REST API endpoints for enterprise credential authorizations

Grant credential authorizations for enterprise organizations

Authorizes an existing user credential for selected organizations in an enterprise. Currently supports personal access tokens (classic) and user-owned SSH authentication keys. The authenticated GitHub App must be owned by the enterprise or an organization in the enterprise. The credential owner must be a member of every selected organization, and the enterprise must be configured with an enterprise-level SSO provider.

Credential authorizations remain active if the GitHub App is uninstalled or loses permission. They remain active until explicitly revoked, the credential is revoked or deleted, or the credential owner loses organization membership.

Fine-grained access tokens for "Grant credential authorizations for enterprise organizations"

This endpoint works with the following fine-grained token types:

GitHub App installation access tokens

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Grant credential authorizations for enterprise organizations"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Body parameters
Name, Type, Description
`credential_id` string Required The SHA-256 fingerprint of the user-owned SSH authentication key to authorize.
`credential_type` string Required Value: `ssh_key`
`organizations` array of strings Required Organization slugs within the enterprise. A maximum of 50 organizations can be specified.

HTTP response status codes for "Grant credential authorizations for enterprise organizations"

Status code	Description
`201`	Credential authorizations were granted.
`403`	Forbidden
`404`	Resource not found
`409`	Conflict. Returned when credential authorizations are being modified by another request.
`422`	Validation failed, or the endpoint has been spammed.

Code samples for "Grant credential authorizations for enterprise organizations"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request examples

Select the example type

post/enterprises/{enterprise}/credential-authorizations

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations \
  -d '{"credential_id":12345678,"credential_type":"classic_pat","organizations":["octo-org","octo-enterprise-org"]}'

Credential authorizations were granted.

Status: 201

{
  "credential_id": 12345678,
  "credential_type": "classic_pat",
  "organizations": [
    "octo-enterprise-org",
    "octo-org"
  ]
}

Revoke enterprise-delegated credential authorizations

Queues revocation of every active organization credential authorization created through enterprise delegation for the enterprise. Credential authorizations created through SAML or other flows are not affected.

The authenticated GitHub App must be owned by the enterprise or one of its organizations, installed on the enterprise, and have the enterprise_credentials:write permission.

Fine-grained access tokens for "Revoke enterprise-delegated credential authorizations"

This endpoint works with the following fine-grained token types:

GitHub App installation access tokens

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Revoke enterprise-delegated credential authorizations"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Query parameters
Name, Type, Description
`integration_id` integer The database ID of a GitHub App currently owned by the enterprise or one of its organizations, or a formerly owned GitHub App with delegation history for the enterprise. When provided, only credential authorizations delegated by that App are revoked. When omitted, all enterprise-delegated credential authorizations for the enterprise are revoked.

HTTP response status codes for "Revoke enterprise-delegated credential authorizations"

Status code	Description
`202`	Delegated credential authorization revocation was queued.
`403`	Forbidden
`404`	Resource not found

Code samples for "Revoke enterprise-delegated credential authorizations"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

delete/enterprises/{enterprise}/credential-authorizations

curl -L \
  -X DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations

Delegated credential authorization revocation was queued.

Status: 202

{
  "message": "Enterprise-delegated credential authorization revocation has been queued"
}

Revoke all credential authorizations for an enterprise

Revokes all credential authorizations for all organizations within the enterprise. This includes any guest, outside, or repository collaborators.

For Enterprise Managed User (EMU) enterprises, you can optionally also destroy all credentials (PATs v1, PATs v2, and SSH keys) owned by enterprise members by setting the revoke_credentials parameter to true.

This operation is performed asynchronously. A background job will be queued to process the revocations.

Warning

If you use a personal access token to call this endpoint, that token may also be revoked or destroyed as part of this operation.

The authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Revoke all credential authorizations for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Revoke all credential authorizations for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Body parameters
Name, Type, Description
`revoke_credentials` boolean Whether to also destroy the actual credentials (PATs and SSH keys) owned by enterprise members. This option is only available for Enterprise Managed User (EMU) enterprises. When set to `true`, all PATs (v1 and v2) and SSH keys owned by enterprise members will be destroyed in addition to the credential authorizations. Default: `false`

HTTP response status codes for "Revoke all credential authorizations for an enterprise"

Status code	Description
`202`	Accepted - The revocation request has been queued
`403`	Forbidden
`404`	Resource not found
`422`	Validation error - The `revoke_credentials` option is only available for EMU enterprises

Code samples for "Revoke all credential authorizations for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

post/enterprises/{enterprise}/credential-authorizations/revoke-all

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/revoke-all \
  -d '{"revoke_credentials":false}'

Accepted - The revocation request has been queued

Status: 202

{
  "message": "Credential authorization revocation has been queued"
}

Revoke a single credential type for an enterprise

Revokes a single credential type (for example, classic personal access tokens) across all organizations within the enterprise. This removes the sign-in authorizations for that credential type for every member of the enterprise.

For Enterprise Managed User (EMU) enterprises, you can optionally also destroy the actual credentials of that type owned by enterprise members by setting the revoke_credentials parameter to true.

This operation is performed asynchronously. A background job will be queued to process the revocations.

Warning

If you use a personal access token to call this endpoint, that token may also be revoked or destroyed as part of this operation.

The authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Revoke a single credential type for an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Revoke a single credential type for an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.

Body parameters
Name, Type, Description
`credential_type` string Required The type of credential to revoke across the enterprise. Can be one of: `classic_pat`, `fine_grained_pat`, `ssh_key`, `oauth_app_token`
`revoke_credentials` boolean Whether to also destroy the actual credentials of this type owned by enterprise members. This option is only available for Enterprise Managed User (EMU) enterprises. When set to `true`, all credentials of the given type owned by enterprise members will be destroyed in addition to the credential authorizations. Note that `oauth_app_token` credentials cannot be destroyed; for that type only the credential authorizations are revoked. Default: `false`

HTTP response status codes for "Revoke a single credential type for an enterprise"

Status code	Description
`202`	Accepted - The revocation request has been queued
`403`	Forbidden
`404`	Resource not found
`422`	Validation error - The `credential_type` is missing or invalid, or `revoke_credentials` is not available for this enterprise

Code samples for "Revoke a single credential type for an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

post/enterprises/{enterprise}/credential-authorizations/revoke-credential-type

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/revoke-credential-type \
  -d '{"credential_type":"classic_pat","revoke_credentials":false}'

Accepted - The revocation request has been queued

Status: 202

{
  "message": "Credential type revocation has been queued"
}

Revoke credential authorizations for a user in an enterprise

Revokes all credential authorizations for a single user within the enterprise. This includes any credential authorizations the user has across all organizations in the enterprise.

For Enterprise Managed User (EMU) enterprises, you can optionally also destroy all credentials (PATs v1, PATs v2, and SSH keys) owned by the user by setting the revoke_credentials parameter to true.

This operation is performed asynchronously. A background job will be queued to process the revocations.

Warning

If you use a personal access token to call this endpoint and target yourself, that token may also be revoked or destroyed as part of this operation.

The authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Revoke credential authorizations for a user in an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Revoke credential authorizations for a user in an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`username` string Required The handle for the GitHub user account.

Body parameters
Name, Type, Description
`revoke_credentials` boolean Whether to also destroy the actual credentials (PATs and SSH keys) owned by the user. This option is only available for Enterprise Managed User (EMU) enterprises. When set to `true`, all PATs (v1 and v2) and SSH keys owned by the user will be destroyed in addition to the credential authorizations. Default: `false`

HTTP response status codes for "Revoke credential authorizations for a user in an enterprise"

Status code	Description
`202`	Accepted - The revocation request has been queued
`403`	Forbidden
`404`	Resource not found
`422`	Validation error - The target user cannot be revoked, or `revoke_credentials` is not available for this enterprise

Code samples for "Revoke credential authorizations for a user in an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

post/enterprises/{enterprise}/credential-authorizations/{username}/revoke

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/USERNAME/revoke \
  -d '{"revoke_credentials":false}'

Accepted - The revocation request has been queued

Status: 202

{
  "message": "Credential authorization revocation for user 'octocat' has been queued"
}

Revoke a single credential type for a user in an enterprise

Revokes a single credential type (for example, classic personal access tokens) for a single user within the enterprise. This removes the sign-in authorizations for that credential type across all organizations in the enterprise for the user.

For Enterprise Managed User (EMU) enterprises, you can optionally also destroy the actual credential of that type owned by the user by setting the revoke_credentials parameter to true.

This operation is performed asynchronously. A background job will be queued to process the revocations.

Warning

If you use a personal access token to call this endpoint and target yourself, that token may also be revoked or destroyed as part of this operation.

The authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

Fine-grained access tokens for "Revoke a single credential type for a user in an enterprise"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Enterprise credentials" enterprise permissions (write)

Parameters for "Revoke a single credential type for a user in an enterprise"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`enterprise` string Required The slug version of the enterprise name.
`username` string Required The handle for the GitHub user account.

Body parameters
Name, Type, Description
`credential_type` string Required The type of credential to revoke for the user. Can be one of: `classic_pat`, `fine_grained_pat`, `ssh_key`, `oauth_app_token`
`revoke_credentials` boolean Whether to also destroy the actual credential of this type owned by the user. This option is only available for Enterprise Managed User (EMU) enterprises. When set to `true`, the credential of the given type owned by the user will be destroyed in addition to the credential authorizations. Note that `oauth_app_token` credentials cannot be destroyed; for that type only the credential authorizations are revoked. Default: `false`

HTTP response status codes for "Revoke a single credential type for a user in an enterprise"

Status code	Description
`202`	Accepted - The revocation request has been queued
`403`	Forbidden
`404`	Resource not found
`422`	Validation error - The `credential_type` is missing or invalid, the target user cannot be revoked, or `revoke_credentials` is not available for this enterprise

Code samples for "Revoke a single credential type for a user in an enterprise"

If you access GitHub at GHE.com, replace api.github.com with your enterprise's dedicated subdomain at api.SUBDOMAIN.ghe.com.

Request example

post/enterprises/{enterprise}/credential-authorizations/{username}/revoke-credential-type

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/USERNAME/revoke-credential-type \
  -d '{"credential_type":"classic_pat","revoke_credentials":false}'

Accepted - The revocation request has been queued

Status: 202

{
  "message": "Credential type revocation for user 'octocat' has been queued"
}