Конечные точки REST API для политик GitHub Actions

Используйте REST API для просмотра политик и управления ими GitHub Actions.

List enterprise Actions policies

List all Actions policies for an enterprise.

Note

The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Детализированные токены доступа для «List enterprise Actions policies»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Enterprise administration" enterprise permissions (write)

Параметры для «List enterprise Actions policies»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
enterprise string Обязательное поле

The slug version of the enterprise name.

Параметры запроса
per_page integer

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

По умолчанию.: 30

page integer

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

По умолчанию.: 1

HTTP-коды статуса ответа для «List enterprise Actions policies»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «List enterprise Actions policies»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/enterprises/{enterprise}/actions/policies
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/actions/policies

Response

Status: 200
{ "total_count": 2, "policies": [ { "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "node_id": "RUL_lA", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/1" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/1" } }, "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }, { "id": 2, "name": "Restrict workflow events", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "evaluate", "node_id": "RUL_lB", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/2" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/2" } }, "created_at": "2024-01-15T11:00:00Z", "updated_at": "2024-01-15T11:00:00Z" } ] }

Create an enterprise Actions policy

Create an Actions policy for an enterprise. Omitting workflow_path targets all workflows without storing an explicit condition.

Note

The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Детализированные токены доступа для «Create an enterprise Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Enterprise administration" enterprise permissions (write)

Параметры для «Create an enterprise Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
enterprise string Обязательное поле

The slug version of the enterprise name.

Параметры запроса
name string Обязательное поле

The name of the policy.

enforcement string Обязательное поле

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for an enterprise Actions policy. The conditions object supports one organization target (organization_name, organization_id, or organization_property) combined with one repository target (repository_name or repository_property), and may also contain workflow_path.

organization_name_and_repository_name object

Conditions to target organizations by name and repositories by name

organization_name object Обязательное поле
include array of strings

Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all organizations and ~EMUS to target all enterprise managed user accounts.

exclude array of strings

Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_name_and_repository_property object

Conditions to target organizations by name and repositories by property

organization_name object Обязательное поле
include array of strings

Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all organizations and ~EMUS to target all enterprise managed user accounts.

exclude array of strings

Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_id_and_repository_name object

Conditions to target organizations by id and repositories by name

organization_id object Обязательное поле
organization_ids array of integers

The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_id_and_repository_property object

Conditions to target organizations by id and repositories by property

organization_id object Обязательное поле
organization_ids array of integers

The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_property_and_repository_name object

Conditions to target organizations by property and repositories by name

organization_property object Обязательное поле
include array of objects

The organization properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

exclude array of objects

The organization properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_property_and_repository_property object

Conditions to target organizations by property and repositories by property

organization_property object Обязательное поле
include array of objects

The organization properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

exclude array of objects

The organization properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Create an enterprise Actions policy»

Код состоянияDescription
201

Created

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Create an enterprise Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

post/enterprises/{enterprise}/actions/policies
curl -L \ -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/actions/policies \ -d '{"name":"Require approved actors","enforcement":"active","rules":[{"type":"restrict_actions_actors","parameters":{"allowed_actors":[{"id":1234,"type":"Team"}]}}]}'

Response

Status: 201
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Get an enterprise Actions policy

Get a specific Actions policy for an enterprise.

Note

The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Детализированные токены доступа для «Get an enterprise Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Enterprise administration" enterprise permissions (write)

Параметры для «Get an enterprise Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
enterprise string Обязательное поле

The slug version of the enterprise name.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Get an enterprise Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «Get an enterprise Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/enterprises/{enterprise}/actions/policies/{policy_id}
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/actions/policies/POLICY_ID

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Update an enterprise Actions policy

Update an Actions policy for an enterprise. Omitting workflow_path preserves the policy's existing workflow targeting.

Note

The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Детализированные токены доступа для «Update an enterprise Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Enterprise administration" enterprise permissions (write)

Параметры для «Update an enterprise Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
enterprise string Обязательное поле

The slug version of the enterprise name.

policy_id integer Обязательное поле

The ID of the policy.

Параметры запроса
name string

The name of the policy.

enforcement string

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for an enterprise Actions policy. The conditions object supports one organization target (organization_name, organization_id, or organization_property) combined with one repository target (repository_name or repository_property), and may also contain workflow_path.

organization_name_and_repository_name object

Conditions to target organizations by name and repositories by name

organization_name object Обязательное поле
include array of strings

Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all organizations and ~EMUS to target all enterprise managed user accounts.

exclude array of strings

Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_name_and_repository_property object

Conditions to target organizations by name and repositories by property

organization_name object Обязательное поле
include array of strings

Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all organizations and ~EMUS to target all enterprise managed user accounts.

exclude array of strings

Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match.

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_id_and_repository_name object

Conditions to target organizations by id and repositories by name

organization_id object Обязательное поле
organization_ids array of integers

The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_id_and_repository_property object

Conditions to target organizations by id and repositories by property

organization_id object Обязательное поле
organization_ids array of integers

The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_property_and_repository_name object

Conditions to target organizations by property and repositories by name

organization_property object Обязательное поле
include array of objects

The organization properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

exclude array of objects

The organization properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

organization_property_and_repository_property object

Conditions to target organizations by property and repositories by property

organization_property object Обязательное поле
include array of objects

The organization properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

exclude array of objects

The organization properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the organization property to target

property_values array of strings Обязательное поле

The values to match for the organization property

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Update an enterprise Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Update an enterprise Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

put/enterprises/{enterprise}/actions/policies/{policy_id}
curl -L \ -X PUT \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/actions/policies/POLICY_ID \ -d '{"name":"Updated policy name","enforcement":"active"}'

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Delete an enterprise Actions policy

Delete an Actions policy for an enterprise.

Note

The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).

Детализированные токены доступа для «Delete an enterprise Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Enterprise administration" enterprise permissions (write)

Параметры для «Delete an enterprise Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
enterprise string Обязательное поле

The slug version of the enterprise name.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Delete an enterprise Actions policy»

Код состоянияDescription
204

No Content

404

Resource not found

500

Internal Error

Примеры кода для «Delete an enterprise Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

delete/enterprises/{enterprise}/actions/policies/{policy_id}
curl -L \ -X DELETE \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/enterprises/ENTERPRISE/actions/policies/POLICY_ID

Response

Status: 204

List organization Actions policies

List all Actions policies for an organization.

Детализированные токены доступа для «List organization Actions policies»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" organization permissions (write)

Параметры для «List organization Actions policies»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
org string Обязательное поле

The organization name. The name is not case sensitive.

Параметры запроса
per_page integer

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

По умолчанию.: 30

page integer

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

По умолчанию.: 1

has_parents boolean

Include policies configured at higher levels that apply to this organization

По умолчанию.: true

HTTP-коды статуса ответа для «List organization Actions policies»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «List organization Actions policies»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/orgs/{org}/actions/policies
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/orgs/ORG/actions/policies

Response

Status: 200
{ "total_count": 2, "policies": [ { "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "node_id": "RUL_lA", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/1" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/1" } }, "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }, { "id": 2, "name": "Restrict workflow events", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "evaluate", "node_id": "RUL_lB", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/2" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/2" } }, "created_at": "2024-01-15T11:00:00Z", "updated_at": "2024-01-15T11:00:00Z" } ] }

Create an organization Actions policy

Create an Actions policy for an organization. Omitting workflow_path targets all workflows without storing an explicit condition.

Детализированные токены доступа для «Create an organization Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" organization permissions (write)

Параметры для «Create an organization Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
org string Обязательное поле

The organization name. The name is not case sensitive.

Параметры запроса
name string Обязательное поле

The name of the policy.

enforcement string Обязательное поле

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for an organization Actions policy. The conditions object should contain one of repository_name, repository_id, or repository_property, and may also contain workflow_path.

Repository ruleset conditions for repository names object

Parameters for a repository name condition

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

Repository ruleset conditions for repository IDs object

Parameters for a repository ID condition

repository_id object Обязательное поле
repository_ids array of integers

The repository IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

Repository ruleset conditions for repository properties object

Parameters for a repository property condition

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Create an organization Actions policy»

Код состоянияDescription
201

Created

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Create an organization Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

post/orgs/{org}/actions/policies
curl -L \ -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/orgs/ORG/actions/policies \ -d '{"name":"Require approved actors","enforcement":"active","rules":[{"type":"restrict_actions_actors","parameters":{"allowed_actors":[{"id":1234,"type":"Team"}]}}]}'

Response

Status: 201
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Get an organization Actions policy

Get a specific Actions policy for an organization.

Детализированные токены доступа для «Get an organization Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" organization permissions (write)

Параметры для «Get an organization Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
org string Обязательное поле

The organization name. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Get an organization Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «Get an organization Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/orgs/{org}/actions/policies/{policy_id}
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/orgs/ORG/actions/policies/POLICY_ID

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Update an organization Actions policy

Update an Actions policy for an organization. Omitting workflow_path preserves the policy's existing workflow targeting.

Детализированные токены доступа для «Update an organization Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" organization permissions (write)

Параметры для «Update an organization Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
org string Обязательное поле

The organization name. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

Параметры запроса
name string

The name of the policy.

enforcement string

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for an organization Actions policy. The conditions object should contain one of repository_name, repository_id, or repository_property, and may also contain workflow_path.

Repository ruleset conditions for repository names object

Parameters for a repository name condition

repository_name object Обязательное поле
include array of strings

Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts ~ALL to include all repositories.

exclude array of strings

Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.

protected boolean

Whether renaming of target repositories is prevented.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

Repository ruleset conditions for repository IDs object

Parameters for a repository ID condition

repository_id object Обязательное поле
repository_ids array of integers

The repository IDs that the ruleset applies to. One of these IDs must match for the condition to pass.

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

Repository ruleset conditions for repository properties object

Parameters for a repository property condition

repository_property object Обязательное поле
include array of objects

The repository properties and values to include. All of these properties must match for the condition to pass.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

exclude array of objects

The repository properties and values to exclude. The condition will not pass if any of these properties match.

name string Обязательное поле

The name of the repository property to target

property_values array of strings Обязательное поле

The values to match for the repository property

source string

The source of the repository property. Defaults to 'custom' if not specified.

Возможные значения: custom, system

workflow_path object
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Update an organization Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Update an organization Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

put/orgs/{org}/actions/policies/{policy_id}
curl -L \ -X PUT \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/orgs/ORG/actions/policies/POLICY_ID \ -d '{"name":"Updated policy name","enforcement":"active"}'

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Delete an organization Actions policy

Delete an Actions policy for an organization.

Детализированные токены доступа для «Delete an organization Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" organization permissions (write)

Параметры для «Delete an organization Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
org string Обязательное поле

The organization name. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Delete an organization Actions policy»

Код состоянияDescription
204

No Content

404

Resource not found

500

Internal Error

Примеры кода для «Delete an organization Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

delete/orgs/{org}/actions/policies/{policy_id}
curl -L \ -X DELETE \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/orgs/ORG/actions/policies/POLICY_ID

Response

Status: 204

List repository Actions policies

List all Actions policies for a repository.

Детализированные токены доступа для «List repository Actions policies»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" repository permissions (write)

Параметры для «List repository Actions policies»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
owner string Обязательное поле

The account owner of the repository. The name is not case sensitive.

repo string Обязательное поле

The name of the repository without the .git extension. The name is not case sensitive.

Параметры запроса
per_page integer

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

По умолчанию.: 30

page integer

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

По умолчанию.: 1

has_parents boolean

Include policies configured at higher levels that apply to this repository

По умолчанию.: true

HTTP-коды статуса ответа для «List repository Actions policies»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «List repository Actions policies»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/repos/{owner}/{repo}/actions/policies
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/actions/policies

Response

Status: 200
{ "total_count": 2, "policies": [ { "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "node_id": "RUL_lA", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/1" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/1" } }, "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }, { "id": 2, "name": "Restrict workflow events", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "evaluate", "node_id": "RUL_lB", "_links": { "self": { "href": "https://api.github.com/enterprises/enterprise/actions/policies/2" }, "html": { "href": "https://github.com/enterprises/enterprise/settings/policies/actions/2" } }, "created_at": "2024-01-15T11:00:00Z", "updated_at": "2024-01-15T11:00:00Z" } ] }

Create a repository Actions policy

Create an Actions policy for a repository. Omitting workflow_path targets all workflows without storing an explicit condition.

Детализированные токены доступа для «Create a repository Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" repository permissions (write)

Параметры для «Create a repository Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
owner string Обязательное поле

The account owner of the repository. The name is not case sensitive.

repo string Обязательное поле

The name of the repository without the .git extension. The name is not case sensitive.

Параметры запроса
name string Обязательное поле

The name of the policy.

enforcement string Обязательное поле

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for a repository Actions policy. The object may be empty to preserve or use the default workflow targeting, or contain only workflow_path.

object
Actions policy workflow path condition object

Parameters for an Actions policy workflow path condition. Omitting workflow_path when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.

workflow_path object Обязательное поле
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Create a repository Actions policy»

Код состоянияDescription
201

Created

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Create a repository Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

post/repos/{owner}/{repo}/actions/policies
curl -L \ -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/actions/policies \ -d '{"name":"Require approved actors","enforcement":"active","rules":[{"type":"restrict_actions_actors","parameters":{"allowed_actors":[{"id":1234,"type":"Team"}]}}]}'

Response

Status: 201
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Get a repository Actions policy

Get a specific Actions policy for a repository.

Детализированные токены доступа для «Get a repository Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" repository permissions (write)

Параметры для «Get a repository Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
owner string Обязательное поле

The account owner of the repository. The name is not case sensitive.

repo string Обязательное поле

The name of the repository without the .git extension. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Get a repository Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

500

Internal Error

Примеры кода для «Get a repository Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

get/repos/{owner}/{repo}/actions/policies/{policy_id}
curl -L \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Update a repository Actions policy

Update an Actions policy for a repository. Omitting workflow_path preserves the policy's existing workflow targeting.

Детализированные токены доступа для «Update a repository Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" repository permissions (write)

Параметры для «Update a repository Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
owner string Обязательное поле

The account owner of the repository. The name is not case sensitive.

repo string Обязательное поле

The name of the repository without the .git extension. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

Параметры запроса
name string

The name of the policy.

enforcement string

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. evaluate is not available for the repository target.

Возможные значения: disabled, active, evaluate

conditions object

Conditions for a repository Actions policy. The object may be empty to preserve or use the default workflow targeting, or contain only workflow_path.

object
Actions policy workflow path condition object

Parameters for an Actions policy workflow path condition. Omitting workflow_path when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions.

workflow_path object Обязательное поле
include array of strings Обязательное поле

Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use ~ALL by itself to include all workflows. ~ALL cannot be combined with other included patterns.

exclude array of strings Обязательное поле

Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. ~ALL is not allowed in this array.

rules array of objects

An array of rules within the policy.

restrict_actions_actors object

Choose specific actors that are authorized to trigger Actions workflows.

type string Обязательное поле

значение: restrict_actions_actors

parameters object
allowed_actors array of objects Обязательное поле

Select the actors who can run Actions workflows.

id integer Обязательное поле

ID of the actor authorized to trigger Actions workflows.

type string Обязательное поле

The type of the actor

Возможные значения: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRole

restrict_action_events object

Choose specific GitHub events that will trigger Actions workflows.

type string Обязательное поле

значение: restrict_action_events

parameters object
allowed_events array of strings Обязательное поле

Select the events that can trigger Actions workflows. Supported values are: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_run

HTTP-коды статуса ответа для «Update a repository Actions policy»

Код состоянияDescription
200

OK

404

Resource not found

422

Validation failed, or the endpoint has been spammed.

500

Internal Error

Примеры кода для «Update a repository Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

put/repos/{owner}/{repo}/actions/policies/{policy_id}
curl -L \ -X PUT \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID \ -d '{"name":"Updated policy name","enforcement":"active"}'

Response

Status: 200
{ "id": 1, "name": "Restrict workflow modifications", "target": "actions", "source_type": "Enterprise", "source": "enterprise", "enforcement": "active", "conditions": { "organization_name": { "include": [ "octo-org" ], "exclude": [] }, "repository_name": { "include": [ "octo-repo" ], "exclude": [] } }, "rules": [ { "type": "restrict_actions_actors", "parameters": { "allowed_actors": [ { "id": 5, "type": "User" }, { "id": 1234, "type": "Team" } ] } } ], "node_id": "RUL_lA", "created_at": "2024-01-15T10:30:00Z", "updated_at": "2024-01-15T10:30:00Z" }

Delete a repository Actions policy

Delete an Actions policy for a repository.

Детализированные токены доступа для «Delete a repository Actions policy»

Эта конечная точка работает со следующими точными типами маркеров:

Маркер с точной детализацией должен иметь следующий набор разрешений.:

  • "Administration" repository permissions (write)

Параметры для «Delete a repository Actions policy»

Заголовки
accept string

Setting to application/vnd.github+json is recommended.

Параметры пути
owner string Обязательное поле

The account owner of the repository. The name is not case sensitive.

repo string Обязательное поле

The name of the repository without the .git extension. The name is not case sensitive.

policy_id integer Обязательное поле

The ID of the policy.

HTTP-коды статуса ответа для «Delete a repository Actions policy»

Код состоянияDescription
204

No Content

404

Resource not found

500

Internal Error

Примеры кода для «Delete a repository Actions policy»

Если вы получаете доступ к GitHub на GHE.com, замените api.github.com на выделенный поддомен вашего предприятия в api.SUBDOMAIN.ghe.com.

Пример запроса

delete/repos/{owner}/{repo}/actions/policies/{policy_id}
curl -L \ -X DELETE \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer <YOUR-TOKEN>" \ -H "X-GitHub-Api-Version: 2026-03-10" \ https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID

Response

Status: 204