, required
            - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass.
              - …
            - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match.
              - …
          - `workflow_path` object
            - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns.
            - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array.
    - `rules` ActionsRule[] — An array of rules within the policy
      - union — An actions rule.
        - object — Choose specific actors that are authorized to trigger Actions workflows.
          - `type` 'restrict_actions_actors', required
          - `parameters` object
            - `allowed_actors` ActionsRuleParamsActor[], required — Select the actors who can run Actions workflows.
              - …
        - object — Choose specific GitHub events that will trigger Actions workflows.
          - `type` 'restrict_action_events', required
          - `parameters` object
            - `allowed_events` string[], required — Select the events that can trigger Actions workflows.
    - `node_id` string
    - `_links` object
      - `self` object
        - `href` string — The URL of the policy
      - `html` object
        - `href` string — The html URL of the policy
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `404` — Resource not found
- `500` — Internal Error

## Changes

- **2026-09-16** `953e0072aa36` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/github/apis/rest/changes/orgs/:org/actions/policies/get.md)

---

[API](https://skmtc.dev/github/apis/rest.md) · [All operations](https://skmtc.dev/github/apis/rest/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/rest/revisions/f2faaeb373ce?raw)