Organisations
List an organisation's trusted publishers
The CI workflows the organisation trusts to act for it with no API key, oldest first, with whether the owner's plan includes them, the audience a workflow asks GitHub's token for, and the issuer.
GET
/orgs/{org}/trusted-publishersTL;DR
| Question | Answer |
|---|---|
| What does it do? | List an organisation's trusted publishers. |
| What does it take? | org in the path. |
| What does it return? | Status 200 with a body of type TrustedPublisherList. |
| What can go wrong? | 401 not signed in; 403 a member may not see them (orgs.forbidden); 404 no such organisation, or the caller is not a member of it; 429 too many requests; 503 organisations are not set up on this server. Every failure uses the one error envelope. |
What it does
The CI workflows the organisation trusts to act for it with no API key, oldest first, with whether the owner's plan includes them, the audience a workflow asks GitHub's token for, and the issuer. The owner and an admin may look.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
org | string | yes | The organisation's id or its slug. |
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The trusted publishers. | TrustedPublisherList |
| 401 | Not signed in. | ErrorResponse |
| 403 | A member may not see them (orgs.forbidden). | ErrorResponse |
| 404 | No such organisation, or the caller is not a member of it. | ErrorResponse |
| 429 | Too many requests. | ErrorResponse |
| 503 | Organisations are not set up on this server. | ErrorResponse |
Response body
A 200 answer has the type TrustedPublisherList.
| Field | Type | Required | Description |
|---|---|---|---|
active | boolean | yes | Whether the owner's plan includes trusted publishers. Entries saved before stay, and sign nothing in, while it does not. |
plan | "free" | "pro" | "enterprise" | yes | |
audience | string | null | yes | The audience a workflow asks GitHub for: this API's origin. Null on a server that cannot exchange tokens. |
issuer | string | yes | |
limit | integer | yes | The most trusted publishers an organisation may have. |
items | TrustedPublisher[] | yes | |
items[].id | string | yes | |
items[].name | string | yes | |
items[].provider | "github" | yes | |
items[].repository | string | yes | The repository, owner/name. |
items[].repositoryId | string | null | yes | GitHub's id of the repository, which a run's token must carry. Null until known: a private repository's is pinned by its first run. |
items[].repositoryOwnerId | string | null | yes | GitHub's id of the repository's owner, which a run's token must carry. Null until known. |
items[].workflow | string | yes | The workflow file in .github/workflows the run must start from. |
items[].environment | string | null | yes | The deployment environment the job must run in, or null for any. |
items[].ref | string | null | yes | The ref pattern the run must match, such as refs/heads/main, or null for any ref. |
items[].permissions | ("diagrams" | "drift:write")[] | yes | diagrams: publish to the organisation's library (and read it and the style rules). drift:write: report drift runs to the Drift tab and read the style rules. |
items[].createdAt | integer | yes | Milliseconds since the epoch. |
items[].createdBy | object | null | yes | Who added it, or null when that account is gone. |
items[].createdBy.id | string | yes | |
items[].createdBy.email | string | yes | |
items[].updatedAt | integer | yes | Milliseconds since the epoch. |
items[].lastUsedAt | integer | null | yes | When a run last signed in with it, in milliseconds since the epoch, or null for never. |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint, and the error envelope |
| Schemas | Every request and response type |
| Tool reference | The operations as callable tools |