{"meta":{"title":"REST-API-Endpunkte für OAuth-Autorisierungen","intro":"Verwenden der REST-API für die Interaktion mit OAuth apps und OAuth-Autorisierungen von GitHub Apps","product":"REST-API","breadcrumbs":[{"href":"/de/enterprise-cloud@latest/rest","title":"REST-API"},{"href":"/de/enterprise-cloud@latest/rest/apps","title":"Apps"},{"href":"/de/enterprise-cloud@latest/rest/apps/oauth-applications","title":"OAuth-Autorisierungen"}],"documentType":"article"},"body":"# REST-API-Endpunkte für OAuth-Autorisierungen\n\nVerwenden der REST-API für die Interaktion mit OAuth apps und OAuth-Autorisierungen von GitHub Apps\n\n## Informationen zu OAuth apps und OAuth-Autorisierungen von GitHub Apps\n\nSie können diese Endpunkte verwenden, um die OAuth-Token zu verwalten, die OAuth apps oder GitHub Apps für den Zugriff auf die Konten von Personen auf GitHub verwenden.\n\nToken für OAuth apps weisen das Präfix `gho_` auf, während OAuth-Token für GitHub Apps, die für die Authentifizierung im Namen des Benutzers verwendet werden, das Präfix `ghu_` aufweisen. Du kannst die folgenden Endpunkte für beide Typen von OAuth-Token verwenden.\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## Delete an app authorization\n\n```\nDELETE /applications/{client_id}/grant\n```\n\nOAuth and GitHub application owners can revoke a grant for their application and a specific user. You must provide a valid OAuth access_token as an input parameter and the grant for the token's owner will be deleted.\nDeleting an application's grant will also delete all OAuth tokens associated with the application for the user. Once deleted, the application will have no access to the user's account and will no longer be listed on the application authorizations settings screen within GitHub.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`client_id`** (string) (required)\n  The client ID of the GitHub app.\n\n#### Body parameters\n\n- **`access_token`** (string) (required)\n  The OAuth access token used to authenticate to the GitHub API.\n\n### HTTP response status codes\n\n- **204** - No Content\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/applications/Iv1.8a61f9b3a7aba766/grant \\\n  -d '{\n  \"access_token\": \"e72e16c7e42f292c6912e7710c838347ae178b4a\"\n}'\n```\n\n**Response schema (Status: 204):**\n\n## Check a token\n\n```\nPOST /applications/{client_id}/token\n```\n\nOAuth applications and GitHub applications with OAuth authorizations can use this API method for checking OAuth token validity without exceeding the normal rate limits for failed login attempts. Authentication works differently with this particular endpoint. Invalid tokens will return 404 NOT FOUND.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`client_id`** (string) (required)\n  The client ID of the GitHub app.\n\n#### Body parameters\n\n- **`access_token`** (string) (required)\n  The access_token of the OAuth or GitHub application.\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **404** - Resource not found\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/applications/Iv1.8a61f9b3a7aba766/token \\\n  -d '{\n  \"access_token\": \"e72e16c7e42f292c6912e7710c838347ae178b4a\"\n}'\n```\n\n**Response schema (Status: 200):**\n\n* `id`: required, integer, format: int64\n* `url`: required, string, format: uri\n* `scopes`: required, array of string or null\n* `token`: required, string\n* `token_last_eight`: required, string or null\n* `hashed_token`: required, string or null\n* `app`: required, object:\n  * `client_id`: required, string\n  * `name`: required, string\n  * `url`: required, string, format: uri\n* `note`: required, string or null\n* `note_url`: required, string or null, format: uri\n* `updated_at`: required, string, format: date-time\n* `created_at`: required, string, format: date-time\n* `fingerprint`: required, string or null\n* `user`: any of:\n  * **null**\n  * **Simple User**\n    * `name`: string or null\n    * `email`: string or null\n    * `login`: required, string\n    * `id`: required, integer, format: int64\n    * `node_id`: required, string\n    * `avatar_url`: required, string, format: uri\n    * `gravatar_id`: required, string or null\n    * `url`: required, string, format: uri\n    * `html_url`: required, string, format: uri\n    * `followers_url`: required, string, format: uri\n    * `following_url`: required, string\n    * `gists_url`: required, string\n    * `starred_url`: required, string\n    * `subscriptions_url`: required, string, format: uri\n    * `organizations_url`: required, string, format: uri\n    * `repos_url`: required, string, format: uri\n    * `events_url`: required, string\n    * `received_events_url`: required, string, format: uri\n    * `type`: required, string\n    * `site_admin`: required, boolean\n    * `starred_at`: string\n    * `user_view_type`: string\n* `installation`: any of:\n  * **null**\n  * **Scoped Installation**\n    * `permissions`: required, `App Permissions`:\n      * `actions`: string, enum: `read`, `write`\n      * `administration`: string, enum: `read`, `write`\n      * `artifact_metadata`: string, enum: `read`, `write`\n      * `attestations`: string, enum: `read`, `write`\n      * `checks`: string, enum: `read`, `write`\n      * `code_quality`: string, enum: `read`, `write`\n      * `codespaces`: string, enum: `read`, `write`\n      * `contents`: string, enum: `read`, `write`\n      * `dependabot_secrets`: string, enum: `read`, `write`\n      * `deployments`: string, enum: `read`, `write`\n      * `discussions`: string, enum: `read`, `write`\n      * `environments`: string, enum: `read`, `write`\n      * `issues`: string, enum: `read`, `write`\n      * `merge_queues`: string, enum: `read`, `write`\n      * `metadata`: string, enum: `read`, `write`\n      * `packages`: string, enum: `read`, `write`\n      * `pages`: string, enum: `read`, `write`\n      * `pull_requests`: string, enum: `read`, `write`\n      * `repository_custom_properties`: string, enum: `read`, `write`\n      * `repository_hooks`: string, enum: `read`, `write`\n      * `repository_projects`: string, enum: `read`, `write`, `admin`\n      * `secret_scanning_alerts`: string, enum: `read`, `write`\n      * `secrets`: string, enum: `read`, `write`\n      * `security_events`: string, enum: `read`, `write`\n      * `single_file`: string, enum: `read`, `write`\n      * `statuses`: string, enum: `read`, `write`\n      * `vulnerability_alerts`: string, enum: `read`, `write`\n      * `workflows`: string, enum: `write`\n      * `custom_properties_for_organizations`: string, enum: `read`, `write`\n      * `members`: string, enum: `read`, `write`\n      * `organization_administration`: string, enum: `read`, `write`\n      * `organization_custom_roles`: string, enum: `read`, `write`\n      * `organization_custom_org_roles`: string, enum: `read`, `write`\n      * `organization_custom_properties`: string, enum: `read`, `write`, `admin`\n      * `organization_copilot_seat_management`: string, enum: `read`, `write`\n      * `organization_copilot_agent_settings`: string, enum: `read`, `write`\n      * `organization_announcement_banners`: string, enum: `read`, `write`\n      * `organization_events`: string, enum: `read`\n      * `organization_hooks`: string, enum: `read`, `write`\n      * `organization_personal_access_tokens`: string, enum: `read`, `write`\n      * `organization_personal_access_token_requests`: string, enum: `read`, `write`\n      * `organization_plan`: string, enum: `read`\n      * `organization_projects`: string, enum: `read`, `write`, `admin`\n      * `organization_packages`: string, enum: `read`, `write`\n      * `organization_secrets`: string, enum: `read`, `write`\n      * `organization_self_hosted_runners`: string, enum: `read`, `write`\n      * `organization_user_blocking`: string, enum: `read`, `write`\n      * `email_addresses`: string, enum: `read`, `write`\n      * `followers`: string, enum: `read`, `write`\n      * `git_ssh_keys`: string, enum: `read`, `write`\n      * `gpg_keys`: string, enum: `read`, `write`\n      * `interaction_limits`: string, enum: `read`, `write`\n      * `profile`: string, enum: `write`\n      * `starring`: string, enum: `read`, `write`\n      * `enterprise_administration`: string, enum: `read`, `write`\n      * `enterprise_custom_properties_for_organizations`: string, enum: `read`, `write`, `admin`\n      * `enterprise_organization_installations`: string, enum: `read`, `write`\n      * `enterprise_organization_installation_repositories`: string, enum: `read`, `write`\n    * `repository_selection`: required, string, enum: `all`, `selected`\n    * `single_file_name`: required, string or null\n    * `has_multiple_single_files`: boolean\n    * `single_file_paths`: array of string\n    * `repositories_url`: required, string, format: uri\n    * `account`: required, `Simple User` (see above)\n* `expires_at`: required, string or null, format: date-time\n\n## Reset a token\n\n```\nPATCH /applications/{client_id}/token\n```\n\nOAuth applications and GitHub applications with OAuth authorizations can use this API method to reset a valid OAuth token without end-user involvement. Applications must save the \"token\" property in the response because changes take effect immediately. Invalid tokens will return 404 NOT FOUND.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`client_id`** (string) (required)\n  The client ID of the GitHub app.\n\n#### Body parameters\n\n- **`access_token`** (string) (required)\n  The access_token of the OAuth or GitHub application.\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PATCH \\\n  https://api.github.com/applications/Iv1.8a61f9b3a7aba766/token \\\n  -d '{\n  \"access_token\": \"e72e16c7e42f292c6912e7710c838347ae178b4a\"\n}'\n```\n\n**Response schema (Status: 200):**\n\nSame response schema as [Check a token](#check-a-token).\n\n## Delete an app token\n\n```\nDELETE /applications/{client_id}/token\n```\n\nOAuth  or GitHub application owners can revoke a single token for an OAuth application or a GitHub application with an OAuth authorization.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`client_id`** (string) (required)\n  The client ID of the GitHub app.\n\n#### Body parameters\n\n- **`access_token`** (string) (required)\n  The OAuth access token used to authenticate to the GitHub API.\n\n### HTTP response status codes\n\n- **204** - No Content\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/applications/Iv1.8a61f9b3a7aba766/token \\\n  -d '{\n  \"access_token\": \"e72e16c7e42f292c6912e7710c838347ae178b4a\"\n}'\n```\n\n**Response schema (Status: 204):**"}