Free, Pro, & Team

English

Actions

The GitHub Actions API enables you to manage GitHub Actions using the REST API. This API is available for authenticated users, OAuth Apps, and GitHub Apps. Access tokens require repo scope for private repos and public_repo scope for public repos. GitHub Apps require the permissions mentioned in each endpoint. For more information, see "GitHub Actions Documentation."

Artifacts

The Artifacts API allows you to download, delete, and retrieve information about workflow artifacts. Artifacts enable you to share data between jobs in a workflow and store data once that workflow has completed. For more information, see "Persisting workflow data using artifacts."

List artifacts for a repository

Lists all artifacts for a repository. Anyone with read access to the repository can use this endpoint. If the repository is private you must use an access token with the repo scope. GitHub Apps must have the actions:read permission to use this endpoint.

get /repos/{owner}/{repo}/actions/artifacts

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`per_page`	integer	query	Results per page (max 100) Default: `30`
`page`	integer	query	Page number of the results to fetch. Default: `1`

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/artifacts

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/artifacts', {
  owner: 'octocat',
  repo: 'hello-world'
})

Response

Status: 200 OK

{
  "total_count": 2,
  "artifacts": [
    {
      "id": 11,
      "node_id": "MDg6QXJ0aWZhY3QxMQ==",
      "name": "Rails",
      "size_in_bytes": 556,
      "url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11",
      "archive_download_url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11/zip",
      "expired": false,
      "created_at": "2020-01-10T14:59:22Z",
      "expires_at": "2020-03-21T14:59:22Z",
      "updated_at": "2020-02-21T14:59:22Z"
    },
    {
      "id": 13,
      "node_id": "MDg6QXJ0aWZhY3QxMw==",
      "name": "",
      "size_in_bytes": 453,
      "url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/13",
      "archive_download_url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/13/zip",
      "expired": false,
      "created_at": "2020-01-10T14:59:22Z",
      "expires_at": "2020-03-21T14:59:22Z",
      "updated_at": "2020-02-21T14:59:22Z"
    }
  ]
}

Notes

Works with GitHub Apps

Get an artifact

Gets a specific artifact for a workflow run. Anyone with read access to the repository can use this endpoint. If the repository is private you must use an access token with the repo scope. GitHub Apps must have the actions:read permission to use this endpoint.

get /repos/{owner}/{repo}/actions/artifacts/{artifact_id}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`artifact_id`	integer	path	artifact_id parameter

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/artifacts/42

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}', {
  owner: 'octocat',
  repo: 'hello-world',
  artifact_id: 42
})

Response

Status: 200 OK

{
  "id": 11,
  "node_id": "MDg6QXJ0aWZhY3QxMQ==",
  "name": "Rails",
  "size_in_bytes": 556,
  "url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11",
  "archive_download_url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11/zip",
  "expired": false,
  "created_at": "2020-01-10T14:59:22Z",
  "expires_at": "2020-01-21T14:59:22Z",
  "updated_at": "2020-01-21T14:59:22Z"
}

Notes

Works with GitHub Apps

Delete an artifact

Deletes an artifact for a workflow run. You must authenticate using an access token with the repo scope to use this endpoint. GitHub Apps must have the actions:write permission to use this endpoint.

delete /repos/{owner}/{repo}/actions/artifacts/{artifact_id}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`artifact_id`	integer	path	artifact_id parameter

Code samples

Shell

curl \
  -X DELETE \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/artifacts/42

JavaScript (@octokit/core.js)

await octokit.request('DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}', {
  owner: 'octocat',
  repo: 'hello-world',
  artifact_id: 42
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Download an artifact

Gets a redirect URL to download an archive for a repository. This URL expires after 1 minute. Look for Location: in the response header to find the URL for the download. The :archive_format must be zip. Anyone with read access to the repository can use this endpoint. If the repository is private you must use an access token with the repo scope. GitHub Apps must have the actions:read permission to use this endpoint.

get /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`artifact_id`	integer	path	artifact_id parameter
`archive_format`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/artifacts/42/ARCHIVE_FORMAT

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}', {
  owner: 'octocat',
  repo: 'hello-world',
  artifact_id: 42,
  archive_format: 'archive_format'
})

Response

Status: 302 Found

Notes

Works with GitHub Apps

List workflow run artifacts

Lists artifacts for a workflow run. Anyone with read access to the repository can use this endpoint. If the repository is private you must use an access token with the repo scope. GitHub Apps must have the actions:read permission to use this endpoint.

get /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`run_id`	integer	path	The id of the workflow run.
`per_page`	integer	query	Results per page (max 100) Default: `30`
`page`	integer	query	Page number of the results to fetch. Default: `1`

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/runs/42/artifacts

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts', {
  owner: 'octocat',
  repo: 'hello-world',
  run_id: 42
})

Response

Status: 200 OK

{
  "total_count": 2,
  "artifacts": [
    {
      "id": 11,
      "node_id": "MDg6QXJ0aWZhY3QxMQ==",
      "name": "Rails",
      "size_in_bytes": 556,
      "url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11",
      "archive_download_url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/11/zip",
      "expired": false,
      "created_at": "2020-01-10T14:59:22Z",
      "expires_at": "2020-03-21T14:59:22Z",
      "updated_at": "2020-02-21T14:59:22Z"
    },
    {
      "id": 13,
      "node_id": "MDg6QXJ0aWZhY3QxMw==",
      "name": "",
      "size_in_bytes": 453,
      "url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/13",
      "archive_download_url": "https://api.github.com/repos/octo-org/octo-docs/actions/artifacts/13/zip",
      "expired": false,
      "created_at": "2020-01-10T14:59:22Z",
      "expires_at": "2020-03-21T14:59:22Z",
      "updated_at": "2020-02-21T14:59:22Z"
    }
  ]
}

Notes

Works with GitHub Apps

Permissions

The Permissions API allows you to set permissions for what organizations and repositories are allowed to run GitHub Actions, and what actions are allowed to run. For more information, see "Usage limits, billing, and administration."

You can also set permissions for an enterprise. For more information, see the "GitHub Enterprise administration" REST API.

Get GitHub Actions permissions for an organization

Gets the GitHub Actions permissions policy for repositories and allowed actions in an organization.

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

get /orgs/{org}/actions/permissions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/permissions', {
  org: 'org'
})

Response

Status: 200 OK

{
  "enabled_repositories": "all",
  "allowed_actions": "selected",
  "selected_actions_url": "https://api.github.com/organizations/42/actions/permissions/selected-actions"
}

Notes

Works with GitHub Apps

Set GitHub Actions permissions for an organization

Sets the GitHub Actions permissions policy for repositories and allowed actions in an organization.

If the organization belongs to an enterprise that has set restrictive permissions at the enterprise level, such as allowed_actions to selected actions, then you cannot override them for the organization.

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

put /orgs/{org}/actions/permissions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`enabled_repositories`	string	body	Required. The policy that controls the repositories in the organization that are allowed to run GitHub Actions. Can be one of: `all`, `none`, or `selected`.
`allowed_actions`	string	body	The permissions policy that controls the actions that are allowed to run. Can be one of: `all`, `local_only`, or `selected`.

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions \
  -d '{"enabled_repositories":"enabled_repositories"}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /orgs/{org}/actions/permissions', {
  org: 'org',
  enabled_repositories: 'enabled_repositories'
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

List selected repositories enabled for GitHub Actions in an organization

Lists the selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for enabled_repositories must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

get /orgs/{org}/actions/permissions/repositories

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`per_page`	integer	query	Results per page (max 100) Default: `30`
`page`	integer	query	Page number of the results to fetch. Default: `1`

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/repositories

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/permissions/repositories', {
  org: 'org'
})

Response

Status: 200 OK

{
  "total_count": 1,
  "repositories": [
    {
      "id": 1296269,
      "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
      "name": "Hello-World",
      "full_name": "octocat/Hello-World",
      "owner": {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": false
      },
      "private": false,
      "html_url": "https://github.com/octocat/Hello-World",
      "description": "This your first repo!",
      "fork": false,
      "url": "https://api.github.com/repos/octocat/Hello-World",
      "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
      "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
      "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
      "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
      "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
      "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
      "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
      "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
      "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
      "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
      "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
      "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
      "events_url": "https://api.github.com/repos/octocat/Hello-World/events",
      "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
      "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
      "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
      "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
      "git_url": "git:github.com/octocat/Hello-World.git",
      "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
      "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
      "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
      "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
      "labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
      "languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
      "merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
      "milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
      "notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
      "pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
      "releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
      "ssh_url": "git@github.com:octocat/Hello-World.git",
      "stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
      "statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
      "subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
      "subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
      "tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
      "teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
      "trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
      "clone_url": "https://github.com/octocat/Hello-World.git",
      "mirror_url": "git:git.example.com/octocat/Hello-World",
      "hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks",
      "svn_url": "https://svn.github.com/octocat/Hello-World",
      "homepage": "https://github.com",
      "language": null,
      "forks_count": 9,
      "stargazers_count": 80,
      "watchers_count": 80,
      "size": 108,
      "default_branch": "master",
      "open_issues_count": 0,
      "is_template": true,
      "topics": [
        "octocat",
        "atom",
        "electron",
        "api"
      ],
      "has_issues": true,
      "has_projects": true,
      "has_wiki": true,
      "has_pages": false,
      "has_downloads": true,
      "archived": false,
      "disabled": false,
      "visibility": "public",
      "pushed_at": "2011-01-26T19:06:43Z",
      "created_at": "2011-01-26T19:01:12Z",
      "updated_at": "2011-01-26T19:14:43Z",
      "permissions": {
        "admin": false,
        "push": false,
        "pull": true
      },
      "allow_rebase_merge": true,
      "template_repository": null,
      "temp_clone_token": "ABTLWHOULUVAXGTRYU7OC2876QJ2O",
      "allow_squash_merge": true,
      "allow_auto_merge": false,
      "delete_branch_on_merge": true,
      "allow_merge_commit": true,
      "subscribers_count": 42,
      "network_count": 0,
      "license": {
        "key": "mit",
        "name": "MIT License",
        "url": "https://api.github.com/licenses/mit",
        "spdx_id": "MIT",
        "node_id": "MDc6TGljZW5zZW1pdA==",
        "html_url": "https://github.com/licenses/mit"
      },
      "forks": 1,
      "open_issues": 1,
      "watchers": 1
    }
  ]
}

Notes

Works with GitHub Apps

Set selected repositories enabled for GitHub Actions in an organization

Replaces the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for enabled_repositories must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

put /orgs/{org}/actions/permissions/repositories

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`selected_repository_ids`	array of integers	body	Required. List of repository IDs to enable for GitHub Actions.

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/repositories \
  -d '{"selected_repository_ids":[42]}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /orgs/{org}/actions/permissions/repositories', {
  org: 'org',
  selected_repository_ids: [
    42
  ]
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Enable a selected repository for GitHub Actions in an organization

Adds a repository to the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for enabled_repositories must be must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

put /orgs/{org}/actions/permissions/repositories/{repository_id}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`repository_id`	integer	path

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/repositories/42

JavaScript (@octokit/core.js)

await octokit.request('PUT /orgs/{org}/actions/permissions/repositories/{repository_id}', {
  org: 'org',
  repository_id: 42
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Disable a selected repository for GitHub Actions in an organization

Removes a repository from the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for enabled_repositories must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

delete /orgs/{org}/actions/permissions/repositories/{repository_id}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`repository_id`	integer	path

Code samples

Shell

curl \
  -X DELETE \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/repositories/42

JavaScript (@octokit/core.js)

await octokit.request('DELETE /orgs/{org}/actions/permissions/repositories/{repository_id}', {
  org: 'org',
  repository_id: 42
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Get allowed actions for an organization

Gets the selected actions that are allowed in an organization. To use this endpoint, the organization permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization.""

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

get /orgs/{org}/actions/permissions/selected-actions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/selected-actions

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/permissions/selected-actions', {
  org: 'org'
})

Response

Status: 200 OK

{
  "github_owned_allowed": true,
  "verified_allowed": false,
  "patterns_allowed": [
    "monalisa/octocat@*",
    "docker/*"
  ]
}

Notes

Works with GitHub Apps

Set allowed actions for an organization

Sets the actions that are allowed in an organization. To use this endpoint, the organization permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

If the organization belongs to an enterprise that has selected actions set at the enterprise level, then you cannot override any of the enterprise's allowed actions settings.

To use the patterns_allowed setting for private repositories, the organization must belong to an enterprise. If the organization does not belong to an enterprise, then the patterns_allowed setting only applies to public repositories in the organization.

You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the administration organization permission to use this API.

put /orgs/{org}/actions/permissions/selected-actions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`github_owned_allowed`	boolean	body	Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.
`verified_allowed`	boolean	body	Whether actions in GitHub Marketplace from verified creators are allowed. Set to `true` to allow all GitHub Marketplace actions by verified creators.
`patterns_allowed`	array of strings	body	Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, `monalisa/octocat@`, `monalisa/octocat@v2`, `monalisa/`."

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/permissions/selected-actions \
  -d '{"github_owned_allowed":true}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /orgs/{org}/actions/permissions/selected-actions', {
  org: 'org',
  github_owned_allowed: true
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Get GitHub Actions permissions for a repository

Gets the GitHub Actions permissions policy for a repository, including whether GitHub Actions is enabled and the actions allowed to run in the repository.

You must authenticate using an access token with the repo scope to use this endpoint. GitHub Apps must have the administration repository permission to use this API.

get /repos/{owner}/{repo}/actions/permissions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/permissions

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/permissions', {
  owner: 'octocat',
  repo: 'hello-world'
})

Response

Status: 200 OK

{
  "enabled": true,
  "allowed_actions": "selected",
  "selected_actions_url": "https://api.github.com/repositories/42/actions/permissions/selected-actions"
}

Notes

Works with GitHub Apps

Set GitHub Actions permissions for a repository

Sets the GitHub Actions permissions policy for enabling GitHub Actions and allowed actions in the repository.

If the repository belongs to an organization or enterprise that has set restrictive permissions at the organization or enterprise levels, such as allowed_actions to selected actions, then you cannot override them for the repository.

You must authenticate using an access token with the repo scope to use this endpoint. GitHub Apps must have the administration repository permission to use this API.

put /repos/{owner}/{repo}/actions/permissions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`enabled`	boolean	body	Required. Whether GitHub Actions is enabled on the repository.
`allowed_actions`	string	body	The permissions policy that controls the actions that are allowed to run. Can be one of: `all`, `local_only`, or `selected`.

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/permissions \
  -d '{"enabled":true}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions', {
  owner: 'octocat',
  repo: 'hello-world',
  enabled: true
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Get allowed actions for a repository

Gets the settings for selected actions that are allowed in a repository. To use this endpoint, the repository policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for a repository."

You must authenticate using an access token with the repo scope to use this endpoint. GitHub Apps must have the administration repository permission to use this API.

get /repos/{owner}/{repo}/actions/permissions/selected-actions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/permissions/selected-actions

JavaScript (@octokit/core.js)

await octokit.request('GET /repos/{owner}/{repo}/actions/permissions/selected-actions', {
  owner: 'octocat',
  repo: 'hello-world'
})

Response

Status: 200 OK

{
  "github_owned_allowed": true,
  "verified_allowed": false,
  "patterns_allowed": [
    "monalisa/octocat@*",
    "docker/*"
  ]
}

Notes

Works with GitHub Apps

Set allowed actions for a repository

Sets the actions that are allowed in a repository. To use this endpoint, the repository permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for a repository."

If the repository belongs to an organization or enterprise that has selected actions set at the organization or enterprise levels, then you cannot override any of the allowed actions settings.

To use the patterns_allowed setting for private repositories, the repository must belong to an enterprise. If the repository does not belong to an enterprise, then the patterns_allowed setting only applies to public repositories.

You must authenticate using an access token with the repo scope to use this endpoint. GitHub Apps must have the administration repository permission to use this API.

put /repos/{owner}/{repo}/actions/permissions/selected-actions

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`owner`	string	path
`repo`	string	path
`github_owned_allowed`	boolean	body	Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.
`verified_allowed`	boolean	body	Whether actions in GitHub Marketplace from verified creators are allowed. Set to `true` to allow all GitHub Marketplace actions by verified creators.
`patterns_allowed`	array of strings	body	Specifies a list of string-matching patterns to allow specific action(s). Wildcards, tags, and SHAs are allowed. For example, `monalisa/octocat@`, `monalisa/octocat@v2`, `monalisa/`."

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/octocat/hello-world/actions/permissions/selected-actions \
  -d '{"github_owned_allowed":true}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions/selected-actions', {
  owner: 'octocat',
  repo: 'hello-world',
  github_owned_allowed: true
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

Secrets

The Secrets API lets you create, update, delete, and retrieve information about encrypted secrets. Encrypted secrets allow you to store sensitive information, such as access tokens, in your repository, repository environments, or organization. For more information, see "Creating and using encrypted secrets."

This API is available for authenticated users, OAuth Apps, and GitHub Apps. Access tokens require repo scope for private repos and public_repo scope for public repos. GitHub Apps must have the secrets permission to use this API. Authenticated users must have collaborator access to a repository to create, update, or read secrets.

List organization secrets

Lists all secrets available in an organization without revealing their encrypted values. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

get /orgs/{org}/actions/secrets

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`per_page`	integer	query	Results per page (max 100) Default: `30`
`page`	integer	query	Page number of the results to fetch. Default: `1`

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/secrets', {
  org: 'org'
})

Response

Status: 200 OK

{
  "total_count": 3,
  "secrets": [
    {
      "name": "GIST_ID",
      "created_at": "2019-08-10T14:59:22Z",
      "updated_at": "2020-01-10T14:59:22Z",
      "visibility": "private"
    },
    {
      "name": "DEPLOY_TOKEN",
      "created_at": "2019-08-10T14:59:22Z",
      "updated_at": "2020-01-10T14:59:22Z",
      "visibility": "all"
    },
    {
      "name": "GH_TOKEN",
      "created_at": "2019-08-10T14:59:22Z",
      "updated_at": "2020-01-10T14:59:22Z",
      "visibility": "selected",
      "selected_repositories_url": "https://api.github.com/orgs/octo-org/actions/secrets/SUPER_SECRET/repositories"
    }
  ]
}

Notes

Works with GitHub Apps

Get an organization public key

Gets your public key, which you need to encrypt secrets. You need to encrypt a secret before you can create or update secrets. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

get /orgs/{org}/actions/secrets/public-key

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets/public-key

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/secrets/public-key', {
  org: 'org'
})

Response

Status: 200 OK

{
  "key_id": "012345678912345678",
  "key": "2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvv1234"
}

Notes

Works with GitHub Apps

Get an organization secret

Gets a single organization secret without revealing its encrypted value. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

get /orgs/{org}/actions/secrets/{secret_name}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`secret_name`	string	path	secret_name parameter

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets/SECRET_NAME

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/secrets/{secret_name}', {
  org: 'org',
  secret_name: 'secret_name'
})

Response

Status: 200 OK

{
  "name": "GH_TOKEN",
  "created_at": "2019-08-10T14:59:22Z",
  "updated_at": "2020-01-10T14:59:22Z",
  "visibility": "selected",
  "selected_repositories_url": "https://api.github.com/orgs/octo-org/actions/secrets/SUPER_SECRET/repositories"
}

Notes

Works with GitHub Apps

Create or update an organization secret

Creates or updates an organization secret with an encrypted value. Encrypt your secret using LibSodium. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

Example encrypting a secret using Node.js

Encrypt your secret using the tweetsodium library.

const sodium = require('tweetsodium');
const key = "base64-encoded-public-key";
const value = "plain-text-secret";
// Convert the message and key to Uint8Array's (Buffer implements that interface)
const messageBytes = Buffer.from(value);
const keyBytes = Buffer.from(key, 'base64');
// Encrypt using LibSodium.
const encryptedBytes = sodium.seal(messageBytes, keyBytes);
// Base64 the encrypted secret
const encrypted = Buffer.from(encryptedBytes).toString('base64');
console.log(encrypted);

Example encrypting a secret using Python

Encrypt your secret using pynacl with Python 3.

from base64 import b64encode
from nacl import encoding, public
def encrypt(public_key: str, secret_value: str) -> str:
"""Encrypt a Unicode string using the public key."""
public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
sealed_box = public.SealedBox(public_key)
encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
return b64encode(encrypted).decode("utf-8")

Example encrypting a secret using C#

Encrypt your secret using the Sodium.Core package.

var secretValue = System.Text.Encoding.UTF8.GetBytes("mySecret");
var publicKey = Convert.FromBase64String("2Sg8iYjAxxmI2LvUXpJjkYrMxURPc8r+dB7TJyvvcCU=");
var sealedPublicKeyBox = Sodium.SealedPublicKeyBox.Create(secretValue, publicKey);
Console.WriteLine(Convert.ToBase64String(sealedPublicKeyBox));

Example encrypting a secret using Ruby

Encrypt your secret using the rbnacl gem.

require "rbnacl"
require "base64"
key = Base64.decode64("+ZYvJDZMHUfBkJdyq5Zm9SKqeuBQ4sj+6sfjlH4CgG0=")
public_key = RbNaCl::PublicKey.new(key)
box = RbNaCl::Boxes::Sealed.from_public_key(public_key)
encrypted_secret = box.encrypt("my_secret")
# Print the base64 encoded secret
puts Base64.strict_encode64(encrypted_secret)

put /orgs/{org}/actions/secrets/{secret_name}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`secret_name`	string	path	secret_name parameter
`encrypted_value`	string	body	Value for your secret, encrypted with LibSodium using the public key retrieved from the Get an organization public key endpoint.
`key_id`	string	body	ID of the key you used to encrypt the secret.
`visibility`	string	body	Required. Configures the access that repositories have to the organization secret. Can be one of: - `all` - All repositories in an organization can access the secret. - `private` - Private repositories in an organization can access the secret. - `selected` - Only specific repositories can access the secret.
`selected_repository_ids`	array of strings	body	An array of repository ids that can access the organization secret. You can only provide a list of repository ids when the `visibility` is set to `selected`. You can manage the list of selected repositories using the List selected repositories for an organization secret, Set selected repositories for an organization secret, and Remove selected repository from an organization secret endpoints.

Code samples

Shell

curl \
  -X PUT \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets/SECRET_NAME \
  -d '{"visibility":"visibility"}'

JavaScript (@octokit/core.js)

await octokit.request('PUT /orgs/{org}/actions/secrets/{secret_name}', {
  org: 'org',
  secret_name: 'secret_name',
  visibility: 'visibility'
})

Response when creating a secret

Status: 201 Created

Response when updating a secret

Status: 204 No Content

Notes

Works with GitHub Apps

Delete an organization secret

Deletes a secret in an organization using the secret name. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

delete /orgs/{org}/actions/secrets/{secret_name}

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`secret_name`	string	path	secret_name parameter

Code samples

Shell

curl \
  -X DELETE \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets/SECRET_NAME

JavaScript (@octokit/core.js)

await octokit.request('DELETE /orgs/{org}/actions/secrets/{secret_name}', {
  org: 'org',
  secret_name: 'secret_name'
})

Response

Status: 204 No Content

Notes

Works with GitHub Apps

List selected repositories for an organization secret

Lists all repositories that have been selected when the visibility for repository access to a secret is set to selected. You must authenticate using an access token with the admin:org scope to use this endpoint. GitHub Apps must have the secrets organization permission to use this endpoint.

get /orgs/{org}/actions/secrets/{secret_name}/repositories

Parameters

Name	Type	In	Description
`accept`	string	header	Setting to `application/vnd.github.v3+json` is recommended.
`org`	string	path
`secret_name`	string	path	secret_name parameter
`page`	integer	query	Page number of the results to fetch. Default: `1`
`per_page`	integer	query	Results per page (max 100) Default: `30`

Code samples

Shell

curl \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/orgs/ORG/actions/secrets/SECRET_NAME/repositories

JavaScript (@octokit/core.js)

await octokit.request('GET /orgs/{org}/actions/secrets/{secret_name}/repositories', {
  org: 'org',
  secret_name: 'secret_name'
})

Response

Status: 200 OK

{
  "total_count": 1,
  "repositories": [
    {
      "id": 1296269,
      "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
      "name": "Hello-World",
      "full_name": "octocat/Hello-World",
      "owner": {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": false
      },
      "private": false,
      "html_url": "https://github.com/octocat/Hello-World",
      "description": "This your first repo!",
      "fork": false,
      "url": "https://api.github.com/repos/octocat/Hello-World",
      "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
      "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
      "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
      "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
      "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
      "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
      "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
      "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
      "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
      "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
      "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
      "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
      "events_url": "https://api.github.com/repos/octocat/Hello-World/events",
      "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
      "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
      "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
      "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
      "git_url": "git:github.com/octocat/Hello-World.git",
      "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
      "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
      "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
      "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/