GitHub Enterprise Oidc API

openapi: 3.2.0
info:
  title: Github Enterprise Oidc API
  version: 1.1.4
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  x-github-plan: ghec
  description: 'Operations tagged oidc across 2 of this provider''s published API definitions: github-enterprise-ghec-openapi.json, github-enterprise-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.github.com
tags:
- name: OIDC
  description: Endpoints to manage GitHub OIDC configuration using the REST API.
paths:
  /enterprises/{enterprise}/actions/oidc/customization/properties/repo:
    get:
      summary: List OIDC custom property inclusions for an enterprise
      description: 'Lists the repository custom properties that are included in the OIDC token for repository actions in an enterprise.


        OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.


        > [!NOTE]

        > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).'
      tags:
      - OIDC
      operationId: oidc/list-oidc-custom-property-inclusions-for-enterprise
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#list-oidc-custom-property-inclusions-for-an-enterprise
      parameters:
      - $ref: '#/components/parameters/enterprise'
      responses:
        '200':
          description: A JSON array of OIDC custom property inclusions
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/oidc-custom-property-inclusion'
              examples:
                default:
                  value:
                  - custom_property_name: environment
                    inclusion_source: enterprise
                  - custom_property_name: team
                    inclusion_source: enterprise
        '404':
          $ref: '#/components/responses/not_found'
        '403':
          $ref: '#/components/responses/forbidden'
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: false
        category: actions
        subcategory: oidc
    post:
      summary: Create an OIDC custom property inclusion for an enterprise
      description: 'Adds a repository custom property to be included in the OIDC token for repository actions in an enterprise.


        OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.


        > [!NOTE]

        > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).'
      tags:
      - OIDC
      operationId: oidc/create-oidc-custom-property-inclusion-for-enterprise
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#create-an-oidc-custom-property-inclusion-for-an-enterprise
      parameters:
      - $ref: '#/components/parameters/enterprise'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/oidc-custom-property-inclusion-input'
            examples:
              default:
                $ref: '#/components/examples/oidc-custom-property-inclusion'
      responses:
        '201':
          description: OIDC custom property inclusion created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oidc-custom-property-inclusion'
              examples:
                default:
                  $ref: '#/components/examples/oidc-custom-property-inclusion'
        '400':
          description: Invalid input
        '403':
          $ref: '#/components/responses/forbidden'
        '422':
          description: Property inclusion already exists
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: false
        category: actions
        subcategory: oidc
    servers:
    - url: https://api.github.com
  /enterprises/{enterprise}/actions/oidc/customization/properties/repo/{custom_property_name}:
    delete:
      summary: Delete an OIDC custom property inclusion for an enterprise
      description: 'Removes a repository custom property from being included in the OIDC token for repository actions in an enterprise.


        OAuth app tokens and personal access tokens (classic) need the `admin:enterprise` scope to use this endpoint.


        > [!NOTE]

        > The "Enterprise administration" fine-grained permission is not available to callers. To use this API, you must use an OAuth app token or a personal access token (classic).'
      tags:
      - OIDC
      operationId: oidc/delete-oidc-custom-property-inclusion-for-enterprise
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#delete-an-oidc-custom-property-inclusion-for-an-enterprise
      parameters:
      - $ref: '#/components/parameters/enterprise'
      - name: custom_property_name
        in: path
        required: true
        schema:
          type: string
        description: The name of the custom property to remove from OIDC token inclusion
      responses:
        '204':
          description: OIDC custom property inclusion deleted
        '400':
          description: Invalid input
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          description: Property inclusion not found
      x-github:
        enabledForGitHubApps: true
        githubCloudOnly: false
        category: actions
        subcategory: oidc
    servers:
    - url: https://api.github.com
  /orgs/{org}/actions/oidc/customization/properties/repo:
    get:
      summary: List OIDC custom property inclusions for an organization
      description: 'Lists the repository custom properties that are included in the OIDC token for repository actions in an organization.


        OAuth app tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.'
      tags:
      - OIDC
      operationId: oidc/list-oidc-custom-property-inclusions-for-org
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#list-oidc-custom-property-inclusions-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      responses:
        '200':
          description: A JSON array of OIDC custom property inclusions
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/oidc-custom-property-inclusion'
              examples:
                default:
                  value:
                  - property_name: environment
                  - property_name: team
        '404':
          $ref: '#/components/responses/not_found'
        '403':
          $ref: '#/components/responses/forbidden'
      x-github:
        enabledForGitHubApps: true
        category: actions
        subcategory: oidc
    post:
      summary: Create an OIDC custom property inclusion for an organization
      description: 'Adds a repository custom property to be included in the OIDC token for repository actions in an organization.


        OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.'
      tags:
      - OIDC
      operationId: oidc/create-oidc-custom-property-inclusion-for-org
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#create-an-oidc-custom-property-inclusion-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/oidc-custom-property-inclusion-input'
            examples:
              default:
                $ref: '#/components/examples/oidc-custom-property-inclusion'
      responses:
        '201':
          description: OIDC custom property inclusion created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oidc-custom-property-inclusion'
              examples:
                default:
                  $ref: '#/components/examples/oidc-custom-property-inclusion'
        '400':
          description: Invalid input
        '403':
          $ref: '#/components/responses/forbidden'
        '422':
          description: Property inclusion already exists
      x-github:
        enabledForGitHubApps: true
        category: actions
        subcategory: oidc
    servers:
    - url: https://api.github.com
  /orgs/{org}/actions/oidc/customization/properties/repo/{custom_property_name}:
    delete:
      summary: Delete an OIDC custom property inclusion for an organization
      description: 'Removes a repository custom property from being included in the OIDC token for repository actions in an organization.


        OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.'
      tags:
      - OIDC
      operationId: oidc/delete-oidc-custom-property-inclusion-for-org
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#delete-an-oidc-custom-property-inclusion-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      - name: custom_property_name
        in: path
        required: true
        schema:
          type: string
        description: The name of the custom property to remove from OIDC token inclusion
      responses:
        '204':
          description: OIDC custom property inclusion deleted
        '400':
          description: Invalid input
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          description: Property inclusion not found
      x-github:
        enabledForGitHubApps: true
        category: actions
        subcategory: oidc
    servers:
    - url: https://api.github.com
  /orgs/{org}/actions/oidc/customization/sub:
    get:
      summary: Get the customization template for an OIDC subject claim for an organization
      description: 'Gets the customization template for an OpenID Connect (OIDC) subject claim.


        OAuth app tokens and personal access tokens (classic) need the `read:org` scope to use this endpoint.'
      tags:
      - OIDC
      operationId: oidc/get-oidc-custom-sub-template-for-org
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#get-the-customization-template-for-an-oidc-subject-claim-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      responses:
        '200':
          description: A JSON serialized template for OIDC subject claim customization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/oidc-custom-sub'
              examples:
                default:
                  $ref: '#/components/examples/oidc-custom-sub'
      x-github:
        enabledForGitHubApps: true
        category: actions
        subcategory: oidc
    put:
      summary: Set the customization template for an OIDC subject claim for an organization
      description: 'Creates or updates the customization template for an OpenID Connect (OIDC) subject claim.


        OAuth app tokens and personal access tokens (classic) need the `write:org` scope to use this endpoint.'
      tags:
      - OIDC
      operationId: oidc/update-oidc-custom-sub-template-for-org
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-cloud@latest/rest/actions/oidc#set-the-customization-template-for-an-oidc-subject-claim-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              title: Actions OIDC Subject customization
              description: Actions OIDC Subject customization
              type: object
              properties:
                include_claim_keys:
                  description: Array of unique strings. Each claim key can only contain alphanumeric characters and underscores.
                  type: array
                  items:
                    type: string
                use_immutable_subject:
                  description: Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.
                  type: boolean
            examples:
              default:
                $ref: '#/components/examples/oidc-custom-sub'
      responses:
        '201':
          description: Empty response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/empty-object'
              examples:
                default:
                  value: null
        '404':
          $ref: '#/components/responses/not_found'
        '403':
          $ref: '#/components/responses/forbidden'
      x-github:
        enabledForGitHubApps: true
        previews: []
        category: actions
        subcategory: oidc
    servers:
    - url: https://api.github.com
components:
  parameters:
    org:
      name: org
      description: The organization name. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
    enterprise:
      name: enterprise
      description: The slug version of the enterprise name.
      in: path
      required: true
      schema:
        type: string
  examples:
    oidc-custom-sub:
      value:
        include_claim_keys:
        - repo
        - context
    oidc-custom-property-inclusion:
      value:
        custom_property_name: environment
  responses:
    forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
  schemas:
    empty-object:
      title: Empty Object
      description: An object without any properties.
      type: object
      properties: {}
      additionalProperties: false
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
        documentation_url:
          type: string
        url:
          type: string
        status:
          type: string
    oidc-custom-sub:
      title: Actions OIDC Subject customization
      description: Actions OIDC Subject customization
      type: object
      properties:
        include_claim_keys:
          description: Array of unique strings. Each claim key can only contain alphanumeric characters and underscores.
          type: array
          items:
            type: string
        use_immutable_subject:
          description: Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.
          type: boolean
      required:
      - include_claim_keys
    oidc-custom-property-inclusion:
      title: Actions OIDC Custom Property Inclusion
      description: An OIDC custom property inclusion for repository properties
      type: object
      properties:
        custom_property_name:
          type: string
          description: The name of the custom property that is included in the OIDC token
        inclusion_source:
          type: string
          description: Whether the inclusion was defined at the organization or enterprise level
          enum:
          - organization
          - enterprise
          example: organization
      required:
      - custom_property_name
      - inclusion_source
    oidc-custom-property-inclusion-input:
      title: Actions OIDC Custom Property Inclusion Input
      description: Input for creating an OIDC custom property inclusion
      type: object
      properties:
        custom_property_name:
          type: string
          description: The name of the custom property to include in the OIDC token
      required:
      - custom_property_name
externalDocs:
  description: GitHub Enterprise Cloud REST API
  url: https://docs.github.com/enterprise-cloud@latest/rest/
x-refined-from:
- github-enterprise-ghec-openapi.json
- github-enterprise-openapi.yml