v56

latestOpenAPI 3.0.3MITraw.githubusercontent.com2026-08-011,4581,08113.3 MB

orgs

List SAML SSO authorizations for an organization

Lists all credential authorizations for an organization that uses SAML single sign-on (SSO). The credentials can be personal access tokens, SSH keys, OAuth app access tokens, or user-to-server tokens from GitHub Apps that organization members have authorized for the organization. For more information, see About authentication with SAML single sign-on.

The authenticated user must be an organization owner to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:org scope to use this endpoint.

get/orgs/{org}/credential-authorizations

Path parameters

orgstring required

The organization name. The name is not case sensitive.

Query parameters

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

pageinteger

Page token

loginstring

Limits the list of credentials authorizations for an organization to a specific login

Response

loginstring required

User login that owns the underlying credential.

credential_idinteger required

Unique identifier for the authorization of the credential. Use this to revoke authorization of the underlying token or key.

credential_type'personal access token' | 'SSH key' | 'OAuth app token' | 'GitHub app token' required

Human-readable description of the credential type.

token_last_eightstring

Last eight characters of the credential. Only included in responses with a credential_type of personal access token, OAuth app token, or GitHub app token.

credential_authorized_atstring date-time required

Date when the credential was authorized for use.

scopesstring[]

List of OAuth scopes the token has been granted.

fingerprintstring

Unique string to distinguish the credential. Only included in responses with a credential_type of SSH key.

credential_accessed_atstring date-time nullable required

Date when the credential was last accessed. May be null if it was never accessed

authorized_credential_idinteger nullable required

The ID of the underlying token or key that was authorized by the user. This will remain unchanged across authorizations of the token or key.

authorized_credential_titlestring nullable

The title given to the ssh key. This will only be present when the credential is an ssh key.

authorized_credential_notestring nullable

The note given to the token. This will only be present when the credential is a token.

authorized_credential_expires_atstring date-time nullable

The expiry for the token. This will only be present when the credential is a token.

Example response

[
  {
    "login": "monalisa",
    "credential_id": 1,
    "credential_type": "SSH key",
    "token_last_eight": "12345678",
    "credential_authorized_at": "2011-01-26T19:06:43Z",
    "scopes": [
      "user",
      "repo"
    ],
    "fingerprint": "jklmnop12345678",
    "credential_accessed_at": "2011-01-26T19:06:43Z",
    "authorized_credential_id": 12345678,
    "authorized_credential_title": "my ssh key",
    "authorized_credential_note": "my token"
  }
]