Skip to content
forgit api docs

Revoke a list of credentials

POST
/credentials/revoke

Submit a list of credentials to be revoked. This endpoint is intended to revoke credentials the caller does not own and may have found exposed on GitHub.com or elsewhere. It can also be used for credentials associated with an old user account that you no longer have access to. Credential owners will be notified of the revocation.

This endpoint currently accepts the following credential types:

  • Personal access tokens (classic) (ghp_)
  • Fine-grained personal access tokens (github_pat_)
  • OAuth app access tokens (gho_)
  • User-to-server tokens from GitHub Apps (ghu_)
  • Refresh tokens from GitHub Apps (ghr_)

Revoked credentials may impact users on GitHub Free, Pro, & Team and GitHub Enterprise Cloud, and GitHub Enterprise Cloud with Enterprise Managed Users. GitHub cannot reactivate any credentials that have been revoked; new credentials will need to be generated.

To prevent abuse, this API is limited to only 60 unauthenticated requests per hour and a max of 1000 tokens per API request.

[!NOTE] Any authenticated requests will return a 403.

API method documentation

Request Body required

Section titled “ Request Body required ”
Media type application/json
object
credentials
required

A list of credentials to be revoked, up to 1000 per request.

Array<string>
>= 1 items <= 1000 items
Examples
Example default 
{
  "credentials": [
    "ghp_1234567890abcdef1234567890abcdef12345678",
    "github_pat_0A1B2C3D4E5F6G7H8I9J0K_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456",
    "gho_1234567890abcdef1234567890abcdef12345678",
    "ghu_1234567890abcdef1234567890abcdef12345678",
    "ghr_1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab"
  ]
}

Responses

Section titled “ Responses ”

202

Section titled “ 202 ”

Accepted

Media type application/json
object
Examples
Example default 
null

422

Section titled “ 422 ”

Validation failed, or the endpoint has been spammed.

Media type application/json
Validation Error Simple

Validation Error Simple

object
message
required
string
documentation_url
required
string
errors
Array<string>
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    "example"
  ]
}

500

Section titled “ 500 ”

Internal Error

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}