GitHub v3 REST API

Get all organization roles for an organization Lists the organization roles available in this organization. For more information on organization roles, see "[Using organization roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles)." To use this endpoint, the authenticated user must be one of: - An administrator for the organization. - An organization member (or a member of a team) assigned a custom organization role that includes the **View organization roles** (`read_organization_custom_org_role`) permission. For more information, see "[Permissions for organization access](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-custom-organization-roles#permissions-for-organization-access)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

List organization fine-grained permissions for an organization Lists the fine-grained permissions that can be used in custom organization roles for an organization. For more information, see "[Managing people's access to your organization with roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles)." To list the fine-grained permissions that can be used in custom repository roles for an organization, see "[List repository fine-grained permissions for an organization](https://docs.github.com/enterprise-cloud@latest/rest/orgs/organization-roles#list-repository-fine-grained-permissions-for-an-organization)." To use this endpoint, the authenticated user must be one of: - An administrator for the organization. - An organization member (or a member of a team) assigned a custom organization role that includes the **View organization roles** (`read_organization_custom_org_role`) permission. For more information, see "[Permissions for organization access](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-custom-organization-roles#permissions-for-organization-access)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

List outside collaborators for an organization List all users who are outside collaborators of an organization.

List repositories a fine-grained personal access token has access to Lists the repositories a fine-grained personal access token has access to. Only GitHub Apps can use this endpoint.

List repositories requested to be accessed by a fine-grained personal access token Lists the repositories a fine-grained personal access token request is requesting access to. Only GitHub Apps can use this endpoint.

List requests to access organization resources with fine-grained personal access tokens Lists requests from organization members to access organization resources with a fine-grained personal access token. Only GitHub Apps can use this endpoint.

List fine-grained personal access tokens with access to organization resources Lists approved fine-grained personal access tokens owned by organization members that can access organization resources. Only GitHub Apps can use this endpoint.

List pending organization invitations The return hash contains a `role` field which refers to the Organization Invitation role and will be one of the following values: `direct_member`, `admin`, `billing_manager`, or `hiring_manager`. If the invitee is not a GitHub Enterprise Cloud member, the `login` field in the return hash will be `null`. This endpoint is not available for [Enterprise Managed User (EMU) organizations](https://docs.github.com/enterprise-cloud@latest/admin/identity-and-access-management/using-enterprise-managed-users-for-iam/about-enterprise-managed-users).

List public organization members Members of an organization can choose to have their membership publicized or not.

List push rule bypass requests within an organization Lists the requests made by users of a repository to bypass push protection rules within an organization.

List repository fine-grained permissions for an organization Lists the fine-grained permissions that can be used in custom repository roles for an organization. For more information, see "[About custom repository roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-repository-roles)." The authenticated user must be an administrator of the organization or of a repository of the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` or `repo` scope to use this endpoint.

List SAML SSO authorizations for an organization Lists all credential authorizations for an organization that uses SAML single sign-on (SSO). The credentials can be personal access tokens, SSH keys, OAuth app access tokens, or user-to-server tokens from GitHub Apps that organization members have authorized for the organization. For more information, see [About authentication with SAML single sign-on](https://docs.github.com/enterprise-cloud@latest/articles/about-authentication-with-saml-single-sign-on). The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.

List security manager teams > [!WARNING] > **Closing down notice:** This operation is closing down and will be removed starting January 1, 2026. Please use the "[Organization Roles](https://docs.github.com/enterprise-cloud@latest/rest/orgs/organization-roles)" endpoints instead.

List deliveries for an organization webhook You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.

List organization webhooks You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.

Update a custom organization role Updates an existing custom organization role. Permission changes will apply to all assignees. For more information on custom organization roles, see "[Managing people's access to your organization with roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles)." If the update would add repository permissions, the `base_role` must also be set to a value besides `none`, either previously or as part of the update. If the update sets the `base_role` field to `none`, you must also remove all of the repository permissions as well, otherwise the update will fail. To use this endpoint, the authenticated user must be one of: - An administrator for the organization. - An organization member (or a member of a team) assigned a custom organization role that includes the **Manage custom organization roles** (`write_organization_custom_org_role`) permission. For more information, see "[Permissions for organization access](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-custom-organization-roles#permissions-for-organization-access)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Ping an organization webhook You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.

Redeliver a delivery for an organization webhook You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.

Remove an organization member Removing a user from this list will remove them from all teams and they will no longer have any access to the organization's repositories. > [!NOTE] > If a user has both direct membership in the organization as well as indirect membership via an enterprise team, only their direct membership will be removed. Their indirect membership via an enterprise team remains until the user is removed from the enterprise team.

Remove organization membership for a user In order to remove a user's membership with an organization, the authenticated user must be an organization owner. If the specified user is an active member of the organization, this will remove them from the organization. If the specified user has been invited to the organization, this will cancel their invitation. The specified user will receive an email notification in both cases. > [!NOTE] > If a user has both direct membership in the organization as well as indirect membership via an enterprise team, only their direct membership will be removed. Their indirect membership via an enterprise team remains until the user is removed from the enterprise team.

Remove outside collaborator from an organization Removing a user from this list will remove them from all the organization's repositories.

Remove public organization membership for the authenticated user Removes the public membership for the authenticated user from the specified organization, unless public visibility is enforced by default.

Remove a SAML SSO authorization for an organization Removes a credential authorization for an organization that uses SAML SSO. The credential can be a personal access token, an SSH key, an OAuth app access token, or a user-to-server token from a GitHub App. Once you remove someone's credential authorization, they will need to authorize the credential again for the organization they want to access. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove a security manager team > [!WARNING] > **Closing down notice:** This operation is closing down and will be removed starting January 1, 2026. Please use the "[Organization Roles](https://docs.github.com/enterprise-cloud@latest/rest/orgs/organization-roles)" endpoints instead.

Review a request to access organization resources with a fine-grained personal access token Approves or denies a pending request to access organization resources via a fine-grained personal access token. Only GitHub Apps can use this endpoint.

Review requests to access organization resources with fine-grained personal access tokens Approves or denies multiple pending requests to access organization resources via a fine-grained personal access token. Only GitHub Apps can use this endpoint.

Revoke all credential authorizations for an organization Revokes all SAML SSO credential authorizations for every member of the organization. This removes the sign-in authorizations for personal access tokens, SSH keys, OAuth app tokens, and user-to-server tokens that members have authorized for the organization. Members will need to authorize their credentials again to access the organization. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint, that token's > authorization for the organization may also be revoked as part of this operation. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove all organization roles for a team Removes all assigned organization roles from a team. For more information on organization roles, see "[Using organization roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove all organization roles for a user Revokes all assigned organization roles from a user. For more information on organization roles, see "[Using organization roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Revoke credential authorizations for a user in an organization Revokes all SAML SSO credential authorizations for a single user within the organization. This removes the sign-in authorizations for the user's personal access tokens, SSH keys, OAuth app tokens, and user-to-server tokens that they have authorized for the organization. The user will need to authorize their credentials again to access the organization. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint and target yourself, > that token's authorization for the organization may also be revoked as part of > this operation. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Revoke a single credential type for an organization Revokes a single credential type (for example, classic personal access tokens) across the organization. This removes the sign-in authorizations for that credential type for every member of the organization. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint and revoke classic > personal access tokens, that token's authorization for the organization may > also be revoked as part of this operation. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Revoke a single credential type for a user in an organization Revokes a single credential type (for example, classic personal access tokens) for a single user within the organization. This removes the sign-in authorizations for that credential type for the user in the organization. This operation is performed asynchronously. A background job will be queued to process the revocations. > [!WARNING] > If you use a personal access token to call this endpoint, target yourself, and > revoke classic personal access tokens, that token's authorization for the > organization may also be revoked as part of this operation. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove an organization role from a team Removes an organization role from a team. For more information on organization roles, see "[Using organization roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Remove an organization role from a user. For more information on organization roles, see "[Using organization roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Set cluster deployment records Set deployment records for a given cluster. If proposed records in the 'deployments' field have identical 'cluster', 'logical_environment', 'physical_environment', and 'deployment_name' values as existing records, the existing records will be updated. If no existing records match, new records will be created. Note: Artifacts are uniquely identified by the combination of their repository and digest fields. If two entries in the deployments array resolve to the same repository and have identical digest fields but differing name and version fields, the endpoint will use the artifact name and version from the record processed first, since a single artifact (identified by repository and digest) can only have one name and version.

Set immutable releases settings for an organization Sets the immutable releases policy for repositories in an organization. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Set selected repositories for immutable releases enforcement Replaces all repositories that have been selected for immutable releases enforcement in an organization. To use this endpoint, the organization immutable releases policy for `enforced_repositories` must be configured to `selected`. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Set organization membership for a user Only authenticated organization owners can add a member to the organization or update the member's role. * If the authenticated user is _adding_ a member to the organization, the invited user will receive an email inviting them to the organization. The user's [membership status](https://docs.github.com/enterprise-cloud@latest/rest/orgs/members#get-organization-membership-for-a-user) will be `pending` until they accept the invitation. * Authenticated users can _update_ a user's membership by passing the `role` parameter. If the authenticated user changes a member's role to `admin`, the affected user will receive an email notifying them that they've been made an organization owner. If the authenticated user changes an owner's role to `member`, no email will be sent. **Rate limits** To prevent abuse, organization owners are limited to creating 50 organization invitations for an organization within a 24 hour period. If the organization is more than one month old or on a paid plan, the limit is 500 invitations per 24 hour period.

Set public organization membership for the authenticated user The user can publicize their own membership. (A user cannot publicize the membership for another user.) Note that you'll need to set `Content-Length` to zero when calling out to this endpoint. For more information, see "[HTTP method](https://docs.github.com/enterprise-cloud@latest/rest/guides/getting-started-with-the-rest-api#http-method)."

Unblock a user from an organization Unblocks the given user on behalf of the specified organization.

Update an organization > [!WARNING] > **Closing down notice:** GitHub Enterprise Cloud will replace and discontinue `members_allowed_repository_creation_type` in favor of more granular permissions. The new input parameters are `members_can_create_public_repositories`, `members_can_create_private_repositories` for all organizations and `members_can_create_internal_repositories` for organizations associated with an enterprise account using GitHub Enterprise Cloud or GitHub Enterprise Server 2.20+. For more information, see the [blog post](https://developer.github.com/changes/2019-12-03-internal-visibility-changes). > [!WARNING] > **Closing down notice:** Code security product enablement for new repositories through the organization API is closing down. Please use [code security configurations](https://docs.github.com/enterprise-cloud@latest/rest/code-security/configurations#set-a-code-security-configuration-as-a-default-for-an-organization) to set defaults instead. For more information on setting a default security configuration, see the [changelog](https://github.blog/changelog/2024-07-09-sunsetting-security-settings-defaults-parameters-in-the-organizations-rest-api/). Updates the organization's profile and member privileges. The authenticated user must be an organization owner to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` or `repo` scope to use this endpoint.

Update a custom repository role Updates a custom repository role that can be used by all repositories owned by the organization. For more information about custom repository roles, see "[About custom repository roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-repository-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Closing down - Update a custom role > [!WARNING] > **Closing down notice:** This operation is closing down and will be removed after September 6, 2023. Use the "[Update a custom repository role](https://docs.github.com/enterprise-cloud@latest/rest/orgs/custom-roles#update-a-custom-repository-role)" endpoint instead. Updates a custom repository role that can be used by all repositories owned by the organization. For more information about custom repository roles, see "[About custom repository roles](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-repository-roles)." The authenticated user must be an administrator for the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Update issue field for an organization Updates an issue field for an organization. You can find out more about issue fields in [Managing issue fields in an organization](https://docs.github.com/enterprise-cloud@latest/issues/tracking-your-work-with-issues/using-issues/managing-issue-fields-in-an-organization). To use this endpoint, the authenticated user must be an administrator for the organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Update issue type for an organization Updates an issue type for an organization. You can find out more about issue types in [Managing issue types in an organization](https://docs.github.com/enterprise-cloud@latest/issues/tracking-your-work-with-issues/configuring-issues/managing-issue-types-in-an-organization). To use this endpoint, the authenticated user must be an administrator for the organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Update an organization membership for the authenticated user Converts the authenticated user to an active member of the organization, if that user has a pending invitation from the organization.

Update the access a fine-grained personal access token has to organization resources Updates the access an organization member has to organization resources via a fine-grained personal access token. Limited to revoking the token's existing access. Limited to revoking a token's existing access. Only GitHub Apps can use this endpoint.

Update the access to organization resources via fine-grained personal access tokens Updates the access organization members have to organization resources via fine-grained personal access tokens. Limited to revoking a token's existing access. Only GitHub Apps can use this endpoint.

Update an organization webhook You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.

Update a webhook configuration for an organization You must be an organization owner or have the "Manage organization webhooks" permission to use this endpoint. OAuth app tokens and personal access tokens (classic) need `admin:org_hook` scope. OAuth apps cannot list, view, or edit webhooks that they did not create and users cannot list, view, or edit webhooks that were created by OAuth apps.