GitHub v3 REST API

Remove a self-hosted runner from a group for an enterprise Removes a self-hosted runner from a group configured in an enterprise. The runner is then returned to the default group. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Revoke all credential authorizations for an enterprise Revokes all credential authorizations for all organizations within the enterprise. This includes any guest, outside, or repository collaborators. For Enterprise Managed User (EMU) enterprises, you can optionally also destroy all credentials (PATs v1, PATs v2, and SSH keys) owned by enterprise members by setting the `revoke_credentials` parameter to `true`. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint, that token may also be > revoked or destroyed as part of this operation. The authenticated user must be an enterprise owner or have the `write_enterprise_credentials` permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Remove all enterprise roles from a team Removes all assigned enterprise roles from a team in an enterprise. > [!WARNING] > This API is not available for Copilot Business for non-GHE. To use this endpoint, the authenticated user must be one of: - An administrator for the enterprise. - A user, or a user on a team, with the fine-grained permission `write_enterprise_custom_enterprise_role` in the enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Revoke credential authorizations for a user in an enterprise Revokes all credential authorizations for a single user within the enterprise. This includes any credential authorizations the user has across all organizations in the enterprise. For Enterprise Managed User (EMU) enterprises, you can optionally also destroy all credentials (PATs v1, PATs v2, and SSH keys) owned by the user by setting the `revoke_credentials` parameter to `true`. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint and target yourself, that > token may also be revoked or destroyed as part of this operation. The authenticated user must be an enterprise owner or have the `write_enterprise_credentials` permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Revoke a single credential type for an enterprise Revokes a single credential type (for example, classic personal access tokens) across all organizations within the enterprise. This removes the sign-in authorizations for that credential type for every member of the enterprise. For Enterprise Managed User (EMU) enterprises, you can optionally also destroy the actual credentials of that type owned by enterprise members by setting the `revoke_credentials` parameter to `true`. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint, that token may also be > revoked or destroyed as part of this operation. The authenticated user must be an enterprise owner or have the `write_enterprise_credentials` permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Revoke a single credential type for a user in an enterprise Revokes a single credential type (for example, classic personal access tokens) for a single user within the enterprise. This removes the sign-in authorizations for that credential type across all organizations in the enterprise for the user. For Enterprise Managed User (EMU) enterprises, you can optionally also destroy the actual credential of that type owned by the user by setting the `revoke_credentials` parameter to `true`. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint and target yourself, that > token may also be revoked or destroyed as part of this operation. The authenticated user must be an enterprise owner or have the `write_enterprise_credentials` permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Revoke enterprise-delegated credential authorizations Queues revocation of every active organization credential authorization created through enterprise delegation for the enterprise. Credential authorizations created through SAML or other flows are not affected. The authenticated GitHub App must be owned by the enterprise or one of its organizations, installed on the enterprise, and have the `enterprise_credentials:write` permission.

Remove an enterprise role from a team Removes an enterprise role from a team in an enterprise. > [!WARNING] > This API is not available for Copilot Business for non-GHE. To use this endpoint, the authenticated user must be one of: - An administrator for the enterprise. - A user, or a user on a team, with the fine-grained permission `write_enterprise_custom_enterprise_role` in the enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Set allowed actions and reusable workflows for an enterprise Sets the actions and reusable workflows that are allowed in an enterprise. To use this endpoint, the enterprise permission policy for `allowed_actions` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an enterprise](#set-github-actions-permissions-for-an-enterprise)." OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Set artifact and log retention settings for an enterprise Sets retention settings for checks, workflow runs, commit statuses, artifacts, and logs for an enterprise. Checks include check suites, check runs, and check annotations. These settings also apply to checks and commit statuses created by third-party integrations, and are not limited to data created by GitHub Actions.

Set custom labels for a self-hosted runner for an enterprise Remove all previous custom labels and set the new custom labels for a specific self-hosted runner configured in an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Set fork PR contributor approval permissions for an enterprise Sets the fork PR contributor approval policy for an enterprise.

Set GitHub Actions permissions for an enterprise Sets the GitHub Actions permissions policy for organizations and allowed actions and reusable workflows in an enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Set SCIM information for a provisioned enterprise group Replaces an existing provisioned group’s information. You must provide all the information required for the group as if you were provisioning it for the first time. Any existing group information that you don't provide will be removed, including group membership. If you want to only update a specific attribute, use the [Update an attribute for a SCIM enterprise group](#update-an-attribute-for-a-scim-enterprise-group) endpoint instead.

Set SCIM information for a provisioned enterprise user Replaces an existing provisioned user's information. You must supply complete user information, just as you would when provisioning them initially. Any previously existing data not provided will be deleted. To update only a specific attribute, refer to the [Update an attribute for a SCIM user](#update-an-attribute-for-a-scim-enterprise-user) endpoint. > [!WARNING] > Setting `active: false` will suspend a user. As a result, their handle and primary email address will be obfuscated. > > ``` >{ > "schemas": [ > "urn:ietf:params:scim:schemas:core:2.0:User" > ], > "externalId": "E012345", > "active": false, > "userName": "E012345", > "name": { > "familyName": "Octocat", > "givenName": "Mona", > "middleName": "Lisa" > }, > "displayName": "Mona Lisa", > "emails": [ > { > "value": "[email protected]", > "type": "work", > "primary": true > } > ], > "roles": [ > { > "value": "User" > } > ] >} > ```

Set organization access for a self-hosted runner group in an enterprise Replaces the list of organizations that have access to a self-hosted runner configured in an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Set private repo fork PR workflow settings for an enterprise Sets the settings for whether workflows from fork pull requests can run on private repositories in an enterprise.

Set selected organizations enabled for GitHub Actions in an enterprise Replaces the list of selected organizations that are enabled for GitHub Actions in an enterprise. To use this endpoint, the enterprise permission policy for `enabled_organizations` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an enterprise](#set-github-actions-permissions-for-an-enterprise)." OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Set self-hosted runners in a group for an enterprise Replaces the list of self-hosted runners that are part of an enterprise runner group. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Set self-hosted runners permissions for an enterprise Sets the settings for whether organizations in the enterprise are allowed to manage self-hosted runners at the repository level.

Sync innersource vulnerabilities for an enterprise Synchronize innersource vulnerability data with the Advisory Database for an enterprise. This endpoint receives vulnerability data in OSV format and creates, updates, or withdraws innersource vulnerabilities accordingly. Dependabot alerting is triggered for created and updated vulnerabilities. The request body accepts up to 100 vulnerabilities per call. The request is validated and then queued for asynchronous processing: a successful request returns `202 Accepted` with a `Location` header pointing to a status URL that you poll for the final result. Syncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see "[Rate limits for the API](https://docs.github.com/enterprise-cloud@latest/rest/using-the-rest-api/rate-limits-for-the-rest-api#about-secondary-rate-limits)" and "[Best practices for using the REST API](https://docs.github.com/enterprise-cloud@latest/rest/guides/best-practices-for-using-the-rest-api)." This endpoint does not support OAuth apps or personal access tokens.

Update an attribute for a SCIM enterprise group Update a provisioned group’s individual attributes. To modify a group's values, you'll need to use a specific Operations JSON format which must include at least one of the following operations: add, remove, or replace. For examples and more information on this SCIM format, consult the [SCIM specification](https://tools.ietf.org/html/rfc7644#section-3.5.2). The update function can also be used to add group memberships. You can submit group memberships individually or in batches for improved efficiency. > [!NOTE] > Memberships are referenced via a local user id. Ensure users are created before referencing them here.

Update an attribute for a SCIM enterprise user Update a provisioned user's individual attributes. To modify a user's attributes, you'll need to provide a `Operations` JSON formatted request that includes at least one of the following actions: add, remove, or replace. For specific examples and more information on the SCIM operations format, please refer to the [SCIM specification](https://tools.ietf.org/html/rfc7644#section-3.5.2). > [!NOTE] > Complex SCIM `path` selectors that include filters are not supported. For example, a `path` selector defined as `"path": "emails[type eq \"work\"]"` will be ineffective. > [!WARNING] > Setting `active: false` will suspend a user. As a result, their handle and primary email address will be obfuscated. > > ``` > { > "schemas": [ > "urn:ietf:params:scim:api:messages:2.0:PatchOp" > ], > "Operations": [ > { > "op": "replace", > "value": { > "active": false > } > } > ] > } > ```

Update an existing audit log stream configuration Updates an existing audit log stream configuration for an enterprise. Microsoft Agent 365 streams are configured through Microsoft Entra authorization. For those streams, this endpoint can only pause or resume the stream. Authorization-managed fields cannot be updated; delete and recreate the stream to change its Entra tenant or authorization. When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "[Encrypting secrets for the REST API](/rest/guides/encrypting-secrets-for-the-rest-api)."

Update a self-hosted runner group for an enterprise Updates the `name` and `visibility` of a self-hosted runner group in an enterprise. OAuth app tokens and personal access tokens (classic) need the `manage_runners:enterprise` scope to use this endpoint.

Add or update a Visual Studio subscription user match Updates a manual match between a user and a Visual Studio subscription.

Toggle installation repository access between selected and all repositories Toggle repository access for a GitHub App installation between all repositories and selected repositories. You must provide at least one repository when changing the access to 'selected'. If you change the access to 'all', the repositories list must not be provided. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Install a GitHub App on an enterprise-owned organization Installs any valid GitHub App on the specified organization owned by the enterprise. If the app is already installed on the organization, and is suspended, it will be unsuspended. If the app has a pending installation request, they will all be approved. If the app is already installed and has a pending update request, it will be updated to the latest version. If the app is now requesting repository permissions, it will be given access to the repositories listed in the request or fail if no `repository_selection` is provided. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Uninstall a GitHub App from an enterprise-owned organization Uninstall a GitHub App from an organization. Any app installed on the organization can be removed. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Grant repository access to an organization installation. You can add up to 50 repositories at a time. If the installation already has access to the repository, it will not be added again. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Get repositories belonging to an enterprise-owned organization List the repositories belonging to an enterprise-owned organization that can be made accessible to a GitHub App installed on that organization. This API provides a shallow list of repositories in the organization, allowing the caller to then add or remove those repositories to an installation in that organization. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Get enterprise-owned organizations that can have GitHub Apps installed List the organizations owned by the enterprise, intended for use by GitHub Apps that are managing applications across the enterprise. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Get the repositories accessible to a given GitHub App installation Lists the repositories accessible to a given GitHub App installation on an enterprise-owned organization. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

List GitHub Apps installed on an enterprise-owned organization Lists the GitHub App installations associated with the given enterprise-owned organization. This lists all GitHub Apps that have been installed on the organization, regardless of who owns the application. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Remove repository access from an organization installation Remove repository access from a GitHub App installed on an organization. You can remove up to 50 repositories at a time. You cannot remove repositories from an app installed on `all` repositories, nor can you remove the last repository for an app. If you attempt to do so, the API will return a 422 Unprocessable Entity error. This API can only be called by a GitHub App installed on the enterprise that owns the organization.

Add team member Add a team member to an enterprise team.

Bulk add team members Add multiple team members to an enterprise team.

Bulk remove team members Remove multiple team members from an enterprise team.

Get enterprise team membership Returns whether the user is a member of the enterprise team.

List members in an enterprise team Lists all team members in an enterprise team.

List enterprise teams for a user Lists all enterprise teams that a user is a member of. This endpoint is available only for enterprises using the new enterprise teams experience. The authenticated user must be an enterprise owner or have the `enterprise_teams:read` permission.

Remove team membership Remove membership of a specific user from a particular team in an enterprise.

Add an organization assignment Assign an enterprise team to an organization.

Add organization assignments Assign an enterprise team to multiple organizations.

Remove organization assignments Unassign an enterprise team from multiple organizations.

Delete an organization assignment Unassign an enterprise team from an organization.

Get organization assignment Check if an enterprise team is assigned to an organization

Get organization assignments Get all organizations assigned to an enterprise team

Create an enterprise team To create an enterprise team, the authenticated user must be an owner of the enterprise.

Delete an enterprise team To delete an enterprise team, the authenticated user must be an enterprise owner. If you are an enterprise owner, deleting an enterprise team will delete all of its IdP mappings as well.