GitHub Actions Secrets API

Manage encrypted secrets for Actions

Documentation GitHub OpenAPI

Business capability

Configuration & Secrets Management BC-4210.60

Operations 13

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /repos/{owner}/{repo}/actions/secrets List a repository's own Actions secrets · Github Actions List Repository Secrets #

Ask an LLM

“What secrets are defined directly on my repository for workflows to use?”

“Can I see the names of my repo's secrets without exposing their values?”

Tell an agent

List the repository-level secrets defined in {owner}/{repo}.

Show the names and update dates of secrets stored on {owner}/{repo} itself.

GET /repos/{owner}/{repo}/actions/secrets/public-key Get the key for encrypting a repository secret · Github Actions Get a Repository Public Key #

Ask an LLM

“Which public key do I encrypt a new repository secret with before uploading it?”

“Where do I get the key_id to send along with an encrypted repo secret?”

Tell an agent

Get the secret-encryption public key for repository {owner}/{repo}.

Fetch the repo public key and key ID I need to encrypt a secret for {repo}.

GET /repos/{owner}/{repo}/actions/secrets/{secret_name} Look up one repository secret's metadata · Github Actions Get a Repository Secret #

Ask an LLM

“When was a particular repository secret last updated?”

“Does my repository have a secret with a given name?”

Tell an agent

Get the repository secret {secret_name} in {owner}/{repo}.

Check when repo secret {secret_name} was created and last changed.

PUT /repos/{owner}/{repo}/actions/secrets/{secret_name} Create or update a repository secret · Github Actions Create or Update a Repository Secret #

Ask an LLM

“How do I add a new secret to my repository for workflows to read?”

“Can I rotate the value of an existing repository secret?”

Tell an agent

Save repository secret {secret_name} in {owner}/{repo} with encrypted value {encrypted_value} and key {key_id}.

Rotate the repo secret {secret_name} to a newly encrypted value.

DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name} Delete a repository secret · Github Actions Delete a Repository Secret #

Ask an LLM

“How do I remove a secret from a single repository?”

“Can I delete a leaked repository secret by name?”

Tell an agent destructive · confirm first

Delete repository secret {secret_name} from {owner}/{repo}.

Remove the repo-level secret {secret_name}.

GET /repos/{owner}/{repo}/actions/organization-secrets List organization secrets shared with a repository · Github Actions List Repository Organization Secrets #

Ask an LLM

“Which organization-level secrets can my repository's workflows access?”

“What org secrets have been shared into this repo?”

Tell an agent

List the organization secrets that {owner}/{repo} has access to.

Show which inherited org secrets are available in {repo}.

GET /orgs/{org}/actions/secrets List all of an organization's Actions secrets · Github Actions List Organization Secrets #

Ask an LLM

“What Actions secrets are defined at the organization level?”

“Can I see every org secret along with its visibility setting?”

Tell an agent

List every organization secret defined in {org}.

Show the names and visibility of all org-level secrets in {org}.

GET /orgs/{org}/actions/secrets/public-key Get the key for encrypting an organization secret · Github Actions Get an Organization Public Key #

Ask an LLM

“Which public key do I use to encrypt an organization-level secret?”

“Where do I find the org key_id to send with an encrypted org secret?”

Tell an agent

Get the organization public key for encrypting secrets in {org}.

Fetch the org-level encryption key and key ID for {org}.

GET /orgs/{org}/actions/secrets/{secret_name} Look up one organization secret's metadata · Github Actions Get an Organization Secret #

Ask an LLM

“What visibility does a particular organization secret have?”

“When was an org secret last updated?”

Tell an agent

Get the organization secret {secret_name} in {org}.

Check the visibility and last update of org secret {secret_name}.

PUT /orgs/{org}/actions/secrets/{secret_name} Create or update an organization secret · Github Actions Create or Update an Organization Secret #

Ask an LLM

“How do I create a secret once at the organization level for many repositories to use?”

“Can I make an org secret visible to all, private, or only selected repositories?”

Tell an agent

Save org secret {secret_name} in {org} with encrypted value {encrypted_value} and key {key_id}.

Set the visibility of org secret {secret_name} to {visibility}.

DELETE /orgs/{org}/actions/secrets/{secret_name} Delete an organization secret · Github Actions Delete an Organization Secret #

Ask an LLM

“How do I delete a secret from my whole organization?”

“Can I remove an org-level secret that several repos were sharing?”

Tell an agent destructive · confirm first

Delete organization secret {secret_name} from {org}.

Remove the org-wide secret {secret_name}.

GET /orgs/{org}/actions/secrets/{secret_name}/repositories List repositories selected for an org secret · Github Actions List Selected Repositories for an Organization Secret #

Ask an LLM

“Which repositories are allowed to use an organization secret with selected visibility?”

“What repos currently have access to a specific org secret?”

Tell an agent

List the repositories selected for org secret {secret_name} in {org}.

Show which repos can read the {secret_name} organization secret.

PUT /orgs/{org}/actions/secrets/{secret_name}/repositories Replace the repositories that can use an org secret · Github Actions Set Selected Repositories for an Organization Secret #

Ask an LLM

“How do I change which repositories get access to an organization secret?”

“Can I replace the whole list of repos for a selected-visibility org secret at once?”

Tell an agent

Grant org secret {secret_name} in {org} to exactly repositories {selected_repository_ids}.

Replace the repository access list for secret {secret_name} with {selected_repository_ids}.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/github-actions:github-actions-secrets-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: GitHub Actions Secrets API
  description: REST API for managing GitHub Actions workflows, runs, artifacts, secrets, runners, caches, variables, permissions, and OIDC.
  version: 1.0.0
  contact:
    name: GitHub Support
    url: https://support.github.com
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
servers:
- url: https://api.github.com
  description: GitHub REST API
security:
- bearerAuth: []
- personalAccessToken: []
tags:
- name: Secrets
  description: Manage encrypted secrets for Actions
paths:
  /repos/{owner}/{repo}/actions/secrets:
    get:
      operationId: listRepoSecrets
      summary: Github Actions List Repository Secrets
      description: Lists all secrets available in a repository without revealing their encrypted values.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - $ref: '#/components/parameters/perPage'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          description: Successfully retrieved secrets
          content:
            application/json:
              schema:
                type: object
                properties:
                  total_count:
                    type: integer
                  secrets:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActionsSecret'
              examples:
                Listreposecrets200Example:
                  summary: Default listRepoSecrets 200 response
                  x-microcks-default: true
                  value:
                    total_count: 10
                    secrets:
                    - name: Example Title
                      created_at: '2026-01-15T10:30:00Z'
                      updated_at: '2026-01-15T10:30:00Z'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/actions/secrets/public-key:
    get:
      operationId: getRepoPublicKey
      summary: Github Actions Get a Repository Public Key
      description: Gets your public key, which you need to encrypt secrets.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      responses:
        '200':
          description: Successfully retrieved public key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionsPublicKey'
              examples:
                Getrepopublickey200Example:
                  summary: Default getRepoPublicKey 200 response
                  x-microcks-default: true
                  value:
                    key_id: '500123'
                    key: example_value
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/actions/secrets/{secret_name}:
    get:
      operationId: getRepoSecret
      summary: Github Actions Get a Repository Secret
      description: Gets a single repository secret without revealing its encrypted value.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - $ref: '#/components/parameters/secretName'
      responses:
        '200':
          description: Successfully retrieved secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionsSecret'
              examples:
                Getreposecret200Example:
                  summary: Default getRepoSecret 200 response
                  x-microcks-default: true
                  value:
                    name: Example Title
                    created_at: '2026-01-15T10:30:00Z'
                    updated_at: '2026-01-15T10:30:00Z'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: createOrUpdateRepoSecret
      summary: Github Actions Create or Update a Repository Secret
      description: Creates or updates a repository secret with an encrypted value.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - $ref: '#/components/parameters/secretName'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                encrypted_value:
                  type: string
                  description: Value for your secret, encrypted with LibSodium using the public key.
                key_id:
                  type: string
                  description: ID of the key you used to encrypt the secret.
            examples:
              CreateorupdatereposecretRequestExample:
                summary: Default createOrUpdateRepoSecret request
                x-microcks-default: true
                value:
                  encrypted_value: example_value
                  key_id: '500123'
      responses:
        '201':
          description: Secret created
        '204':
          description: Secret updated
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRepoSecret
      summary: Github Actions Delete a Repository Secret
      description: Deletes a secret in a repository using the secret name.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - $ref: '#/components/parameters/secretName'
      responses:
        '204':
          description: Successfully deleted secret
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /repos/{owner}/{repo}/actions/organization-secrets:
    get:
      operationId: listRepoOrgSecrets
      summary: Github Actions List Repository Organization Secrets
      description: Lists all organization secrets shared with a repository without revealing their encrypted values.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/owner'
      - $ref: '#/components/parameters/repo'
      - $ref: '#/components/parameters/perPage'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          description: Successfully retrieved organization secrets
          content:
            application/json:
              schema:
                type: object
                properties:
                  total_count:
                    type: integer
                  secrets:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActionsSecret'
              examples:
                Listrepoorgsecrets200Example:
                  summary: Default listRepoOrgSecrets 200 response
                  x-microcks-default: true
                  value:
                    total_count: 10
                    secrets:
                    - name: Example Title
                      created_at: '2026-01-15T10:30:00Z'
                      updated_at: '2026-01-15T10:30:00Z'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /orgs/{org}/actions/secrets:
    get:
      operationId: listOrgSecrets
      summary: Github Actions List Organization Secrets
      description: Lists all secrets available in an organization without revealing their encrypted values.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/perPage'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          description: Successfully retrieved organization secrets
          content:
            application/json:
              schema:
                type: object
                properties:
                  total_count:
                    type: integer
                  secrets:
                    type: array
                    items:
                      $ref: '#/components/schemas/OrgActionsSecret'
              examples:
                Listorgsecrets200Example:
                  summary: Default listOrgSecrets 200 response
                  x-microcks-default: true
                  value:
                    total_count: 10
                    secrets:
                    - name: Example Title
                      created_at: '2026-01-15T10:30:00Z'
                      updated_at: '2026-01-15T10:30:00Z'
                      visibility: all
                      selected_repositories_url: https://www.example.com
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /orgs/{org}/actions/secrets/public-key:
    get:
      operationId: getOrgPublicKey
      summary: Github Actions Get an Organization Public Key
      description: Gets your public key, which you need to encrypt secrets.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      responses:
        '200':
          description: Successfully retrieved public key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionsPublicKey'
              examples:
                Getorgpublickey200Example:
                  summary: Default getOrgPublicKey 200 response
                  x-microcks-default: true
                  value:
                    key_id: '500123'
                    key: example_value
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /orgs/{org}/actions/secrets/{secret_name}:
    get:
      operationId: getOrgSecret
      summary: Github Actions Get an Organization Secret
      description: Gets a single organization secret without revealing its encrypted value.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/secretName'
      responses:
        '200':
          description: Successfully retrieved secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgActionsSecret'
              examples:
                Getorgsecret200Example:
                  summary: Default getOrgSecret 200 response
                  x-microcks-default: true
                  value:
                    name: Example Title
                    created_at: '2026-01-15T10:30:00Z'
                    updated_at: '2026-01-15T10:30:00Z'
                    visibility: all
                    selected_repositories_url: https://www.example.com
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: createOrUpdateOrgSecret
      summary: Github Actions Create or Update an Organization Secret
      description: Creates or updates an organization secret with an encrypted value.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/secretName'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                encrypted_value:
                  type: string
                key_id:
                  type: string
                visibility:
                  type: string
                  enum:
                  - all
                  - private
                  - selected
                selected_repository_ids:
                  type: array
                  items:
                    type: integer
            examples:
              CreateorupdateorgsecretRequestExample:
                summary: Default createOrUpdateOrgSecret request
                x-microcks-default: true
                value:
                  encrypted_value: example_value
                  key_id: '500123'
                  visibility: all
                  selected_repository_ids:
                  - 10
      responses:
        '201':
          description: Secret created
        '204':
          description: Secret updated
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteOrgSecret
      summary: Github Actions Delete an Organization Secret
      description: Deletes a secret in an organization using the secret name.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/secretName'
      responses:
        '204':
          description: Successfully deleted secret
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /orgs/{org}/actions/secrets/{secret_name}/repositories:
    get:
      operationId: listSelectedReposForOrgSecret
      summary: Github Actions List Selected Repositories for an Organization Secret
      description: Lists all repositories that have been selected when the visibility for repository access to a secret is set to selected.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/secretName'
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/perPage'
      responses:
        '200':
          description: Successfully retrieved repositories
          content:
            application/json:
              schema:
                type: object
                properties:
                  total_count:
                    type: integer
                  repositories:
                    type: array
                    items:
                      $ref: '#/components/schemas/MinimalRepository'
              examples:
                Listselectedreposfororgsecret200Example:
                  summary: Default listSelectedReposForOrgSecret 200 response
                  x-microcks-default: true
                  value:
                    total_count: 10
                    repositories:
                    - id: abc123
                      node_id: '500123'
                      name: Example Title
                      full_name: example_value
                      private: true
                      html_url: https://www.example.com
                      url: https://www.example.com
                      description: A sample description.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: setSelectedReposForOrgSecret
      summary: Github Actions Set Selected Repositories for an Organization Secret
      description: Replaces all repositories for an organization secret when the visibility for repository access is set to selected.
      tags:
      - Secrets
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/secretName'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - selected_repository_ids
              properties:
                selected_repository_ids:
                  type: array
                  items:
                    type: integer
            examples:
              SetselectedreposfororgsecretRequestExample:
                summary: Default setSelectedReposForOrgSecret request
                x-microcks-default: true
                value:
                  selected_repository_ids:
                  - 10
      responses:
        '204':
          description: Successfully set repositories
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ActionsSecret:
      type: object
      properties:
        name:
          type: string
          description: The name of the secret.
          example: Example Title
        created_at:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
    MinimalRepository:
      type: object
      properties:
        id:
          type: integer
          example: abc123
        node_id:
          type: string
          example: '500123'
        name:
          type: string
          example: Example Title
        full_name:
          type: string
          example: example_value
        owner:
          $ref: '#/components/schemas/SimpleUser'
        private:
          type: boolean
          example: true
        html_url:
          type: string
          format: uri
          example: https://www.example.com
        url:
          type: string
          format: uri
          example: https://www.example.com
        description:
          type: string
          nullable: true
          example: A sample description.
    OrgActionsSecret:
      type: object
      properties:
        name:
          type: string
          example: Example Title
        created_at:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
        visibility:
          type: string
          enum:
          - all
          - private
          - selected
          example: all
        selected_repositories_url:
          type: string
          format: uri
          example: https://www.example.com
    SimpleUser:
      type: object
      properties:
        login:
          type: string
          example: example_value
        id:
          type: integer
          example: abc123
        node_id:
          type: string
          example: '500123'
        avatar_url:
          type: string
          format: uri
          example: https://www.example.com
        url:
          type: string
          format: uri
          example: https://www.example.com
        html_url:
          type: string
          format: uri
          example: https://www.example.com
        type:
          type: string
          example: example_value
    ActionsPublicKey:
      type: object
      properties:
        key_id:
          type: string
          description: The identifier for the key.
          example: '500123'
        key:
          type: string
          description: The Base64 encoded public key.
          example: example_value
  parameters:
    secretName:
      name: secret_name
      in: path
      required: true
      schema:
        type: string
      description: The name of the secret.
    org:
      name: org
      in: path
      required: true
      schema:
        type: string
      description: The organization name.
    repo:
      name: repo
      in: path
      required: true
      schema:
        type: string
      description: The name of the repository without the .git extension.
    page:
      name: page
      in: query
      schema:
        type: integer
        default: 1
      description: The page number of the results to fetch.
    perPage:
      name: per_page
      in: query
      schema:
        type: integer
        default: 30
        maximum: 100
      description: The number of results per page (max 100).
    owner:
      name: owner
      in: path
      required: true
      schema:
        type: string
      description: The account owner of the repository.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: GitHub personal access token or OAuth token
    personalAccessToken:
      type: http
      scheme: bearer
      description: Fine-grained personal access token with Actions permissions

GitHub Actions Secrets API

Operations 13

Documentation

Specifications

Schemas & Data

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification