GitHub v3 REST API

List selected repositories for an organization secret Lists all repositories that have been selected when the `visibility` for repository access to a secret is set to `selected`. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove selected repository from an organization secret Removes a repository from an organization secret when the `visibility` for repository access is set to `selected`. The visibility is set when you [Create or update an organization secret](https://docs.github.com/enterprise-cloud@latest/rest/dependabot/secrets#create-or-update-an-organization-secret). OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Lists the repositories Dependabot can access in an enterprise Lists repositories that enterprise admins have allowed Dependabot to access when updating dependencies across organizations in the enterprise. The authenticated user must be an enterprise owner to use this endpoint. > [!NOTE] > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Lists the repositories Dependabot can access in an organization Lists repositories that organization admins have allowed Dependabot to access when updating dependencies. > [!NOTE] > This operation supports both server-to-server and user-to-server access. Unauthorized users will not see the existence of this endpoint.

Review a dismissal request for a Dependabot alert for a repository Approve or deny a dismissal request to dismiss a Dependabot alert in a repository. Delegated alert dismissal must be enabled on the repository and the user must be a dismissal reviewer to access this endpoint. OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint.

Set the default repository access level for Dependabot Sets the default level of repository access Dependabot will have while performing an update. Available values are: - 'public' - Dependabot will only have access to public repositories, unless access is explicitly granted to non-public repositories. - 'internal' - Dependabot will only have access to public and internal repositories, unless access is explicitly granted to private repositories. Unauthorized users will not see the existence of this endpoint. This operation supports both server-to-server and user-to-server access. OAuth app tokens and personal access tokens (classic) need the `write:org` scope to use this endpoint.

Set the default repository access level for Dependabot in an enterprise Sets the default level of repository access Dependabot will have while performing an update across organizations in the enterprise. Available values are: - 'public' - Dependabot will only have access to public repositories, unless access is explicitly granted to non-public repositories. - 'internal' - Dependabot will only have access to public and internal repositories, unless access is explicitly granted to private repositories. The authenticated user must be an enterprise owner to use this endpoint. > [!NOTE] > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Set selected repositories for an organization secret Replaces all repositories for an organization secret when the `visibility` for repository access is set to `selected`. The visibility is set when you [Create or update an organization secret](https://docs.github.com/enterprise-cloud@latest/rest/dependabot/secrets#create-or-update-an-organization-secret). OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Update a Dependabot alert The authenticated user must have access to security alerts for the repository to use this endpoint. For more information, see "[Granting access to security alerts](https://docs.github.com/enterprise-cloud@latest/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts)." OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the `public_repo` scope instead.

Updates Dependabot's repository access list for an enterprise Updates repositories according to the list of repositories that enterprise admins have given Dependabot access to when they've updated dependencies across organizations in the enterprise. The authenticated user must be an enterprise owner to use this endpoint. **Example request body:** ```json { "repository_ids_to_add": [123, 456], "repository_ids_to_remove": [789] } ``` > [!NOTE] > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Updates Dependabot's repository access list for an organization Updates repositories according to the list of repositories that organization admins have given Dependabot access to when they've updated dependencies. > [!NOTE] > This operation supports both server-to-server and user-to-server access. Unauthorized users will not see the existence of this endpoint. OAuth app tokens and personal access tokens (classic) need the `write:org` scope to use this endpoint. **Example request body:** ```json { "repository_ids_to_add": [123, 456], "repository_ids_to_remove": [789] } ```

Check license compliance for packages Checks whether packages identified by the supplied package URLs (PURLs) are allowed by the repository's license compliance policy. For requests made on behalf of a user, that user must have write access to the repository or the "View repository license policy" permission. OAuth apps and classic personal access tokens require the `repo` scope.

Create a snapshot of dependencies for a repository Create a new snapshot of a repository's dependencies. The authenticated user must have access to the repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Get a diff of the dependencies between commits Gets the diff of the dependency changes between two commits of a repository, based on the changes to the dependency manifests made in those commits.

Export a software bill of materials (SBOM) for a repository. > [!WARNING] > **Closing down notice:** This operation is closing down and will not be accessible after November 13, 2026. Please migrate to the asynchronous flow. Use "[Request generation of a software bill of materials (SBOM) for a repository](https://docs.github.com/enterprise-cloud@latest/rest/dependency-graph/sboms#request-generation-of-a-software-bill-of-materials-sbom-for-a-repository)" to trigger the report, then "[Fetch a software bill of materials (SBOM) for a repository](https://docs.github.com/enterprise-cloud@latest/rest/dependency-graph/sboms#fetch-a-software-bill-of-materials-sbom-for-a-repository)" to retrieve it. For more information, see the [changelog](https://github.blog/changelog/2026-05-12-synchronous-sbom-api-deprecated/). Exports the software bill of materials (SBOM) for a repository in SPDX JSON format.

Fetch a software bill of materials (SBOM) for a repository. Fetches a previously generated software bill of materials (SBOM) for a repository. When the SBOM is ready, the response is a 302 redirect to a temporary download URL for the SBOM in SPDX JSON format. The generated SBOM report may be retained for up to one week from the original request. The temporary download URL returned by this endpoint expires separately, and its expiry is set when the fetch request is made.

Request generation of a software bill of materials (SBOM) for a repository. Triggers a job to generate a software bill of materials (SBOM) for a repository in SPDX JSON format.

Get the license compliance policy for an enterprise Gets the license compliance policy for an enterprise. Currently, only the policy with the ID `default` is supported. The authenticated user must be an enterprise owner, or have the "View enterprise license policy" or "Edit enterprise license policy" fine-grained permission on the enterprise.

Set the license compliance policy for an enterprise Sets the license compliance policy for an enterprise. Currently, only the policy with the ID `default` is supported. The authenticated user must be an enterprise owner, or have the "Edit enterprise license policy" fine-grained permission on the enterprise.

Get emojis Lists all the emojis available to use on GitHub Enterprise Cloud.

Add custom labels to a self-hosted runner for an enterprise Add custom labels to a self-hosted runner configured in an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Add organization access to a self-hosted runner group in an enterprise Adds an organization to the list of selected organizations that can access a self-hosted runner group. The runner group must have `visibility` set to `selected`. For more information, see "[Create a self-hosted runner group for an enterprise](#create-a-self-hosted-runner-group-for-an-enterprise)." OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Add a self-hosted runner to a group for an enterprise Adds a self-hosted runner to a runner group configured in an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Assign an enterprise role to an enterprise user Assigns an enterprise role to a user in an enterprise. To use this endpoint, the authenticated user must be one of: - An administrator for the enterprise. - A user, or a user on a team, with the fine-grained permission `write_enterprise_custom_enterprise_role` in the enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Assign an enterprise role to a team Assigns an enterprise role to a team in an enterprise. > [!WARNING] > This API is not available for Copilot Business for non-GHE. To use this endpoint, the authenticated user must be one of: - An administrator for the enterprise. - A user, or a user on a team, with the fine-grained permission `write_enterprise_custom_enterprise_role` in the enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Create an audit log streaming configuration for an enterprise Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog. Microsoft Agent 365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings. When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)."

Create an enterprise token inventory export Starts an asynchronous CSV export of the enterprise token inventory and returns an opaque export id to poll. Limited to a small number of exports per enterprise per day. The generated file is UTF-8 CSV with a header row, using RFC 4180 field quoting and escaping and LF (`\n`) line endings. Timestamps are ISO-8601 in UTC (for example, `2026-09-15T12:00:00Z`). An empty cell means the value is null or unknown, never `false`. Multi-value cells join their entries with `; ` — this includes `scopes` and `permissions`, where each permission is encoded as a `resource:action` pair (for example, `contents:write; issues:read`). The file has one row per (credential, authorizing organization); the credential columns repeat while `organization_id` and `organization` vary, and a credential with no organization grant appears once with empty organization columns. `authorization_count` is the credential's total number of organization authorizations across the enterprise, plus one when `enterprise_authorized` is true, independent of any filters applied to the export. `credential_id` is a raw source-table id that can collide across credential types, so it is unique only together with `credential_type`, and only for the types that populate it (classic and fine-grained PATs, OAuth and GitHub App user tokens); SSH keys are keyed by `fingerprint`, while GitHub App installations and federated JTIs have no unique per-row column. `owner_type` (`user`, `oauth_application`, or `github_app`) disambiguates the id space of `owner_id`. `expiry_status` is `expires`, `never`, or `unknown` — `unknown` marks a credential whose expiration could not be determined, so a blank `expires_at` is never mistaken for one that never expires. You must be an enterprise owner (or hold a role with the "View enterprise credentials" permission) to use this endpoint. OAuth app tokens and personal access tokens (classic) require the `read:enterprise` scope to access this endpoint.

Create a registration token for an enterprise Returns a token that you can pass to the `config` script. The token expires after one hour. Example using registration token: Configure your self-hosted runner, replacing `TOKEN` with the registration token provided by this endpoint. ``` ./config.sh --url https://github.com/enterprises/octo-enterprise --token TOKEN ``` OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Create a remove token for an enterprise Returns a token that you can pass to the `config` script to remove a self-hosted runner from an enterprise. The token expires after one hour. Example using remove token: To remove your self-hosted runner from an enterprise, replace `TOKEN` with the remove token provided by this endpoint. ``` ./config.sh remove --token TOKEN ``` OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Create a self-hosted runner group for an enterprise Creates a new self-hosted runner group for an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Create or update an organization custom property definition on an enterprise Creates a new or updates an existing organization custom property definition that is defined on an enterprise. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `admin:enterprise` scope - Actors with the enterprise-level "manage enterprise custom properties for organizations" fine-grained permission

Create or update organization custom property definitions on an enterprise Creates new or updates existing organization custom properties defined on an enterprise in a batch. If the property already exists, the existing property will be replaced with the new values. Missing optional values will fall back to default values, previous values will be overwritten. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `admin:enterprise` scope - Actors with the enterprise-level "manage enterprise custom properties for organizations" fine-grained permission

Create or update custom property values for organizations in an enterprise. To remove a custom property value from an organization, set the property value to `null`. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `admin:enterprise` scope - Actors with the enterprise-level "edit enterprise custom properties for organizations" fine-grained permission or above

Remove an organization custom property definition from an enterprise Removes an organization custom property definition that is defined on an enterprise. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `admin:enterprise` scope - Actors with the enterprise-level "manage enterprise custom properties for organizations" fine-grained permission

Get an organization custom property definition from an enterprise Gets an organization custom property definition that is defined on an enterprise. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `read:enterprise` scope - Actors with the enterprise-level "read enterprise custom properties for organizations" fine-grained permission or above

Get organization custom properties schema for an enterprise Gets all organization custom property definitions that are defined on an enterprise. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `read:enterprise` scope - Actors with the enterprise-level "read enterprise custom properties for organizations" fine-grained permission or above

List custom property values for organizations in an enterprise Lists enterprise organizations with all of their custom property values. Access requirements: - Enterprise admins - OAuth tokens and personal access tokens (classic) with the `read:enterprise` scope - Actors with the enterprise-level "read enterprise custom properties for organizations" fine-grained permission or above

Create or update a custom property for an enterprise Creates a new or updates an existing custom property that is defined for an enterprise. To use this endpoint, the authenticated user must be an administrator for the enterprise.

Create or update custom properties for an enterprise Creates new or updates existing custom properties defined for an enterprise in a batch. If the property already exists, the existing property will be replaced with the new values. Missing optional values will fall back to default values, previous values will be overwritten. E.g. if a property exists with `values_editable_by: org_and_repo_actors` and it's updated without specifying `values_editable_by`, it will be updated to default value `org_actors`. To use this endpoint, the authenticated user must be an administrator for the enterprise.

Remove a custom property for an enterprise Remove a custom property that is defined for an enterprise. To use this endpoint, the authenticated user must be an administrator for the enterprise.

Get a custom property for an enterprise Gets a custom property that is defined for an enterprise. Enterprise members can read these properties.

Get custom properties for an enterprise Gets all custom properties defined for an enterprise. Enterprise members can read these properties.

Promote a custom property to an enterprise Promotes an existing organization custom property to an enterprise. To use this endpoint, the authenticated user must be an administrator for the enterprise.

Delete an audit log streaming configuration for an enterprise Deletes an existing audit log stream configuration for an enterprise. When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)."

Delete a SCIM group from an enterprise Deletes a SCIM group from an enterprise.

Delete a self-hosted runner from an enterprise Forces the removal of a self-hosted runner from an enterprise. You can use this endpoint to completely remove the runner when the machine you were using no longer exists. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Delete a self-hosted runner group from an enterprise Deletes a self-hosted runner group for an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Delete a SCIM user from an enterprise Suspends a SCIM user permanently from an enterprise. This action will: remove all the user's data, anonymize their login, email, and display name, erase all external identity SCIM attributes, delete the user's emails, avatar, PATs, SSH keys, OAuth authorizations, GPG keys, and SAML mappings. This action is irreversible.

Delete a Visual Studio subscription user match Deletes a manual match between a user and a Visual Studio subscription.

Disable access restrictions for an enterprise Disable access restriction by proxy header using the network proxy owned by the enterprise.