---
title: "Revoke credential authorizations for a user in an organization"
method: POST
path: "/orgs/{org}/credential-authorizations/{username}/revoke"
tags: ["orgs"]
---

# Revoke credential authorizations for a user in an organization

`POST /orgs/{org}/credential-authorizations/{username}/revoke`

Revokes all SAML SSO credential authorizations for a single user within the
organization. This removes the sign-in authorizations for the user's personal
access tokens, SSH keys, OAuth app tokens, and user-to-server tokens that they
have authorized for the organization. The user will need to authorize their
credentials again to access the organization.

This operation is performed asynchronously. A background job will be queued to process
the revocations.

> [!WARNING]
> If you use a personal access token to call this endpoint and target yourself,
> that token's authorization for the organization may also be revoked as part of
> this operation.

The authenticated user must be an organization owner to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required
- `username` string, required

## Response `202`

Accepted - The revocation request has been queued

- object
  - `message` string — A message indicating the revocation has been queued
  - `warning` string — A warning message if the token used for this request may be revoked

## Other responses

- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.net/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/enterprise-cloud/revisions/daeba3129b5f/schema)