针对 GitHub Actions 权限的 REST API 端点

Get GitHub Actions permissions for an enterprise

Gets the GitHub Actions permissions policy for organizations and allowed actions and reusable workflows in an enterprise.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Get GitHub Actions permissions for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Get GitHub Actions permissions for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

“Get GitHub Actions permissions for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	OK

“Get GitHub Actions permissions for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions

Response

Status: 200

{
  "enabled_organizations": "all",
  "allowed_actions": "selected",
  "selected_actions_url": "https://api.github.com/enterprises/2/actions/permissions/selected-actions",
  "sha_pinning_required": true
}

Set GitHub Actions permissions for an enterprise

Sets the GitHub Actions permissions policy for organizations and allowed actions and reusable workflows in an enterprise.

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Set GitHub Actions permissions for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set GitHub Actions permissions for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`enabled_organizations` string 必须 The policy that controls the organizations in the enterprise that are allowed to run GitHub Actions. 可以是以下选项之一: `all`, `none`, `selected`
`allowed_actions` string The permissions policy that controls the actions and reusable workflows that are allowed to run. 可以是以下选项之一: `all`, `local_only`, `selected`
`sha_pinning_required` boolean Whether actions must be pinned to a full-length commit SHA.

“Set GitHub Actions permissions for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	No Content

“Set GitHub Actions permissions for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions \
  -d '{"enabled_organizations":"all","allowed_actions":"selected","sha_pinning_required":true}'

Response

Status: 204

Get artifact and log retention settings for an enterprise

Gets artifact and log retention settings for an enterprise.

“Get artifact and log retention settings for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Get artifact and log retention settings for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

“Get artifact and log retention settings for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	Successfully retrieved the artifact and log retention settings
`401`	Authorization failure
`404`	Resource not found

“Get artifact and log retention settings for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions/artifact-and-log-retention

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/artifact-and-log-retention

Example response

Status: 200

{
  "days": 90,
  "maximum_allowed_days": 365
}

Set artifact and log retention settings for an enterprise

Sets artifact and log retention settings for an enterprise.

“Set artifact and log retention settings for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set artifact and log retention settings for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`days` integer 必须 The number of days to retain artifacts and logs

“Set artifact and log retention settings for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	Successfully updated the artifact and log retention settings
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.

“Set artifact and log retention settings for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions/artifact-and-log-retention

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/artifact-and-log-retention \
  -d '{"days":100}'

Successfully updated the artifact and log retention settings

Status: 204

Get fork PR contributor approval permissions for an enterprise

Gets the fork PR contributor approval policy for an enterprise.

“Get fork PR contributor approval permissions for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Get fork PR contributor approval permissions for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

“Get fork PR contributor approval permissions for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	OK
`404`	Resource not found

“Get fork PR contributor approval permissions for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions/fork-pr-contributor-approval

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/fork-pr-contributor-approval

Response

Status: 200

{
  "approval_policy": "first_time_contributors"
}

Set fork PR contributor approval permissions for an enterprise

Sets the fork PR contributor approval policy for an enterprise.

“Set fork PR contributor approval permissions for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set fork PR contributor approval permissions for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`approval_policy` string 必须 The policy that controls when fork PR workflows require approval from a maintainer. 可以是以下选项之一: `first_time_contributors_new_to_github`, `first_time_contributors`, `all_external_contributors`

“Set fork PR contributor approval permissions for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	No Content
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.

“Set fork PR contributor approval permissions for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions/fork-pr-contributor-approval

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/fork-pr-contributor-approval \
  -d '{"approval_policy":"first_time_contributors"}'

Response

Status: 204

Get private repo fork PR workflow settings for an enterprise

Gets the settings for whether workflows from fork pull requests can run on private repositories in an enterprise.

“Get private repo fork PR workflow settings for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Get private repo fork PR workflow settings for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

“Get private repo fork PR workflow settings for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	OK
`404`	Resource not found

“Get private repo fork PR workflow settings for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions/fork-pr-workflows-private-repos

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/fork-pr-workflows-private-repos

Response

Status: 200

{
  "run_workflows_from_fork_pull_requests": true,
  "send_write_tokens_to_workflows": false,
  "send_secrets_and_variables": false,
  "require_approval_for_fork_pr_workflows": true
}

Set private repo fork PR workflow settings for an enterprise

Sets the settings for whether workflows from fork pull requests can run on private repositories in an enterprise.

“Set private repo fork PR workflow settings for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set private repo fork PR workflow settings for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`run_workflows_from_fork_pull_requests` boolean 必须 Whether workflows triggered by pull requests from forks are allowed to run on private repositories.
`send_write_tokens_to_workflows` boolean Whether GitHub Actions can create pull requests or submit approving pull request reviews from a workflow triggered by a fork pull request.
`send_secrets_and_variables` boolean Whether to make secrets and variables available to workflows triggered by pull requests from forks.
`require_approval_for_fork_pr_workflows` boolean Whether workflows triggered by pull requests from forks require approval from a repository administrator to run.

“Set private repo fork PR workflow settings for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	Empty response for successful settings update
`404`	Resource not found
`422`	Validation failed, or the endpoint has been spammed.

“Set private repo fork PR workflow settings for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions/fork-pr-workflows-private-repos

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/fork-pr-workflows-private-repos \
  -d '{"run_workflows_from_fork_pull_requests":true,"send_write_tokens_to_workflows":false,"send_secrets_and_variables":false,"require_approval_for_fork_pr_workflows":true}'

Empty response for successful settings update

Status: 204

List selected organizations enabled for GitHub Actions in an enterprise

Lists the organizations that are selected to have GitHub Actions enabled in an enterprise. To use this endpoint, the enterprise permission policy for enabled_organizations must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“List selected organizations enabled for GitHub Actions in an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”List selected organizations enabled for GitHub Actions in an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

查询参数
名称, 类型, 说明
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." 默认: `30`
`page` integer The page number of the results to fetch. For more information, see "Using pagination in the REST API." 默认: `1`

“List selected organizations enabled for GitHub Actions in an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	OK

“List selected organizations enabled for GitHub Actions in an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions/organizations

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/organizations

Response

Status: 200

{
  "total_count": 1,
  "organizations": [
    {
      "login": "octocat",
      "id": 161335,
      "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
      "url": "https://api.github.com/orgs/octo-org",
      "repos_url": "https://api.github.com/orgs/octo-org/repos",
      "events_url": "https://api.github.com/orgs/octo-org/events",
      "hooks_url": "https://api.github.com/orgs/octo-org/hooks",
      "issues_url": "https://api.github.com/orgs/octo-org/issues",
      "members_url": "https://api.github.com/orgs/octo-org/members{/member}",
      "public_members_url": "https://api.github.com/orgs/octo-org/public_members{/member}",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "description": "A great organization"
    }
  ]
}

Set selected organizations enabled for GitHub Actions in an enterprise

Replaces the list of selected organizations that are enabled for GitHub Actions in an enterprise. To use this endpoint, the enterprise permission policy for enabled_organizations must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Set selected organizations enabled for GitHub Actions in an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set selected organizations enabled for GitHub Actions in an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`selected_organization_ids` array of integers 必须 List of organization IDs to enable for GitHub Actions.

“Set selected organizations enabled for GitHub Actions in an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	No Content

“Set selected organizations enabled for GitHub Actions in an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions/organizations

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/organizations \
  -d '{"selected_organization_ids":[32,91]}'

Response

Status: 204

Enable a selected organization for GitHub Actions in an enterprise

Adds an organization to the list of selected organizations that are enabled for GitHub Actions in an enterprise. To use this endpoint, the enterprise permission policy for enabled_organizations must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Enable a selected organization for GitHub Actions in an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Enable a selected organization for GitHub Actions in an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.
`org_id` integer 必须 The unique identifier of the organization.

“Enable a selected organization for GitHub Actions in an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	No Content

“Enable a selected organization for GitHub Actions in an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

put/enterprises/{enterprise}/actions/permissions/organizations/{org_id}

curl -L \
  -X PUT \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/organizations/ORG_ID

Response

Status: 204

Disable a selected organization for GitHub Actions in an enterprise

Removes an organization from the list of selected organizations that are enabled for GitHub Actions in an enterprise. To use this endpoint, the enterprise permission policy for enabled_organizations must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Disable a selected organization for GitHub Actions in an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Disable a selected organization for GitHub Actions in an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.
`org_id` integer 必须 The unique identifier of the organization.

“Disable a selected organization for GitHub Actions in an enterprise”的 HTTP 响应状态代码

状态代码	说明
`204`	No Content

“Disable a selected organization for GitHub Actions in an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

delete/enterprises/{enterprise}/actions/permissions/organizations/{org_id}

curl -L \
  -X DELETE \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/organizations/ORG_ID

Response

Status: 204

Get allowed actions and reusable workflows for an enterprise

Gets the selected actions and reusable workflows that are allowed in an enterprise. To use this endpoint, the enterprise permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Get allowed actions and reusable workflows for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Get allowed actions and reusable workflows for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

“Get allowed actions and reusable workflows for an enterprise”的 HTTP 响应状态代码

状态代码	说明
`200`	OK

“Get allowed actions and reusable workflows for an enterprise”的代码示例

如果你在 GHE.com 上访问 GitHub，请将 api.github.com 替换为企业的专用子域，位于 api.SUBDOMAIN.ghe.com。

请求示例

get/enterprises/{enterprise}/actions/permissions/selected-actions

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/enterprises/ENTERPRISE/actions/permissions/selected-actions

Response

Status: 200

{
  "github_owned_allowed": true,
  "verified_allowed": false,
  "patterns_allowed": [
    "monalisa/octocat@*",
    "docker/*"
  ]
}

Set allowed actions and reusable workflows for an enterprise

Sets the actions and reusable workflows that are allowed in an enterprise. To use this endpoint, the enterprise permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for an enterprise."

OAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.

“Set allowed actions and reusable workflows for an enterprise”的细粒度访问令牌

此终结点不适用于GitHub应用用户访问令牌、GitHub应用安装访问令牌或精细的个人访问令牌。

“”Set allowed actions and reusable workflows for an enterprise 的参数

标头
名称, 类型, 说明
`accept` string Setting to `application/vnd.github+json` is recommended.

路径参数
名称, 类型, 说明
`enterprise` string 必须 The slug version of the enterprise name.

主体参数
名称, 类型, 说明
`github_owned_allowed` boolean Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.
`verified_allowed` boolean Whether actions from GitHub Marketplace verified creators are allowed. Set to `true` to allow all actions by GitHub Marketplace verified creators.
`patterns_allowed` array of strings Specifies a list of string-matching patterns to allow specific action(s) and reusable workflow(s). Wildcards, tags, and SHAs are allowed. For example,