How can I review all Personal Access Tokens (classic and fine-grained) in my organisation?

[daramcq]

Select Topic Area

Question

Body

Hi! 👋🏻
I want to review my organisation's use of Personal Access Tokens.

We would like to list all PATs in use in the org, both Classic and fine-grained, and, if possible, introspect the scopes that they have been created with.

Ideally, we could do this through the API, but manual review would also be acceptable. I can see that it is possible to do this for fine-grained access tokens (reference), but I have not been able to find anything in the documentation for PATs.

Thanks in advance!

[daramcq]

Just for clarity - we do not want to see the tokens themselves, just relevant data such as the 'note', 'created_at', 'updated_at' and 'scopes' keys.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[mrzinger]

You can use audit logs for this purpose if you have GitHub Enterprise and you are enterprise administrator. This will work only if you have to have at least enterprise:read permissions.

GitHub documentation and APIs can be misleading when it comes to auditing classic Personal Access Tokens due to mismatched terminology.

Since the introduction of fine-grained tokens, the term Personal Access Token (PAT) has started to refer specifically to these newer tokens in the context of security log events. Meanwhile, the legacy (or "classic") access token is now considered an OAuth access token.

Therefore, when working with audit logs to identify events related to fine-grained access tokens, you should use the personal_access_token event group. For classic PATs, the related events are grouped under oauth_access.
For example:

• To find fine-grained PATs, use the personal_access_token.create event.
• For classic PATs, use the oauth_access.create event.