Use the REST API to interact with variables in GitHub Actions.
You can use the REST API to create, update, delete, and retrieve information about variables that can be used in workflows in GitHub Actions. Variables allow you to store non-sensitive information, such as a username, in your repository, repository environments, or organization. For more information, see Store information in variables in the GitHub Actions documentation.
Note
Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.
GET /orgs/{org}/actions/variables
Lists all organization variables.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, the repo scope is also required.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
per_page (integer)
The number of results per page (max 30). For more information, see "Using pagination in the REST API."
Default: 10
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/actions/variables
Response schema (Status: 200):
total_count: required, integervariables: required, array of Actions Variable for an Organization:
name: required, stringvalue: required, stringcreated_at: required, string, format: date-timeupdated_at: required, string, format: date-timevisibility: required, string, enum: all, private, selectedselected_repositories_url: string, format: uriPOST /orgs/{org}/actions/variables
Creates an organization variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need theadmin:org scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.org (string) (required)name (string) (required)
The name of the variable.
value (string) (required)
The value of the variable.
visibility (string) (required)
The type of repositories in the organization that can access the variable. selected means only the repositories specified by selected_repository_ids can access the variable.
Can be one of: all, private, selected
selected_repository_ids (array of integers)
An array of repository ids that can access the organization variable. You can only provide a list of repository ids when the visibility is set to selected.
Request:
curl -L \
-X POST \
https://api.github.com/orgs/ORG/actions/variables \
-d '{
"name": "USERNAME",
"value": "octocat",
"visibility": "selected",
"selected_repository_ids": [
1296269,
1296280
]
}'
Response schema (Status: 201):
GET /orgs/{org}/actions/variables/{name}
Gets a specific variable in an organization.
The authenticated user must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need theadmin:org scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/actions/variables/NAME
Response schema (Status: 200):
name: required, stringvalue: required, stringcreated_at: required, string, format: date-timeupdated_at: required, string, format: date-timevisibility: required, string, enum: all, private, selectedselected_repositories_url: string, format: uriPATCH /orgs/{org}/actions/variables/{name}
Updates an organization variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, the repo scope is also required.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
name (string)
The name of the variable.
value (string)
The value of the variable.
visibility (string)
The type of repositories in the organization that can access the variable. selected means only the repositories specified by selected_repository_ids can access the variable.
Can be one of: all, private, selected
selected_repository_ids (array of integers)
An array of repository ids that can access the organization variable. You can only provide a list of repository ids when the visibility is set to selected.
Request:
curl -L \
-X PATCH \
https://api.github.com/orgs/ORG/actions/variables/NAME \
-d '{
"name": "USERNAME",
"value": "octocat",
"visibility": "selected",
"selected_repository_ids": [
1296269,
1296280
]
}'
Response schema (Status: 204):
DELETE /orgs/{org}/actions/variables/{name}
Deletes an organization variable using the variable name.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need theadmin:org scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
Request:
curl -L \
-X DELETE \
https://api.github.com/orgs/ORG/actions/variables/NAME
Response schema (Status: 204):
GET /orgs/{org}/actions/variables/{name}/repositories
Lists all repositories that can access an organization variable
that is available to selected repositories.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, the repo scope is also required.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
per_page (integer)
The number of results per page (max 100). For more information, see "Using pagination in the REST API."
Default: 30
200 - OK
409 - Response when the visibility of the variable is not set to selected
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/actions/variables/NAME/repositories
Response schema (Status: 200):
total_count: required, integerrepositories: required, array of Minimal Repository:
id: required, integer, format: int64node_id: required, stringname: required, stringfull_name: required, stringowner: required, Simple User:
name: string or nullemail: string or nulllogin: required, stringid: required, integer, format: int64node_id: required, stringavatar_url: required, string, format: urigravatar_id: required, string or nullurl: required, string, format: urihtml_url: required, string, format: urifollowers_url: required, string, format: urifollowing_url: required, stringgists_url: required, stringstarred_url: required, stringsubscriptions_url: required, string, format: uriorganizations_url: required, string, format: urirepos_url: required, string, format: urievents_url: required, stringreceived_events_url: required, string, format: uritype: required, stringsite_admin: required, booleanstarred_at: stringuser_view_type: stringprivate: required, booleanhtml_url: required, string, format: uridescription: required, string or nullfork: required, booleanurl: required, string, format: uriarchive_url: required, stringassignees_url: required, stringblobs_url: required, stringbranches_url: required, stringcollaborators_url: required, stringcomments_url: required, stringcommits_url: required, stringcompare_url: required, stringcontents_url: required, stringcontributors_url: required, string, format: urideployments_url: required, string, format: uridownloads_url: required, string, format: urievents_url: required, string, format: uriforks_url: required, string, format: urigit_commits_url: required, stringgit_refs_url: required, stringgit_tags_url: required, stringgit_url: stringissue_comment_url: required, stringissue_events_url: required, stringissues_url: required, stringkeys_url: required, stringlabels_url: required, stringlanguages_url: required, string, format: urimerges_url: required, string, format: urimilestones_url: required, stringnotifications_url: required, stringpulls_url: required, stringreleases_url: required, stringssh_url: stringstargazers_url: required, string, format: uristatuses_url: required, stringsubscribers_url: required, string, format: urisubscription_url: required, string, format: uritags_url: required, string, format: uriteams_url: required, string, format: uritrees_url: required, stringclone_url: stringmirror_url: string or nullhooks_url: required, string, format: urisvn_url: stringhomepage: string or nulllanguage: string or nullforks_count: integerstargazers_count: integerwatchers_count: integersize: integerdefault_branch: stringopen_issues_count: integeris_template: booleantopics: array of stringhas_issues: booleanhas_projects: booleanhas_wiki: booleanhas_pages: booleanhas_discussions: booleanhas_pull_requests: booleanpull_request_creation_policy: string, enum: all, collaborators_onlyarchived: booleandisabled: booleanvisibility: stringpushed_at: string or null, format: date-timecreated_at: string or null, format: date-timeupdated_at: string or null, format: date-timepermissions: object:
admin: booleanmaintain: booleanpush: booleantriage: booleanpull: booleanrole_name: stringtemp_clone_token: stringdelete_branch_on_merge: booleansubscribers_count: integernetwork_count: integercode_of_conduct: Code Of Conduct:
key: required, stringname: required, stringurl: required, string, format: uribody: stringhtml_url: required, string or null, format: urilicense: object or null:
key: stringname: stringspdx_id: stringurl: string or nullnode_id: stringforks: integeropen_issues: integerwatchers: integerallow_forking: booleanweb_commit_signoff_required: booleansecurity_and_analysis: object or null:
advanced_security: object:
status: string, enum: enabled, disabledcode_security: object:
status: string, enum: enabled, disableddependabot_security_updates: object:
status: string, enum: enabled, disabledsecret_scanning: object:
status: string, enum: enabled, disabledsecret_scanning_push_protection: object:
status: string, enum: enabled, disabledsecret_scanning_non_provider_patterns: object:
status: string, enum: enabled, disabledsecret_scanning_ai_detection: object:
status: string, enum: enabled, disabledsecret_scanning_delegated_alert_dismissal: object:
status: string, enum: enabled, disabledsecret_scanning_delegated_bypass: object:
status: string, enum: enabled, disabledsecret_scanning_delegated_bypass_options: object:
reviewers: array of objects:
reviewer_id: required, integerreviewer_type: required, string, enum: TEAM, ROLEmode: string, enum: ALWAYS, EXEMPT, default: "ALWAYS"custom_properties: object, additional properties allowedPUT /orgs/{org}/actions/variables/{name}/repositories
Replaces all repositories for an organization variable that is available
to selected repositories. Organization variables that are available to selected
repositories have their visibility field set to selected.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, the repo scope is also required.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
selected_repository_ids (array of integers) (required)204 - No Content
409 - Response when the visibility of the variable is not set to selected
Request:
curl -L \
-X PUT \
https://api.github.com/orgs/ORG/actions/variables/NAME/repositories \
-d '{
"selected_repository_ids": [
64780797
]
}'
Response schema (Status: 204):
PUT /orgs/{org}/actions/variables/{name}/repositories/{repository_id}
Adds a repository to an organization variable that is available to selected repositories.
Organization variables that are available to selected repositories have their visibility field set to selected.
Authenticated users must have collaborator access to a repository to create, update, or read secrets.
OAuth tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
repository_id (integer) (required)
204 - No Content
409 - Response when the visibility of the variable is not set to selected
Request:
curl -L \
-X PUT \
https://api.github.com/orgs/ORG/actions/variables/NAME/repositories/REPOSITORY_ID
Response schema (Status: 204):
DELETE /orgs/{org}/actions/variables/{name}/repositories/{repository_id}
Removes a repository from an organization variable that is
available to selected repositories. Organization variables that are available to
selected repositories have their visibility field set to selected.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint. If the repository is private, the repo scope is also required.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
name (string) (required)
The name of the variable.
repository_id (integer) (required)
204 - No Content
409 - Response when the visibility of the variable is not set to selected
Request:
curl -L \
-X DELETE \
https://api.github.com/orgs/ORG/actions/variables/NAME/repositories/REPOSITORY_ID
Response schema (Status: 204):
GET /repos/{owner}/{repo}/actions/organization-variables
Lists all organization variables shared with a repository.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
per_page (integer)
The number of results per page (max 30). For more information, see "Using pagination in the REST API."
Default: 10
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/actions/organization-variables
Response schema (Status: 200):
total_count: required, integervariables: required, array of Actions Variable:
name: required, stringvalue: required, stringcreated_at: required, string, format: date-timeupdated_at: required, string, format: date-timeGET /repos/{owner}/{repo}/actions/variables
Lists all repository variables.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
per_page (integer)
The number of results per page (max 30). For more information, see "Using pagination in the REST API."
Default: 10
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/actions/variables
Response schema (Status: 200):
Same response schema as List repository organization variables.
POST /repos/{owner}/{repo}/actions/variables
Creates a repository variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
value (string) (required)
The value of the variable.
Request:
curl -L \
-X POST \
https://api.github.com/repos/OWNER/REPO/actions/variables \
-d '{
"name": "USERNAME",
"value": "octocat"
}'
Response schema (Status: 201):
GET /repos/{owner}/{repo}/actions/variables/{name}
Gets a specific variable in a repository.
The authenticated user must have collaborator access to the repository to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/actions/variables/NAME
Response schema (Status: 200):
name: required, stringvalue: required, stringcreated_at: required, string, format: date-timeupdated_at: required, string, format: date-timePATCH /repos/{owner}/{repo}/actions/variables/{name}
Updates a repository variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
name (string)
The name of the variable.
value (string)
The value of the variable.
Request:
curl -L \
-X PATCH \
https://api.github.com/repos/OWNER/REPO/actions/variables/NAME \
-d '{
"name": "USERNAME",
"value": "octocat"
}'
Response schema (Status: 204):
DELETE /repos/{owner}/{repo}/actions/variables/{name}
Deletes a repository variable using the variable name.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
Request:
curl -L \
-X DELETE \
https://api.github.com/repos/OWNER/REPO/actions/variables/NAME
Response schema (Status: 204):
GET /repos/{owner}/{repo}/environments/{environment_name}/variables
Lists all environment variables.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
environment_name (string) (required)
The name of the environment. The name must be URL encoded. For example, any slashes in the name must be replaced with %2F.
per_page (integer)
The number of results per page (max 30). For more information, see "Using pagination in the REST API."
Default: 10
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/environments/ENVIRONMENT_NAME/variables
Response schema (Status: 200):
Same response schema as List repository organization variables.
POST /repos/{owner}/{repo}/environments/{environment_name}/variables
Create an environment variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
environment_name (string) (required)
The name of the environment. The name must be URL encoded. For example, any slashes in the name must be replaced with %2F.
name (string) (required)
The name of the variable.
value (string) (required)
The value of the variable.
Request:
curl -L \
-X POST \
https://api.github.com/repos/OWNER/REPO/environments/ENVIRONMENT_NAME/variables \
-d '{
"name": "USERNAME",
"value": "octocat"
}'
Response schema (Status: 201):
GET /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
Gets a specific variable in an environment.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
environment_name (string) (required)
The name of the environment. The name must be URL encoded. For example, any slashes in the name must be replaced with %2F.
name (string) (required)
The name of the variable.
Request:
curl -L \
-X GET \
https://api.github.com/repos/OWNER/REPO/environments/ENVIRONMENT_NAME/variables/NAME
Response schema (Status: 200):
Same response schema as Get a repository variable.
PATCH /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
Updates an environment variable that you can reference in a GitHub Actions workflow.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
environment_name (string) (required)
The name of the environment. The name must be URL encoded. For example, any slashes in the name must be replaced with %2F.
name (string)
The name of the variable.
value (string)
The value of the variable.
Request:
curl -L \
-X PATCH \
https://api.github.com/repos/OWNER/REPO/environments/ENVIRONMENT_NAME/variables/NAME \
-d '{
"name": "USERNAME",
"value": "octocat"
}'
Response schema (Status: 204):
DELETE /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
Deletes an environment variable using the variable name.
Authenticated users must have collaborator access to a repository to create, update, or read variables.
OAuth tokens and personal access tokens (classic) need the repo scope to use this endpoint.
accept (string)application/vnd.github+json is recommended.owner (string) (required)
The account owner of the repository. The name is not case sensitive.
repo (string) (required)
The name of the repository without the .git extension. The name is not case sensitive.
name (string) (required)
The name of the variable.
environment_name (string) (required)
The name of the environment. The name must be URL encoded. For example, any slashes in the name must be replaced with %2F.
Request:
curl -L \
-X DELETE \
https://api.github.com/repos/OWNER/REPO/environments/ENVIRONMENT_NAME/variables/NAME
Response schema (Status: 204):