Use the REST API to view and manage policies for GitHub Actions.
Note
Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.
GET /orgs/{org}/actions/policies
List all Actions policies for an organization.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
per_page (integer)
The number of results per page (max 100). For more information, see "Using pagination in the REST API."
Default: 30
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
has_parents (boolean)
Include policies configured at higher levels that apply to this organization
Default: true
200 - OK
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/actions/policies
Response schema (Status: 200):
total_count: required, integerpolicies: required, array of Actions Policy:
id: required, integername: required, stringtarget: required, string, enum: actionssource_type: required, string, enum: Repository, Organization, Enterprisesource: required, stringenforcement: required, string, enum: disabled, active, evaluateconditions: any of:
rules: array of Actions Rule:
type: required, string, enum: restrict_actions_actorsparameters: object:
allowed_actors: required, array of Actor:
id: required, integertype: required, string, enum: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRoletype: required, string, enum: restrict_action_eventsparameters: object:
allowed_events: required, array of string, enum: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_runnode_id: string_links: object:
self: object:
href: stringhtml: object:
href: stringcreated_at: string, format: date-timeupdated_at: string, format: date-timePOST /orgs/{org}/actions/policies
Create an Actions policy for an organization.
Omitting workflow_path targets all workflows without storing an explicit condition.
accept (string)application/vnd.github+json is recommended.org (string) (required)name (string) (required)
The name of the policy.
enforcement (string) (required)
The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (evaluate is only available with GitHub Enterprise).
Can be one of: disabled, active, evaluate
conditions (object)
Conditions for an organization Actions policy. The conditions object should contain one of
repository_name, repository_id, or repository_property, and may also contain workflow_path.
Repository ruleset conditions for repository names (object)repository_name (object) (required)
include (array of strings)exclude (array of strings)protected (boolean)workflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)Repository ruleset conditions for repository IDs (object)repository_id (object) (required)
repository_ids (array of integers)workflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)Repository ruleset conditions for repository properties (object)repository_property (object) (required)
include (array of objects)name (string) (required)property_values (array of strings) (required)source (string)custom, systemexclude (array of objects)name (string) (required)property_values (array of strings) (required)source (string)custom, systemworkflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)rules (array of objects)
An array of rules within the policy.
restrict_actions_actors (object)type (string) (required)restrict_actions_actorsparameters (object)
allowed_actors (array of objects) (required)id (integer) (required)type (string) (required)User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRolerestrict_action_events (object)type (string) (required)restrict_action_eventsparameters (object)
allowed_events (array of strings) (required)201 - Created
404 - Resource not found
422 - Validation failed, or the endpoint has been spammed.
500 - Internal Error
Request:
curl -L \
-X POST \
https://api.github.com/orgs/ORG/actions/policies \
-d '{
"name": "Require approved actors",
"enforcement": "active",
"rules": [
{
"type": "restrict_actions_actors",
"parameters": {
"allowed_actors": [
{
"id": 1234,
"type": "Team"
}
]
}
}
]
}'
Response schema (Status: 201):
id: required, integername: required, stringtarget: required, string, enum: actionssource_type: required, string, enum: Repository, Organization, Enterprisesource: required, stringenforcement: required, string, enum: disabled, active, evaluateconditions: any of:
rules: array of Actions Rule:
type: required, string, enum: restrict_actions_actorsparameters: object:
allowed_actors: required, array of Actor:
id: required, integertype: required, string, enum: User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRoletype: required, string, enum: restrict_action_eventsparameters: object:
allowed_events: required, array of string, enum: branch_protection_rule, check_run, check_suite, create, delete, deployment, deployment_status, discussion, discussion_comment, fork, gollum, image_version, issue_comment, issues, label, merge_group, milestone, page_build, project, project_card, project_column, public, pull_request, pull_request_review, pull_request_review_comment, pull_request_target, push, registry_package, release, repository_dispatch, schedule, status, watch, workflow_call, workflow_dispatch, workflow_runnode_id: string_links: object:
self: object:
href: stringhtml: object:
href: stringcreated_at: string, format: date-timeupdated_at: string, format: date-timeGET /orgs/{org}/actions/policies/{policy_id}
Get a specific Actions policy for an organization.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
200 - OK
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/actions/policies/POLICY_ID
Response schema (Status: 200):
Same response schema as Create an organization Actions policy.
PUT /orgs/{org}/actions/policies/{policy_id}
Update an Actions policy for an organization.
Omitting workflow_path preserves the policy's existing workflow targeting.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
name (string)
The name of the policy.
enforcement (string)
The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (evaluate is only available with GitHub Enterprise).
Can be one of: disabled, active, evaluate
conditions (object)
Conditions for an organization Actions policy. The conditions object should contain one of
repository_name, repository_id, or repository_property, and may also contain workflow_path.
Repository ruleset conditions for repository names (object)repository_name (object) (required)
include (array of strings)exclude (array of strings)protected (boolean)workflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)Repository ruleset conditions for repository IDs (object)repository_id (object) (required)
repository_ids (array of integers)workflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)Repository ruleset conditions for repository properties (object)repository_property (object) (required)
include (array of objects)name (string) (required)property_values (array of strings) (required)source (string)custom, systemexclude (array of objects)name (string) (required)property_values (array of strings) (required)source (string)custom, systemworkflow_path (object)
include (array of strings) (required)exclude (array of strings) (required)rules (array of objects)
An array of rules within the policy.
restrict_actions_actors (object)type (string) (required)restrict_actions_actorsparameters (object)
allowed_actors (array of objects) (required)id (integer) (required)type (string) (required)User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRolerestrict_action_events (object)type (string) (required)restrict_action_eventsparameters (object)
allowed_events (array of strings) (required)200 - OK
404 - Resource not found
422 - Validation failed, or the endpoint has been spammed.
500 - Internal Error
Request:
curl -L \
-X PUT \
https://api.github.com/orgs/ORG/actions/policies/POLICY_ID \
-d '{
"name": "Updated policy name",
"enforcement": "active"
}'
Response schema (Status: 200):
Same response schema as Create an organization Actions policy.
DELETE /orgs/{org}/actions/policies/{policy_id}
Delete an Actions policy for an organization.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
204 - No Content
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X DELETE \
https://api.github.com/orgs/ORG/actions/policies/POLICY_ID
Response schema (Status: 204):
GET /repos/{owner}/{repo}/actions/policies
List all Actions policies for a repository.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
per_page (integer)
The number of results per page (max 100). For more information, see "Using pagination in the REST API."
Default: 30
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
has_parents (boolean)
Include policies configured at higher levels that apply to this repository
Default: true
200 - OK
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/actions/policies
Response schema (Status: 200):
Same response schema as List organization Actions policies.
POST /repos/{owner}/{repo}/actions/policies
Create an Actions policy for a repository.
Omitting workflow_path targets all workflows without storing an explicit condition.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the policy.
enforcement (string) (required)
The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (evaluate is only available with GitHub Enterprise).
Can be one of: disabled, active, evaluate
conditions (object)
Conditions for a repository Actions policy. The object may be empty to preserve or use the
default workflow targeting, or contain only workflow_path.
Actions policy workflow path condition (object)workflow_path (object) (required)
include (array of strings) (required)exclude (array of strings) (required)rules (array of objects)
An array of rules within the policy.
restrict_actions_actors (object)type (string) (required)restrict_actions_actorsparameters (object)
allowed_actors (array of objects) (required)id (integer) (required)type (string) (required)User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRolerestrict_action_events (object)type (string) (required)restrict_action_eventsparameters (object)
allowed_events (array of strings) (required)201 - Created
404 - Resource not found
422 - Validation failed, or the endpoint has been spammed.
500 - Internal Error
Request:
curl -L \
-X POST \
https://api.github.com/repos/OWNER/REPO/actions/policies \
-d '{
"name": "Require approved actors",
"enforcement": "active",
"rules": [
{
"type": "restrict_actions_actors",
"parameters": {
"allowed_actors": [
{
"id": 1234,
"type": "Team"
}
]
}
}
]
}'
Response schema (Status: 201):
Same response schema as Create an organization Actions policy.
GET /repos/{owner}/{repo}/actions/policies/{policy_id}
Get a specific Actions policy for a repository.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
200 - OK
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID
Response schema (Status: 200):
Same response schema as Create an organization Actions policy.
PUT /repos/{owner}/{repo}/actions/policies/{policy_id}
Update an Actions policy for a repository.
Omitting workflow_path preserves the policy's existing workflow targeting.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
name (string)
The name of the policy.
enforcement (string)
The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (evaluate is only available with GitHub Enterprise).
Can be one of: disabled, active, evaluate
conditions (object)
Conditions for a repository Actions policy. The object may be empty to preserve or use the
default workflow targeting, or contain only workflow_path.
Actions policy workflow path condition (object)workflow_path (object) (required)
include (array of strings) (required)exclude (array of strings) (required)rules (array of objects)
An array of rules within the policy.
restrict_actions_actors (object)type (string) (required)restrict_actions_actorsparameters (object)
allowed_actors (array of objects) (required)id (integer) (required)type (string) (required)User, Bot, Team, BusinessTeam, EnterpriseTeam, IntegrationInstallation, App, RepositoryRolerestrict_action_events (object)type (string) (required)restrict_action_eventsparameters (object)
allowed_events (array of strings) (required)200 - OK
404 - Resource not found
422 - Validation failed, or the endpoint has been spammed.
500 - Internal Error
Request:
curl -L \
-X PUT \
https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID \
-d '{
"name": "Updated policy name",
"enforcement": "active"
}'
Response schema (Status: 200):
Same response schema as Create an organization Actions policy.
DELETE /repos/{owner}/{repo}/actions/policies/{policy_id}
Delete an Actions policy for a repository.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
policy_id (integer) (required)
The ID of the policy.
204 - No Content
404 - Resource not found
500 - Internal Error
Request:
curl -L \
-X DELETE \
https://api.github.com/repos/OWNER/REPO/actions/policies/POLICY_ID
Response schema (Status: 204):