---
title: "Revoke credential authorizations for a user in an enterprise"
method: POST
path: "/enterprises/{enterprise}/credential-authorizations/{username}/revoke"
tags: ["enterprise-admin"]
---

# Revoke credential authorizations for a user in an enterprise

`POST /enterprises/{enterprise}/credential-authorizations/{username}/revoke`

Revokes all credential authorizations for a single user within the enterprise.
This includes any credential authorizations the user has across all organizations
in the enterprise.

For Enterprise Managed User (EMU) enterprises, you can optionally also destroy all
credentials (PATs v1, PATs v2, and SSH keys) owned by the user by setting
the `revoke_credentials` parameter to `true`.

This operation is performed asynchronously. A background job will be queued to process
the revocations.

> [!WARNING]
> If you use a personal access token to call this endpoint and target yourself, that
> token may also be revoked or destroyed as part of this operation.

The authenticated user must be an enterprise owner or have the `write_enterprise_credentials` permission to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

## Path parameters

- `enterprise` string, required
- `username` string, required

## Request body

- object
  - `revoke_credentials` boolean — Whether to also destroy the actual credentials (PATs and SSH keys) owned by the user. This option is only available for Enterprise Managed User (EMU) enterprises. When set to `true`, all PATs (v1 and v2) and SSH keys owned by the user will be destroyed in addition to the credential authorizations.

## Response `202`

Accepted - The revocation request has been queued

- object
  - `message` string — A message indicating the revocation has been queued
  - `warning` string — A warning message if the token used for this request may be revoked

## Other responses

- `403` — Forbidden
- `404` — Resource not found
- `422` — Validation error - The target user cannot be revoked, or `revoke_credentials` is not available for this enterprise

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)