---
title: "Set default workflow permissions for an organization"
method: PUT
path: "/orgs/{org}/actions/permissions/workflow"
tags: ["actions"]
---

# Set default workflow permissions for an organization

`PUT /orgs/{org}/actions/permissions/workflow`

Sets the default workflow permissions granted to the `GITHUB_TOKEN` when running workflows in an organization, and sets if GitHub Actions
can submit approving pull request reviews. For more information, see
"[Setting the permissions of the GITHUB_TOKEN for your organization](https://docs.github.com/enterprise-server@3.8/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization)."

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required

## Request body

- ActionsSetDefaultWorkflowPermissions
  - `default_workflow_permissions` 'read' | 'write' — The default workflow permissions granted to the GITHUB_TOKEN when running workflows.
  - `can_approve_pull_request_reviews` boolean — Whether GitHub Actions can approve pull requests. Enabling this can be a security risk.

## Response `204`

Success response

## Other responses

- `409` — Conflict response when changing a setting is prevented by the owning enterprise

---

[API](https://skmtc.net/github/apis/ghes.md) · [All operations](https://skmtc.net/github/apis/ghes/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/ghes/revisions/5438365412fe/schema)