REST API endpoints for GitHub Actions policies

Use the REST API to view and manage policies for GitHub Actions.

Note

Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.

List organization Actions policies

GET /orgs/{org}/actions/policies

List all Actions policies for an organization.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/actions/policies

Response schema (Status: 200):

Create an organization Actions policy

POST /orgs/{org}/actions/policies

Create an Actions policy for an organization.
Omitting workflow_path targets all workflows without storing an explicit condition.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/orgs/ORG/actions/policies \
  -d '{
  "name": "Require approved actors",
  "enforcement": "active",
  "rules": [
    {
      "type": "restrict_actions_actors",
      "parameters": {
        "allowed_actors": [
          {
            "id": 1234,
            "type": "Team"
          }
        ]
      }
    }
  ]
}'

Response schema (Status: 201):

Get an organization Actions policy

GET /orgs/{org}/actions/policies/{policy_id}

Get a specific Actions policy for an organization.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/orgs/ORG/actions/policies/POLICY_ID

Response schema (Status: 200):

Same response schema as Create an organization Actions policy.

Update an organization Actions policy

PUT /orgs/{org}/actions/policies/{policy_id}

Update an Actions policy for an organization.
Omitting workflow_path preserves the policy's existing workflow targeting.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X PUT \
  https://api.github.com/orgs/ORG/actions/policies/POLICY_ID \
  -d '{
  "name": "Updated policy name",
  "enforcement": "active"
}'

Response schema (Status: 200):

Same response schema as Create an organization Actions policy.

Delete an organization Actions policy

DELETE /orgs/{org}/actions/policies/{policy_id}

Delete an Actions policy for an organization.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X DELETE \
  https://api.github.com/orgs/ORG/actions/policies/POLICY_ID

Response schema (Status: 204):

List repository Actions policies

GET /repos/{owner}/{repo}/actions/policies

List all Actions policies for a repository.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/actions/policies

Response schema (Status: 200):

Same response schema as List organization Actions policies.

Create a repository Actions policy

POST /repos/{owner}/{repo}/actions/policies

Create an Actions policy for a repository.
Omitting workflow_path targets all workflows without storing an explicit condition.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X POST \
  https://api.github.com/repos/OWNER/REPO/actions/policies \
  -d '{
  "name": "Require approved actors",
  "enforcement": "active",
  "rules": [
    {
      "type": "restrict_actions_actors",
      "parameters": {
        "allowed_actors": [
          {
            "id": 1234,
            "type": "Team"
          }
        ]
      }
    }
  ]
}'

Response schema (Status: 201):

Same response schema as Create an organization Actions policy.

Get a repository Actions policy

GET /repos/{owner}/{repo}/actions/policies/{policy_id}

Get a specific Actions policy for a repository.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X GET \
  https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID

Response schema (Status: 200):

Same response schema as Create an organization Actions policy.

Update a repository Actions policy

PUT /repos/{owner}/{repo}/actions/policies/{policy_id}

Update an Actions policy for a repository.
Omitting workflow_path preserves the policy's existing workflow targeting.

Parameters

Headers

Path and query parameters

Body parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X PUT \
  https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID \
  -d '{
  "name": "Updated policy name",
  "enforcement": "active"
}'

Response schema (Status: 200):

Same response schema as Create an organization Actions policy.

Delete a repository Actions policy

DELETE /repos/{owner}/{repo}/actions/policies/{policy_id}

Delete an Actions policy for a repository.

Parameters

Headers

Path and query parameters

HTTP response status codes

Code examples

Example

Request:

curl -L \
  -X DELETE \
  https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID

Response schema (Status: 204):