{"meta":{"title":"Конечные точки REST API для авторизации учетных данных предприятия","intro":"Используйте API REST для управления авторизациями корпоративных учетных данных.","product":"REST API","breadcrumbs":[{"href":"/ru/enterprise-cloud@latest/rest","title":"REST API"},{"href":"/ru/enterprise-cloud@latest/rest/enterprise-admin","title":"Администрирование предприятия"},{"href":"/ru/enterprise-cloud@latest/rest/enterprise-admin/credential-authorizations","title":"Авторизации на удостоверения удостоверений"}],"documentType":"article"},"body":"# Конечные точки REST API для авторизации учетных данных предприятия\n\nИспользуйте API REST для управления авторизациями корпоративных учетных данных.\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## Revoke enterprise-delegated credential authorizations\n\n```\nDELETE /enterprises/{enterprise}/credential-authorizations\n```\n\nQueues revocation of every active organization credential authorization created through enterprise\ndelegation for the enterprise. Credential authorizations created through SAML or other flows are not affected.\nThe authenticated GitHub App must be owned by the enterprise or one of its organizations,\ninstalled on the enterprise, and have the enterprise_credentials:write permission.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n- **`integration_id`** (integer)\n  The database ID of a GitHub App currently owned by the enterprise or one of its organizations,\nor a formerly owned GitHub App with delegation history for the enterprise.\nWhen provided, only credential authorizations delegated by that App are revoked. When omitted,\nall enterprise-delegated credential authorizations for the enterprise are revoked.\n\n### HTTP response status codes\n\n- **202** - Delegated credential authorization revocation was queued.\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations\n```\n\n**Response schema (Status: 202):**\n\n* `message`: required, string\n\n## Revoke all credential authorizations for an enterprise\n\n```\nPOST /enterprises/{enterprise}/credential-authorizations/revoke-all\n```\n\nRevokes all credential authorizations for all organizations within the enterprise.\nThis includes any guest, outside, or repository collaborators.\nFor Enterprise Managed User (EMU) enterprises, you can optionally also destroy all\ncredentials (PATs v1, PATs v2, and SSH keys) owned by enterprise members by setting\nthe revoke_credentials parameter to true.\nThis operation is performed asynchronously. A background job will be queued to process\nthe revocations.\nWarning\n\nIf you use a personal access token to call this endpoint, that token may also be\nrevoked or destroyed as part of this operation.\n\nThe authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n#### Body parameters\n\n- **`revoke_credentials`** (boolean)\n  Whether to also destroy the actual credentials (PATs and SSH keys) owned by\nenterprise members. This option is only available for Enterprise Managed User\n(EMU) enterprises. When set to true, all PATs (v1 and v2) and SSH keys owned\nby enterprise members will be destroyed in addition to the credential authorizations.\n  Default: `false`\n\n### HTTP response status codes\n\n- **202** - Accepted - The revocation request has been queued\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation error - The revoke_credentials option is only available for EMU enterprises\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/revoke-all \\\n  -d '{\n  \"revoke_credentials\": false\n}'\n```\n\n**Response schema (Status: 202):**\n\n* `message`: string\n* `warning`: string\n\n## Revoke a single credential type for an enterprise\n\n```\nPOST /enterprises/{enterprise}/credential-authorizations/revoke-credential-type\n```\n\nRevokes a single credential type (for example, classic personal access tokens)\nacross all organizations within the enterprise. This removes the sign-in\nauthorizations for that credential type for every member of the enterprise.\nFor Enterprise Managed User (EMU) enterprises, you can optionally also destroy the\nactual credentials of that type owned by enterprise members by setting the\nrevoke_credentials parameter to true.\nThis operation is performed asynchronously. A background job will be queued to process\nthe revocations.\nWarning\n\nIf you use a personal access token to call this endpoint, that token may also be\nrevoked or destroyed as part of this operation.\n\nThe authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n#### Body parameters\n\n- **`credential_type`** (string) (required)\n  The type of credential to revoke across the enterprise.\n  Can be one of: `classic_pat`, `fine_grained_pat`, `ssh_key`, `oauth_app_token`\n\n- **`revoke_credentials`** (boolean)\n  Whether to also destroy the actual credentials of this type owned by\nenterprise members. This option is only available for Enterprise Managed\nUser (EMU) enterprises. When set to true, all credentials of the given\ntype owned by enterprise members will be destroyed in addition to the\ncredential authorizations. Note that oauth_app_token credentials cannot\nbe destroyed; for that type only the credential authorizations are revoked.\n  Default: `false`\n\n### HTTP response status codes\n\n- **202** - Accepted - The revocation request has been queued\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation error - The credential_type is missing or invalid, or revoke_credentials is not available for this enterprise\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/revoke-credential-type \\\n  -d '{\n  \"credential_type\": \"classic_pat\",\n  \"revoke_credentials\": false\n}'\n```\n\n**Response schema (Status: 202):**\n\nSame response schema as [Revoke all credential authorizations for an enterprise](#revoke-all-credential-authorizations-for-an-enterprise).\n\n## Revoke credential authorizations for a user in an enterprise\n\n```\nPOST /enterprises/{enterprise}/credential-authorizations/{username}/revoke\n```\n\nRevokes all credential authorizations for a single user within the enterprise.\nThis includes any credential authorizations the user has across all organizations\nin the enterprise.\nFor Enterprise Managed User (EMU) enterprises, you can optionally also destroy all\ncredentials (PATs v1, PATs v2, and SSH keys) owned by the user by setting\nthe revoke_credentials parameter to true.\nThis operation is performed asynchronously. A background job will be queued to process\nthe revocations.\nWarning\n\nIf you use a personal access token to call this endpoint and target yourself, that\ntoken may also be revoked or destroyed as part of this operation.\n\nThe authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n#### Body parameters\n\n- **`revoke_credentials`** (boolean)\n  Whether to also destroy the actual credentials (PATs and SSH keys) owned by\nthe user. This option is only available for Enterprise Managed User (EMU)\nenterprises. When set to true, all PATs (v1 and v2) and SSH keys owned\nby the user will be destroyed in addition to the credential authorizations.\n  Default: `false`\n\n### HTTP response status codes\n\n- **202** - Accepted - The revocation request has been queued\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation error - The target user cannot be revoked, or revoke_credentials is not available for this enterprise\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/USERNAME/revoke \\\n  -d '{\n  \"revoke_credentials\": false\n}'\n```\n\n**Response schema (Status: 202):**\n\nSame response schema as [Revoke all credential authorizations for an enterprise](#revoke-all-credential-authorizations-for-an-enterprise).\n\n## Revoke a single credential type for a user in an enterprise\n\n```\nPOST /enterprises/{enterprise}/credential-authorizations/{username}/revoke-credential-type\n```\n\nRevokes a single credential type (for example, classic personal access tokens)\nfor a single user within the enterprise. This removes the sign-in authorizations\nfor that credential type across all organizations in the enterprise for the user.\nFor Enterprise Managed User (EMU) enterprises, you can optionally also destroy the\nactual credential of that type owned by the user by setting the revoke_credentials\nparameter to true.\nThis operation is performed asynchronously. A background job will be queued to process\nthe revocations.\nWarning\n\nIf you use a personal access token to call this endpoint and target yourself, that\ntoken may also be revoked or destroyed as part of this operation.\n\nThe authenticated user must be an enterprise owner or have the write_enterprise_credentials permission to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the admin:enterprise scope to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`enterprise`** (string) (required)\n  The slug version of the enterprise name.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n#### Body parameters\n\n- **`credential_type`** (string) (required)\n  The type of credential to revoke for the user.\n  Can be one of: `classic_pat`, `fine_grained_pat`, `ssh_key`, `oauth_app_token`\n\n- **`revoke_credentials`** (boolean)\n  Whether to also destroy the actual credential of this type owned by the\nuser. This option is only available for Enterprise Managed User (EMU)\nenterprises. When set to true, the credential of the given type owned\nby the user will be destroyed in addition to the credential authorizations.\nNote that oauth_app_token credentials cannot be destroyed; for that type\nonly the credential authorizations are revoked.\n  Default: `false`\n\n### HTTP response status codes\n\n- **202** - Accepted - The revocation request has been queued\n\n- **403** - Forbidden\n\n- **404** - Resource not found\n\n- **422** - Validation error - The credential_type is missing or invalid, the target user cannot be revoked, or revoke_credentials is not available for this enterprise\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X POST \\\n  https://api.github.com/enterprises/ENTERPRISE/credential-authorizations/USERNAME/revoke-credential-type \\\n  -d '{\n  \"credential_type\": \"classic_pat\",\n  \"revoke_credentials\": false\n}'\n```\n\n**Response schema (Status: 202):**\n\nSame response schema as [Revoke all credential authorizations for an enterprise](#revoke-all-credential-authorizations-for-an-enterprise)."}