---
title: "List SAML SSO authorizations for an organization"
method: GET
path: "/orgs/{org}/credential-authorizations"
tags: ["orgs"]
---

# List SAML SSO authorizations for an organization

`GET /orgs/{org}/credential-authorizations`

Lists all credential authorizations for an organization that uses SAML single sign-on (SSO). The credentials can be personal access tokens, SSH keys, OAuth app access tokens, or user-to-server tokens from GitHub Apps that organization members have authorized for the organization. For more information, see [About authentication with SAML single sign-on](https://docs.github.com/enterprise-cloud@latest/articles/about-authentication-with-saml-single-sign-on).

The authenticated user must be an organization owner to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.

## Path parameters

- `org` string, required

## Query parameters

- `per_page` integer
- `page` integer
- `login` string

## Response `200`

Response

- CredentialAuthorization[]
  - `login` string, required — User login that owns the underlying credential.
  - `credential_id` integer, required — Unique identifier for the authorization of the credential. Use this to revoke authorization of the underlying token or key.
  - `credential_type` 'personal access token' | 'SSH key' | 'OAuth app token' | 'GitHub app token', required — Human-readable description of the credential type.
  - `token_last_eight` string — Last eight characters of the credential. Only included in responses with a credential_type of personal access token, OAuth app token, or GitHub app token.
  - `credential_authorized_at` string, date-time, required — Date when the credential was authorized for use.
  - `scopes` string[] — List of OAuth scopes the token has been granted.
  - `fingerprint` string — Unique string to distinguish the credential. Only included in responses with a credential_type of SSH key.
  - `credential_accessed_at` string, date-time, nullable, required — Date when the credential was last accessed. May be null if it was never accessed
  - `authorized_credential_id` integer, nullable, required — The ID of the underlying token or key that was authorized by the user. This will remain unchanged across authorizations of the token or key.
  - `authorized_credential_title` string, nullable — The title given to the ssh key. This will only be present when the credential is an ssh key.
  - `authorized_credential_note` string, nullable — The note given to the token. This will only be present when the credential is a token.
  - `authorized_credential_expires_at` string, date-time, nullable — The expiry for the token. This will only be present when the credential is a token.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)