GitHub

Gets GitHub Actions cache retention limit for an enterprise. All organizations and repositories under this enterprise may not set a higher cache retention limit. OAuth tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Sets GitHub Actions cache retention limit for an enterprise. All organizations and repositories under this enterprise may not set a higher cache retention limit. OAuth tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-retention-limit-for-enterprise"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-retention-limit"
        }
      }
    }
  },
  "required": true
}

Gets GitHub Actions cache storage limit for an enterprise. All organizations and repositories under this enterprise may not set a higher cache storage limit. OAuth tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

Sets GitHub Actions cache storage limit for an enterprise. All organizations and repositories under this enterprise may not set a higher cache storage limit. OAuth tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-storage-limit-for-enterprise"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-storage-limit"
        }
      }
    }
  },
  "required": true
}

Gets GitHub Actions cache retention limit for an organization. All repositories under this organization may not set a higher cache retention limit. OAuth tokens and personal access tokens (classic) need the `admin:organization` scope to use this endpoint.

Sets GitHub Actions cache retention limit for an organization. All repositories under this organization may not set a higher cache retention limit. OAuth tokens and personal access tokens (classic) need the `admin:organization` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-retention-limit-for-organization"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-retention-limit"
        }
      }
    }
  },
  "required": true
}

Gets GitHub Actions cache storage limit for an organization. All repositories under this organization may not set a higher cache storage limit. OAuth tokens and personal access tokens (classic) need the `admin:organization` scope to use this endpoint.

Sets GitHub Actions cache storage limit for an organization. All organizations and repositories under this organization may not set a higher cache storage limit. OAuth tokens and personal access tokens (classic) need the `admin:organization` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-storage-limit-for-organization"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-storage-limit"
        }
      }
    }
  },
  "required": true
}

Gets the total GitHub Actions cache usage for an organization. The data fetched using this API is refreshed approximately every 5 minutes, so values returned from this endpoint may take at least 5 minutes to get updated. OAuth tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.

Lists repositories and their GitHub Actions cache usage for an organization. The data fetched using this API is refreshed approximately every 5 minutes, so values returned from this endpoint may take at least 5 minutes to get updated. OAuth tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.

Lists all GitHub-hosted runners configured in an organization. OAuth app tokens and personal access tokens (classic) need the `manage_runner:org` scope to use this endpoint.

Creates a GitHub-hosted runner for an organization. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name",
          "image",
          "size",
          "runner_group_id"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "Name of the runner. Must be between 1 and 64 characters and may only contain upper and lowercase letters a-z, numbers 0-9, '.', '-', and '_'."
          },
          "size": {
            "type": "string",
            "description": "The machine size of the runner. To list available sizes, use `GET actions/hosted-runners/machine-sizes`"
          },
          "image": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "description": "The unique identifier of the runner image."
              },
              "source": {
                "enum": [
                  "github",
                  "partner",
                  "custom"
                ],
                "type": "string",
                "description": "The source of the runner image."
              },
              "version": {
                "type": "string",
                "nullable": true,
                "description": "The version of the runner image to deploy. This is relevant only for runners using custom images."
              }
            },
            "description": "The image of runner. To list all available images, use `GET /actions/hosted-runners/images/github-owned` or `GET /actions/hosted-runners/images/partner`."
          },
          "image_gen": {
            "type": "boolean",
            "default": false,
            "description": "Whether this runner should be used to generate custom images."
          },
          "maximum_runners": {
            "type": "integer",
            "description": "The maximum amount of runners to scale up to. Runners will not auto-scale above this number. Use this setting to limit your cost."
          },
          "runner_group_id": {
            "type": "integer",
            "description": "The existing runner group to add this runner to."
          },
          "enable_static_ip": {
            "type": "boolean",
            "description": "Whether this runner should be created with a static public IP. Note limit on account. To list limits on account, use `GET actions/hosted-runners/limits`"
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "My Hosted runner",
            "size": "4-core",
            "image": {
              "id": "ubuntu-latest",
              "source": "github"
            },
            "maximum_runners": 50,
            "runner_group_id": 1,
            "enable_static_ip": false
          }
        }
      }
    }
  },
  "required": true
}

List custom images for an organization. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Delete a custom image from the organization. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Get a custom image definition for GitHub Actions Hosted Runners. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

List image versions of a custom image for an organization. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Delete an image version of custom image from the organization. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Get an image version of a custom image for GitHub Actions Hosted Runners. OAuth tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Get the list of GitHub-owned images available for GitHub-hosted runners for an organization.

Get the list of partner images available for GitHub-hosted runners for an organization.

Get the GitHub-hosted runners limits for an organization.

Get the list of machine specs available for GitHub-hosted runners for an organization.

Get the list of platforms available for GitHub-hosted runners for an organization.

Deletes a GitHub-hosted runner for an organization.

Gets a GitHub-hosted runner configured in an organization. OAuth app tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

Updates a GitHub-hosted runner for an organization. OAuth app tokens and personal access tokens (classic) need the `manage_runners:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "Name of the runner. Must be between 1 and 64 characters and may only contain upper and lowercase letters a-z, numbers 0-9, '.', '-', and '_'."
          },
          "size": {
            "type": "string",
            "description": "The machine size of the runner. To list available sizes, use `GET actions/hosted-runners/machine-sizes`"
          },
          "image_id": {
            "type": "string",
            "description": "The unique identifier of the runner image. To list available images, use `GET /actions/hosted-runners/images/github-owned`, `GET /actions/hosted-runners/images/partner`, or `GET /actions/hosted-runners/images/custom`."
          },
          "image_version": {
            "type": "string",
            "nullable": true,
            "description": "The version of the runner image to deploy. This is relevant only for runners using custom images."
          },
          "maximum_runners": {
            "type": "integer",
            "description": "The maximum amount of runners to scale up to. Runners will not auto-scale above this number. Use this setting to limit your cost."
          },
          "runner_group_id": {
            "type": "integer",
            "description": "The existing runner group to add this runner to."
          },
          "enable_static_ip": {
            "type": "boolean",
            "description": "Whether this runner should be updated with a static public IP. Note limit on account. To list limits on account, use `GET actions/hosted-runners/limits`"
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "My larger runner",
            "maximum_runners": 50,
            "runner_group_id": 1,
            "enable_static_ip": false
          }
        }
      }
    }
  },
  "required": true
}

Gets the GitHub Actions permissions policy for repositories and allowed actions and reusable workflows in an organization. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Sets the GitHub Actions permissions policy for repositories and allowed actions and reusable workflows in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "enabled_repositories"
        ],
        "properties": {
          "allowed_actions": {
            "$ref": "#/components/schemas/allowed-actions"
          },
          "enabled_repositories": {
            "$ref": "#/components/schemas/enabled-repositories"
          },
          "sha_pinning_required": {
            "$ref": "#/components/schemas/sha-pinning-required"
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "allowed_actions": "selected",
            "enabled_repositories": "all",
            "sha_pinning_required": true
          }
        }
      }
    }
  },
  "required": true
}

Gets artifact and log retention settings for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Sets artifact and log retention settings for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-artifact-and-log-retention"
      },
      "examples": {
        "application/json": {
          "value": {
            "days": 100
          }
        }
      }
    }
  },
  "required": true
}

Gets the fork PR contributor approval policy for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Sets the fork PR contributor approval policy for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-fork-pr-contributor-approval"
      },
      "examples": {
        "default": {
          "value": {
            "approval_policy": "first_time_contributors"
          },
          "summary": "Set approval policy to first time contributors"
        }
      }
    }
  },
  "required": true
}

Gets the settings for whether workflows from fork pull requests can run on private repositories in an organization.

Sets the settings for whether workflows from fork pull requests can run on private repositories in an organization.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-fork-pr-workflows-private-repos-request"
      },
      "examples": {
        "default": {
          "$ref": "#/components/examples/actions-fork-pr-workflows-private-repos"
        }
      }
    }
  },
  "required": true
}

Lists the selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for `enabled_repositories` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Replaces the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for `enabled_repositories` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "selected_repository_ids"
        ],
        "properties": {
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer",
              "description": "Unique identifier of the repository."
            },
            "description": "List of repository IDs to enable for GitHub Actions."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "selected_repository_ids": [
              32,
              42
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a repository from the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for `enabled_repositories` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Adds a repository to the list of selected repositories that are enabled for GitHub Actions in an organization. To use this endpoint, the organization permission policy for `enabled_repositories` must be must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Gets the selected actions and reusable workflows that are allowed in an organization. To use this endpoint, the organization permission policy for `allowed_actions` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Sets the actions and reusable workflows that are allowed in an organization. To use this endpoint, the organization permission policy for `allowed_actions` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for an organization](#set-github-actions-permissions-for-an-organization)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/selected-actions"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/selected-actions"
        }
      }
    }
  },
  "required": false
}

Gets the settings for self-hosted runners for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Sets the settings for self-hosted runners for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "enabled_repositories"
        ],
        "properties": {
          "enabled_repositories": {
            "enum": [
              "all",
              "selected",
              "none"
            ],
            "type": "string",
            "description": "The policy that controls whether self-hosted runners can be used in the organization"
          }
        }
      },
      "examples": {
        "application/json": {
          "value": {
            "enabled_repositories": "all"
          }
        }
      }
    }
  },
  "required": true
}

Lists repositories that are allowed to use self-hosted runners in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Sets repositories that are allowed to use self-hosted runners in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "selected_repository_ids"
        ],
        "properties": {
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "IDs of repositories that can use repository-level self-hosted runners"
          }
        }
      },
      "examples": {
        "application/json": {
          "value": {
            "selected_repository_ids": [
              1,
              2,
              3
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a repository from the list of repositories that are allowed to use self-hosted runners in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Adds a repository to the list of repositories that are allowed to use self-hosted runners in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope or the "Actions policies" fine-grained permission to use this endpoint.

Gets the default workflow permissions granted to the `GITHUB_TOKEN` when running workflows in an organization, as well as whether GitHub Actions can submit approving pull request reviews. For more information, see "[Setting the permissions of the GITHUB_TOKEN for your organization](https://docs.github.com/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization)." OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Sets the default workflow permissions granted to the `GITHUB_TOKEN` when running workflows in an organization, and sets if GitHub Actions can submit approving pull request reviews. For more information, see "[Setting the permissions of the GITHUB_TOKEN for your organization](https://docs.github.com/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-set-default-workflow-permissions"
      },
      "examples": {
        "default": {
          "$ref": "#/components/examples/actions-default-workflow-permissions"
        }
      }
    }
  },
  "required": false
}

Lists all self-hosted runner groups configured in an organization and inherited from an enterprise. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Creates a new self-hosted runner group for an organization. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "Name of the runner group."
          },
          "runners": {
            "type": "array",
            "items": {
              "type": "integer",
              "description": "Unique identifier of the runner."
            },
            "description": "List of runner IDs to add to the runner group."
          },
          "visibility": {
            "enum": [
              "selected",
              "all",
              "private"
            ],
            "type": "string",
            "default": "all",
            "description": "Visibility of a runner group. You can select all repositories, select individual repositories, or limit access to private repositories."
          },
          "selected_workflows": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "octo-org/octo-repo/.github/workflows/deploy.yaml@main",
              "description": "Name of workflow the runner group should be allowed to run. Note that a ref, tag, or long SHA is required."
            },
            "description": "List of workflows the runner group should be allowed to run. This setting will be ignored unless `restricted_to_workflows` is set to `true`."
          },
          "restricted_to_workflows": {
            "type": "boolean",
            "default": false,
            "description": "If `true`, the runner group will be restricted to running only the workflows specified in the `selected_workflows` array."
          },
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer",
              "description": "Unique identifier of the repository."
            },
            "description": "List of repository IDs that can access the runner group."
          },
          "network_configuration_id": {
            "type": "string",
            "description": "The identifier of a hosted compute network configuration."
          },
          "allows_public_repositories": {
            "type": "boolean",
            "default": false,
            "description": "Whether the runner group can be used by `public` repositories."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "Expensive hardware runners",
            "runners": [
              9,
              2
            ],
            "visibility": "selected",
            "selected_repository_ids": [
              32,
              91
            ]
          }
        }
      }
    }
  },
  "required": true
}

Deletes a self-hosted runner group for an organization. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Gets a specific self-hosted runner group for an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Updates the `name` and `visibility` of a self-hosted runner group in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "Name of the runner group."
          },
          "visibility": {
            "enum": [
              "selected",
              "all",
              "private"
            ],
            "type": "string",
            "description": "Visibility of a runner group. You can select all repositories, select individual repositories, or all private repositories."
          },
          "selected_workflows": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "octo-org/octo-repo/.github/workflows/deploy.yaml@main",
              "description": "Name of workflow the runner group should be allowed to run. Note that a ref, tag, or long SHA is required."
            },
            "description": "List of workflows the runner group should be allowed to run. This setting will be ignored unless `restricted_to_workflows` is set to `true`."
          },
          "restricted_to_workflows": {
            "type": "boolean",
            "default": false,
            "description": "If `true`, the runner group will be restricted to running only the workflows specified in the `selected_workflows` array."
          },
          "network_configuration_id": {
            "type": "string",
            "nullable": true,
            "description": "The identifier of a hosted compute network configuration."
          },
          "allows_public_repositories": {
            "type": "boolean",
            "default": false,
            "description": "Whether the runner group can be used by `public` repositories."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "Expensive hardware runners",
            "visibility": "selected"
          }
        }
      }
    }
  },
  "required": true
}

Lists the GitHub-hosted runners in an organization group. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Lists the repositories with access to a self-hosted runner group configured in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Replaces the list of repositories that have access to a self-hosted runner group configured in an organization. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "selected_repository_ids"
        ],
        "properties": {
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer",
              "description": "Unique identifier of the repository."
            },
            "description": "List of repository IDs that can access the runner group."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "selected_repository_ids": [
              32,
              91
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a repository from the list of selected repositories that can access a self-hosted runner group. The runner group must have `visibility` set to `selected`. For more information, see "[Create a self-hosted runner group for an organization](#create-a-self-hosted-runner-group-for-an-organization)." OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Adds a repository to the list of repositories that can access a self-hosted runner group. The runner group must have `visibility` set to `selected`. For more information, see "[Create a self-hosted runner group for an organization](#create-a-self-hosted-runner-group-for-an-organization)." OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Lists self-hosted runners that are in a specific organization group. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Replaces the list of self-hosted runners that are part of an organization runner group. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "runners"
        ],
        "properties": {
          "runners": {
            "type": "array",
            "items": {
              "type": "integer",
              "description": "Unique identifier of the runner."
            },
            "description": "List of runner IDs to add to the runner group."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "runners": [
              9,
              2
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a self-hosted runner from a group configured in an organization. The runner is then returned to the default group. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Adds a self-hosted runner to a runner group configured in an organization. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

Lists all self-hosted runners configured in an organization. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Lists binaries for the runner application that you can download and run. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Generates a configuration that can be passed to the runner application at startup. The authenticated user must have admin access to the organization. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name",
          "runner_group_id",
          "labels"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "The name of the new runner."
          },
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "description": "The names of the custom labels to add to the runner. **Minimum items**: 1. **Maximum items**: 100."
          },
          "work_folder": {
            "type": "string",
            "default": "_work",
            "description": "The working directory to be used for job execution, relative to the runner install directory."
          },
          "runner_group_id": {
            "type": "integer",
            "description": "The ID of the runner group to register the runner to."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "New runner",
            "labels": [
              "self-hosted",
              "X64",
              "macOS",
              "no-gpu"
            ],
            "work_folder": "_work",
            "runner_group_id": 1
          }
        }
      }
    }
  },
  "required": true
}

Returns a token that you can pass to the `config` script. The token expires after one hour. For example, you can replace `TOKEN` in the following example with the registration token provided by this endpoint to configure your self-hosted runner: ``` ./config.sh --url https://github.com/octo-org --token TOKEN ``` Authenticated users must have admin access to the organization to use this endpoint. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Returns a token that you can pass to the `config` script to remove a self-hosted runner from an organization. The token expires after one hour. For example, you can replace `TOKEN` in the following example with the registration token provided by this endpoint to remove your self-hosted runner from an organization: ``` ./config.sh remove --token TOKEN ``` Authenticated users must have admin access to the organization to use this endpoint. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Forces the removal of a self-hosted runner from an organization. You can use this endpoint to completely remove the runner when the machine you were using no longer exists. Authenticated users must have admin access to the organization to use this endpoint. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific self-hosted runner configured in an organization. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Remove all custom labels from a self-hosted runner configured in an organization. Returns the remaining read-only labels from the runner. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Lists all labels for a self-hosted runner configured in an organization. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Adds custom labels to a self-hosted runner configured in an organization. Authenticated users must have admin access to the organization to use this endpoint. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "labels"
        ],
        "properties": {
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "description": "The names of the custom labels to add to the runner."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "labels": [
              "gpu",
              "accelerated"
            ]
          }
        }
      }
    }
  },
  "required": true
}

Remove all previous custom labels and set the new custom labels for a specific self-hosted runner configured in an organization. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "labels"
        ],
        "properties": {
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 0,
            "description": "The names of the custom labels to set for the runner. You can pass an empty array to remove all custom labels."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "labels": [
              "gpu",
              "accelerated"
            ]
          }
        }
      }
    }
  },
  "required": true
}

Remove a custom label from a self-hosted runner configured in an organization. Returns the remaining labels from the runner. This endpoint returns a `404 Not Found` status if the custom label is not present on the runner. Authenticated users must have admin access to the organization to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Lists all secrets available in an organization without revealing their encrypted values. Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Gets your public key, which you need to encrypt secrets. You need to encrypt a secret before you can create or update secrets. The authenticated user must have collaborator access to a repository to create, update, or read secrets. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Deletes a secret in an organization using the secret name. Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a single organization secret without revealing its encrypted value. The authenticated user must have collaborator access to a repository to create, update, or read secrets OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Creates or updates an organization secret with an encrypted value. Encrypt your secret using [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). For more information, see "[Encrypting secrets for the REST API](https://docs.github.com/rest/guides/encrypting-secrets-for-the-rest-api)." Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "encrypted_value",
          "key_id",
          "visibility"
        ],
        "properties": {
          "key_id": {
            "type": "string",
            "description": "ID of the key you used to encrypt the secret."
          },
          "visibility": {
            "enum": [
              "all",
              "private",
              "selected"
            ],
            "type": "string",
            "description": "Which type of organization repositories have access to the organization secret. `selected` means only the repositories specified by `selected_repository_ids` can access the secret."
          },
          "encrypted_value": {
            "type": "string",
            "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$",
            "description": "Value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get an organization public key](https://docs.github.com/rest/actions/secrets#get-an-organization-public-key) endpoint."
          },
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "An array of repository ids that can access the organization secret. You can only provide a list of repository ids when the `visibility` is set to `selected`. You can manage the list of selected repositories using the [List selected repositories for an organization secret](https://docs.github.com/rest/actions/secrets#list-selected-repositories-for-an-organization-secret), [Set selected repositories for an organization secret](https://docs.github.com/rest/actions/secrets#set-selected-repositories-for-an-organization-secret), and [Remove selected repository from an organization secret](https://docs.github.com/rest/actions/secrets#remove-selected-repository-from-an-organization-secret) endpoints."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "key_id": "012345678912345678",
            "visibility": "selected",
            "encrypted_value": "c2VjcmV0",
            "selected_repository_ids": [
              1296269,
              1296280
            ]
          }
        }
      }
    }
  },
  "required": true
}

Lists all repositories that have been selected when the `visibility` for repository access to a secret is set to `selected`. Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Replaces all repositories for an organization secret when the `visibility` for repository access is set to `selected`. The visibility is set when you [Create or update an organization secret](https://docs.github.com/rest/actions/secrets#create-or-update-an-organization-secret). Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "selected_repository_ids"
        ],
        "properties": {
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "An array of repository ids that can access the organization secret. You can only provide a list of repository ids when the `visibility` is set to `selected`. You can add and remove individual repositories using the [Add selected repository to an organization secret](https://docs.github.com/rest/actions/secrets#add-selected-repository-to-an-organization-secret) and [Remove selected repository from an organization secret](https://docs.github.com/rest/actions/secrets#remove-selected-repository-from-an-organization-secret) endpoints."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "selected_repository_ids": [
              64780797
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a repository from an organization secret when the `visibility` for repository access is set to `selected`. The visibility is set when you [Create or update an organization secret](https://docs.github.com/rest/actions/secrets#create-or-update-an-organization-secret). Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Adds a repository to an organization secret when the `visibility` for repository access is set to `selected`. For more information about setting the visibility, see [Create or update an organization secret](https://docs.github.com/rest/actions/secrets#create-or-update-an-organization-secret). Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists all organization variables. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Creates an organization variable that you can reference in a GitHub Actions workflow. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name",
          "value",
          "visibility"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "The name of the variable."
          },
          "value": {
            "type": "string",
            "description": "The value of the variable."
          },
          "visibility": {
            "enum": [
              "all",
              "private",
              "selected"
            ],
            "type": "string",
            "description": "The type of repositories in the organization that can access the variable. `selected` means only the repositories specified by `selected_repository_ids` can access the variable."
          },
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "An array of repository ids that can access the organization variable. You can only provide a list of repository ids when the `visibility` is set to `selected`."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "USERNAME",
            "value": "octocat",
            "visibility": "selected",
            "selected_repository_ids": [
              1296269,
              1296280
            ]
          }
        }
      }
    }
  },
  "required": true
}

Deletes an organization variable using the variable name. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific variable in an organization. The authenticated user must have collaborator access to a repository to create, update, or read variables. OAuth tokens and personal access tokens (classic) need the`admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Updates an organization variable that you can reference in a GitHub Actions workflow. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "The name of the variable."
          },
          "value": {
            "type": "string",
            "description": "The value of the variable."
          },
          "visibility": {
            "enum": [
              "all",
              "private",
              "selected"
            ],
            "type": "string",
            "description": "The type of repositories in the organization that can access the variable. `selected` means only the repositories specified by `selected_repository_ids` can access the variable."
          },
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "An array of repository ids that can access the organization variable. You can only provide a list of repository ids when the `visibility` is set to `selected`."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "USERNAME",
            "value": "octocat",
            "visibility": "selected",
            "selected_repository_ids": [
              1296269,
              1296280
            ]
          }
        }
      }
    }
  },
  "required": true
}

Lists all repositories that can access an organization variable that is available to selected repositories. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Replaces all repositories for an organization variable that is available to selected repositories. Organization variables that are available to selected repositories have their `visibility` field set to `selected`. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "selected_repository_ids"
        ],
        "properties": {
          "selected_repository_ids": {
            "type": "array",
            "items": {
              "type": "integer"
            },
            "description": "The IDs of the repositories that can access the organization variable."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "selected_repository_ids": [
              64780797
            ]
          }
        }
      }
    }
  },
  "required": true
}

Removes a repository from an organization variable that is available to selected repositories. Organization variables that are available to selected repositories have their `visibility` field set to `selected`. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, the `repo` scope is also required.

Adds a repository to an organization variable that is available to selected repositories. Organization variables that are available to selected repositories have their `visibility` field set to `selected`. Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists all artifacts for a repository. Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Deletes an artifact for a workflow run. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific artifact for a workflow run. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a redirect URL to download an archive for a repository. This URL expires after 1 minute. Look for `Location:` in the response header to find the URL for the download. The `:archive_format` must be `zip`. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets GitHub Actions cache retention limit for a repository. This determines how long caches will be retained for, if not manually removed or evicted due to size constraints. OAuth tokens and personal access tokens (classic) need the `admin:repository` scope to use this endpoint.

Sets GitHub Actions cache retention limit for a repository. This determines how long caches will be retained for, if not manually removed or evicted due to size constraints. OAuth tokens and personal access tokens (classic) need the `admin:repository` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-retention-limit-for-repository"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-retention-limit"
        }
      }
    }
  },
  "required": true
}

Gets GitHub Actions cache storage limit for a repository. This determines the maximum size of caches that can be stored before eviction occurs. OAuth tokens and personal access tokens (classic) need the `admin:repository` scope to use this endpoint.

Sets GitHub Actions cache storage limit for a repository. This determines the maximum size of caches that can be stored before eviction occurs. OAuth tokens and personal access tokens (classic) need the `admin:repository` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-cache-storage-limit-for-repository"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/actions-cache-storage-limit"
        }
      }
    }
  },
  "required": true
}

Gets GitHub Actions cache usage for a repository. The data fetched using this API is refreshed approximately every 5 minutes, so values returned from this endpoint may take at least 5 minutes to get updated. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Deletes one or more GitHub Actions caches for a repository, using a complete cache key. By default, all caches that match the provided key are deleted, but you can optionally provide a Git ref to restrict deletions to caches that match both the provided key and the Git ref. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists the GitHub Actions caches for a repository. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Deletes a GitHub Actions cache for a repository, using a cache ID. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific job in a workflow run. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a redirect URL to download a plain text file of logs for a workflow job. This link expires after 1 minute. Look for `Location:` in the response header to find the URL for the download. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Re-run a job and its dependent jobs in a workflow run. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "nullable": true,
        "properties": {
          "enable_debug_logging": {
            "type": "boolean",
            "default": false,
            "description": "Whether to enable debug logging for the re-run."
          }
        }
      },
      "examples": {
        "default": {
          "value": null
        }
      }
    }
  },
  "required": false
}

Gets the customization template for an OpenID Connect (OIDC) subject claim. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the customization template and `opt-in` or `opt-out` flag for an OpenID Connect (OIDC) subject claim for a repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "title": "Actions OIDC subject customization for a repository",
        "required": [
          "use_default"
        ],
        "properties": {
          "use_default": {
            "type": "boolean",
            "description": "Whether to use the default template or not. If `true`, the `include_claim_keys` field is ignored."
          },
          "include_claim_keys": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Array of unique strings. Each claim key can only contain alphanumeric characters and underscores."
          }
        },
        "description": "Actions OIDC subject customization for a repository"
      },
      "examples": {
        "default": {
          "value": {
            "use_default": false,
            "include_claim_keys": [
              "repo",
              "context"
            ]
          }
        }
      }
    }
  },
  "required": true
}

Lists all organization secrets shared with a repository without revealing their encrypted values. Authenticated users must have collaborator access to a repository to create, update, or read secrets. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists all organization variables shared with a repository. Authenticated users must have collaborator access to a repository to create, update, or read variables. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets the GitHub Actions permissions policy for a repository, including whether GitHub Actions is enabled and the actions and reusable workflows allowed to run in the repository. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the GitHub Actions permissions policy for enabling GitHub Actions and allowed actions and reusable workflows in the repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "enabled"
        ],
        "properties": {
          "enabled": {
            "$ref": "#/components/schemas/actions-enabled"
          },
          "allowed_actions": {
            "$ref": "#/components/schemas/allowed-actions"
          },
          "sha_pinning_required": {
            "$ref": "#/components/schemas/sha-pinning-required"
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "enabled": true,
            "allowed_actions": "selected",
            "sha_pinning_required": true
          }
        }
      }
    }
  },
  "required": true
}

Gets the level of access that workflows outside of the repository have to actions and reusable workflows in the repository. This endpoint only applies to private repositories. For more information, see "[Allowing access to components in a private repository](https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-access-to-components-in-a-private-repository)." OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the level of access that workflows outside of the repository have to actions and reusable workflows in the repository. This endpoint only applies to private repositories. For more information, see "[Allowing access to components in a private repository](https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-access-to-components-in-a-private-repository)". OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-workflow-access-to-repository"
      },
      "examples": {
        "default": {
          "$ref": "#/components/examples/actions-workflow-access-to-repository"
        }
      }
    }
  },
  "required": true
}

Gets artifact and log retention settings for a repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets artifact and log retention settings for a repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-artifact-and-log-retention"
      },
      "examples": {
        "default": {
          "value": {
            "days": 90
          },
          "summary": "Set retention days"
        }
      }
    }
  },
  "required": true
}

Gets the fork PR contributor approval policy for a repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the fork PR contributor approval policy for a repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-fork-pr-contributor-approval"
      },
      "examples": {
        "default": {
          "value": {
            "approval_policy": "first_time_contributors"
          },
          "summary": "Set approval policy to first time contributors"
        }
      }
    }
  },
  "required": true
}

Gets the settings for whether workflows from fork pull requests can run on a private repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the settings for whether workflows from fork pull requests can run on a private repository. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-fork-pr-workflows-private-repos-request"
      },
      "examples": {
        "default": {
          "$ref": "#/components/examples/actions-fork-pr-workflows-private-repos"
        }
      }
    }
  },
  "required": true
}

Gets the settings for selected actions and reusable workflows that are allowed in a repository. To use this endpoint, the repository policy for `allowed_actions` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for a repository](#set-github-actions-permissions-for-a-repository)." OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the actions and reusable workflows that are allowed in a repository. To use this endpoint, the repository permission policy for `allowed_actions` must be configured to `selected`. For more information, see "[Set GitHub Actions permissions for a repository](#set-github-actions-permissions-for-a-repository)." OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/selected-actions"
      },
      "examples": {
        "selected_actions": {
          "$ref": "#/components/examples/selected-actions"
        }
      }
    }
  },
  "required": false
}

Gets the default workflow permissions granted to the `GITHUB_TOKEN` when running workflows in a repository, as well as if GitHub Actions can submit approving pull request reviews. For more information, see "[Setting the permissions of the GITHUB_TOKEN for your repository](https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository)." OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Sets the default workflow permissions granted to the `GITHUB_TOKEN` when running workflows in a repository, and sets if GitHub Actions can submit approving pull request reviews. For more information, see "[Setting the permissions of the GITHUB_TOKEN for your repository](https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository)." OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "$ref": "#/components/schemas/actions-set-default-workflow-permissions"
      },
      "examples": {
        "default": {
          "$ref": "#/components/examples/actions-default-workflow-permissions"
        }
      }
    }
  },
  "required": true
}

Lists all self-hosted runners configured in a repository. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists binaries for the runner application that you can download and run. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Generates a configuration that can be passed to the runner application at startup. The authenticated user must have admin access to the repository. OAuth tokens and personal access tokens (classic) need the`repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "name",
          "runner_group_id",
          "labels"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "The name of the new runner."
          },
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "description": "The names of the custom labels to add to the runner. **Minimum items**: 1. **Maximum items**: 100."
          },
          "work_folder": {
            "type": "string",
            "default": "_work",
            "description": "The working directory to be used for job execution, relative to the runner install directory."
          },
          "runner_group_id": {
            "type": "integer",
            "description": "The ID of the runner group to register the runner to."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "name": "New runner",
            "labels": [
              "self-hosted",
              "X64",
              "macOS",
              "no-gpu"
            ],
            "work_folder": "_work",
            "runner_group_id": 1
          }
        }
      }
    }
  },
  "required": true
}

Returns a token that you can pass to the `config` script. The token expires after one hour. For example, you can replace `TOKEN` in the following example with the registration token provided by this endpoint to configure your self-hosted runner: ``` ./config.sh --url https://github.com/octo-org --token TOKEN ``` Authenticated users must have admin access to the repository to use this endpoint. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Returns a token that you can pass to the `config` script to remove a self-hosted runner from an repository. The token expires after one hour. For example, you can replace `TOKEN` in the following example with the registration token provided by this endpoint to remove your self-hosted runner from an organization: ``` ./config.sh remove --token TOKEN ``` Authenticated users must have admin access to the repository to use this endpoint. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Forces the removal of a self-hosted runner from a repository. You can use this endpoint to completely remove the runner when the machine you were using no longer exists. Authenticated users must have admin access to the repository to use this endpoint. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific self-hosted runner configured in a repository. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Remove all custom labels from a self-hosted runner configured in a repository. Returns the remaining read-only labels from the runner. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists all labels for a self-hosted runner configured in a repository. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Adds custom labels to a self-hosted runner configured in a repository. Authenticated users must have admin access to the organization to use this endpoint. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "labels"
        ],
        "properties": {
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 1,
            "description": "The names of the custom labels to add to the runner."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "labels": [
              "gpu",
              "accelerated"
            ]
          }
        }
      }
    }
  },
  "required": true
}

Remove all previous custom labels and set the new custom labels for a specific self-hosted runner configured in a repository. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "labels"
        ],
        "properties": {
          "labels": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "maxItems": 100,
            "minItems": 0,
            "description": "The names of the custom labels to set for the runner. You can pass an empty array to remove all custom labels."
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "labels": [
              "gpu",
              "accelerated"
            ]
          }
        }
      }
    }
  },
  "required": true
}

Remove a custom label from a self-hosted runner configured in a repository. Returns the remaining labels from the runner. This endpoint returns a `404 Not Found` status if the custom label is not present on the runner. Authenticated users must have admin access to the repository to use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists all workflow runs for a repository. You can use parameters to narrow the list of results. For more information about using parameters, see [Parameters](https://docs.github.com/rest/guides/getting-started-with-the-rest-api#parameters). Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository. This endpoint will return up to 1,000 results for each search when using the following parameters: `actor`, `branch`, `check_suite_id`, `created`, `event`, `head_sha`, `status`.

Deletes a specific workflow run. Anyone with write access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a specific workflow run. Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Approves a workflow run for a pull request from a public fork of a first time contributor. For more information, see ["Approving workflow runs from public forks](https://docs.github.com/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks)." OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists artifacts for a workflow run. Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Gets a specific workflow run attempt. Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Lists jobs for a specific workflow run attempt. You can use parameters to narrow the list of results. For more information about using parameters, see [Parameters](https://docs.github.com/rest/guides/getting-started-with-the-rest-api#parameters). Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Gets a redirect URL to download an archive of log files for a specific workflow run attempt. This link expires after 1 minute. Look for `Location:` in the response header to find the URL for the download. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Cancels a workflow run using its `id`. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Approve or reject custom deployment protection rules provided by a GitHub App for a workflow run. For more information, see "[Using environments for deployment](https://docs.github.com/actions/deployment/targeting-different-environments/using-environments-for-deployment)." > [!NOTE] > GitHub Apps can only review their own custom deployment protection rules. To approve or reject pending deployments that are waiting for review from a specific person or team, see [`POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments`](/rest/actions/workflow-runs#review-pending-deployments-for-a-workflow-run). OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

{
  "content": {
    "application/json": {
      "schema": {
        "anyOf": [
          {
            "$ref": "#/components/schemas/review-custom-gates-comment-required"
          },
          {
            "$ref": "#/components/schemas/review-custom-gates-state-required"
          }
        ]
      },
      "examples": {
        "default": {
          "value": {
            "state": "approved",
            "comment": "All health checks passed.",
            "environment_name": "prod-eus"
          }
        }
      }
    }
  },
  "required": true
}

Cancels a workflow run and bypasses conditions that would otherwise cause a workflow execution to continue, such as an `always()` condition on a job. You should only use this endpoint to cancel a workflow run when the workflow run is not responding to [`POST /repos/{owner}/{repo}/actions/runs/{run_id}/cancel`](/rest/actions/workflow-runs#cancel-a-workflow-run). OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Lists jobs for a workflow run. You can use parameters to narrow the list of results. For more information about using parameters, see [Parameters](https://docs.github.com/rest/guides/getting-started-with-the-rest-api#parameters). Anyone with read access to the repository can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint with a private repository.

Deletes all logs for a workflow run. OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Gets a redirect URL to download an archive of log files for a workflow run. This link expires after 1 minute. Look for `Location:` in the response header to find the URL for the download. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Get all deployment environments for a workflow run that are waiting for protection rules to pass. Anyone with read access to the repository can use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

Approve or reject pending deployments that are waiting on approval by a required reviewer. Required reviewers with read access to the repository contents and deployments can use this endpoint. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

{
  "content": {
    "application/json": {
      "schema": {
        "type": "object",
        "required": [
          "environment_ids",
          "state",
          "comment"
        ],
        "properties": {
          "state": {
            "enum": [
              "approved",
              "rejected"
            ],
            "type": "string",
            "example": "approved",
            "description": "Whether to approve or reject deployment to the specified environments."
          },
          "comment": {
            "type": "string",
            "example": "Ship it!",
            "description": "A comment to accompany the deployment review"
          },
          "environment_ids": {
            "type": "array",
            "items": {
              "type": "integer",
              "example": 161171787
            },
            "example": [
              161171787,
              161171795
            ],
            "description": "The list of environment ids to approve or reject"
          }
        }
      },
      "examples": {
        "default": {
          "value": {
            "state": "approved",
            "comment": "Ship it!",
            "environment_ids": [
              161171787
            ]
          }
        }
      }
    }
  },
  "required": true
}

Re-runs your workflow run using its `id`. OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.