Use the REST API to block and unblock users in an organization.
The token used to authenticate the call must have the admin:org scope in order to make any blocking calls for an organization. Otherwise, the response returns HTTP 404.
Note
Most endpoints use Authorization: Bearer <YOUR-TOKEN> and Accept: application/vnd.github+json headers, plus X-GitHub-Api-Version: 2026-03-10. Curl examples below omit these standard headers for brevity.
GET /orgs/{org}/blocks
List the users blocked by an organization.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
per_page (integer)
The number of results per page (max 100). For more information, see "Using pagination in the REST API."
Default: 30
page (integer)
The page number of the results to fetch. For more information, see "Using pagination in the REST API."
Default: 1
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/blocks
Response schema (Status: 200):
Array of Simple User:
name: string or nullemail: string or nulllogin: required, stringid: required, integer, format: int64node_id: required, stringavatar_url: required, string, format: urigravatar_id: required, string or nullurl: required, string, format: urihtml_url: required, string, format: urifollowers_url: required, string, format: urifollowing_url: required, stringgists_url: required, stringstarred_url: required, stringsubscriptions_url: required, string, format: uriorganizations_url: required, string, format: urirepos_url: required, string, format: urievents_url: required, stringreceived_events_url: required, string, format: uritype: required, stringsite_admin: required, booleanstarred_at: stringuser_view_type: stringGET /orgs/{org}/blocks/{username}
Returns a 204 if the given user is blocked by the given organization. Returns a 404 if the organization is not blocking the user, or if the user account has been identified as spam by GitHub.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
username (string) (required)
The handle for the GitHub user account.
204 - If the user is blocked
404 - If the user is not blocked
Request:
curl -L \
-X GET \
https://api.github.com/orgs/ORG/blocks/USERNAME
Response schema (Status: 204):
PUT /orgs/{org}/blocks/{username}
Blocks the given user on behalf of the specified organization and returns a 204. If the organization cannot block the given user a 422 is returned.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
username (string) (required)
The handle for the GitHub user account.
204 - No Content
422 - Validation failed, or the endpoint has been spammed.
Request:
curl -L \
-X PUT \
https://api.github.com/orgs/ORG/blocks/USERNAME
Response schema (Status: 204):
DELETE /orgs/{org}/blocks/{username}
Unblocks the given user on behalf of the specified organization.
accept (string)application/vnd.github+json is recommended.org (string) (required)
The organization name. The name is not case sensitive.
username (string) (required)
The handle for the GitHub user account.
Request:
curl -L \
-X DELETE \
https://api.github.com/orgs/ORG/blocks/USERNAME
Response schema (Status: 204):