diff --git a/content/organizations/managing-programmatic-access-to-your-organization/about-programmatic-access-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/about-programmatic-access-in-your-organization.md deleted file mode 100644 index 78f84356120f..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/about-programmatic-access-in-your-organization.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: About programmatic access in your organization -intro: 'As an organization owner, you can control access to your organization by {% data variables.product.pat_generic %}s, {% data variables.product.prodname_github_apps %}, and {% data variables.product.prodname_oauth_apps %}.' -permissions: Organization owners can control programmatic access in their organization. -topics: - - Organizations - - GitHub Apps - - OAuth apps - - API -shortTitle: About programmatic access -versions: - fpt: '*' - ghes: '*' - ghec: '*' ---- - -## About programmatic access - -{% data variables.product.prodname_github_apps %}, {% data variables.product.prodname_oauth_apps %}, and {% data variables.product.pat_generic %}s can be used to make API requests that read or write resources owned by an organization. As an organization owner, you can control access to your organization by {% data variables.product.prodname_github_apps %}{% ifversion fpt or ghec %}, {% data variables.product.prodname_oauth_apps %},{% endif %} and {% data variables.product.pat_generic %}s. - -## {% data variables.product.prodname_github_apps %} - -Organization owners can install {% data variables.product.prodname_github_apps %} on their organization. Repository admins can also install a {% data variables.product.prodname_github_app %} on the organization if the app does not request organization resources and if they only grant the app access to repositories where they are an admin. Organization members can submit a request for their organization owner to install a {% data variables.product.prodname_github_app %} on the organization. For more information, see {% ifversion fpt or ghec %}[AUTOTITLE](/apps/using-github-apps/installing-an-app-in-your-organization).{% else %}[AUTOTITLE](/apps/maintaining-github-apps/installing-github-apps).{% endif %} - -Organization owners can prevent outside collaborators from requesting {% data variables.product.prodname_github_apps %} or from installing a {% data variables.product.prodname_github_app %} even if the collaborator is a repository admin. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests). - -Organization owners can review the {% data variables.product.prodname_github_apps %} that are installed on their organization and modify the repositories that each app can access. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/reviewing-github-apps-installed-in-your-organization). - -To help maintain {% data variables.product.prodname_github_apps %} owned by their organization, organization owners can designate other users in their organization as {% data variables.product.prodname_github_app %} managers. {% data variables.product.prodname_github_app %} managers can manage the settings of some or all of the {% data variables.product.prodname_github_apps %} that are owned by the organization. The {% data variables.product.prodname_github_app %} manager role does not grant users permission to install {% data variables.product.prodname_github_apps %} on an organization. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization). - -{% ifversion fpt or ghec %} - -## {% data variables.product.prodname_oauth_apps %} - -Organization managers can restrict {% data variables.product.prodname_oauth_apps %} from accessing organization resources. When these restrictions are enabled, organization members and outside collaborators can still request approval for individual {% data variables.product.prodname_oauth_apps %}. For more information, see [AUTOTITLE](/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions). - -{% endif %} - -## {% data variables.product.pat_generic_caps %}s - -Organization owners can prevent {% data variables.product.pat_v2 %}s and {% data variables.product.pat_v1_plural %} from accessing resources owned by the organization. Organization owners can also require approval for each {% data variables.product.pat_v2 %} that can access the organization. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization). - -Organization owners can view all {% data variables.product.pat_v2 %}s that can access resources owned by the organization. Organization owners can also revoke access by {% data variables.product.pat_v2 %}s. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization). - -{% ifversion ghec %} - -If their organization uses SAML, organization owners can see each {% data variables.product.pat_generic %} that a member of their organization authorized. For more information, see [AUTOTITLE](/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization#viewing-and-revoking-authorized-credentials). - -{% endif %} - -{% ifversion ghes %} - -Site administrators can use the REST API to manage {% data variables.product.pat_generic %}s in their enterprise. For more information, see [AUTOTITLE](/rest/enterprise-admin/users). - -{% endif %} diff --git a/content/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization.md deleted file mode 100644 index cdb44a8b6ea6..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Adding and removing GitHub App managers in your organization -intro: 'Organization owners can grant or revoke access for a user to manage some or all of the {% data variables.product.prodname_github_apps %} owned by the organization.' -redirect_from: - - /articles/adding-github-app-managers-in-your-organization - - /github/setting-up-and-managing-organizations-and-teams/adding-github-app-managers-in-your-organization - - /organizations/managing-access-to-your-organizations-apps/adding-github-app-managers-in-your-organization - - /articles/removing-github-app-managers-from-your-organization - - /github/setting-up-and-managing-organizations-and-teams/removing-github-app-managers-from-your-organization - - /organizations/managing-access-to-your-organizations-apps/removing-github-app-managers-from-your-organization - - /organizations/managing-programmatic-access-to-your-organization/adding-github-app-managers-in-your-organization - - /organizations/managing-programmatic-access-to-your-organization/removing-github-app-managers-from-your-organization -versions: - fpt: '*' - ghes: '*' - ghec: '*' -topics: - - Organizations - - Teams - - GitHub Apps -shortTitle: GitHub App managers ---- - -## About {% data variables.product.prodname_github_app %} managers - -{% data reusables.apps.github-app-managers %} - -For more information about {% data variables.product.prodname_github_app %} manager permissions, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#github-app-managers). - -## Granting the ability to manage all {% data variables.product.prodname_github_apps %} owned by the organization - -{%- ifversion org-app-manager-teams %} -To assign the App Manager organization role to a user or team, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles#assigning-an-organization-role). - -Use the role assignments page to see who has been granted this and any other organization role. Organization owners can always manage {% data variables.product.prodname_github_apps %} and are not shown in this view. -{%- else %} -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.organizations.github-apps-settings-sidebar %} -1. At the bottom of the "Management" section, in the search field, type the username of the person you want to designate as a {% data variables.product.prodname_github_app %} manager in the organization, then click **Grant**. -{%- endif %} - -## Granting the ability to manage an individual {% data variables.product.prodname_github_app %} - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.organizations.github-apps-settings-sidebar %} -1. Under "{% data variables.product.prodname_github_apps %}", click on the avatar of the app you'd like to add a {% data variables.product.prodname_github_app %} manager for. -{% data reusables.organizations.app-managers-settings-sidebar %} -1. At the bottom of the "App managers" section, in the search field, type the username of the person{%- ifversion org-app-manager-teams %} or team{%- endif %} you want to designate as a GitHub App manager for the app, then click **Grant**. - -## Removing a {% data variables.product.prodname_github_app %} manager's permissions for the entire organization - -{%- ifversion org-app-manager-teams %} -See [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles#deleting-an-organization-role-assignment) for directions on removing the App Manager role from a user or team. -{%- else %} -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.organizations.github-apps-settings-sidebar %} -1. Under "Management", next to the person you want to remove {% data variables.product.prodname_github_app %} manager permissions from, click **Revoke**. -{%- endif %} - -## Removing managers from an individual {% data variables.product.prodname_github_app %} - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.organizations.github-apps-settings-sidebar %} -1. Under "{% data variables.product.prodname_github_apps %}", click on the avatar of the app you'd like to remove a {% data variables.product.prodname_github_app %} manager from. -{% data reusables.organizations.app-managers-settings-sidebar %} -1. Under "App managers", next to the person{%- ifversion org-app-manager-teams %} or team{%- endif %} you want to remove {% data variables.product.prodname_github_app %} manager permissions from, click **Revoke**. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/index.md b/content/organizations/managing-programmatic-access-to-your-organization/index.md deleted file mode 100644 index 305ee87228de..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/index.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Managing programmatic access to your organization -intro: 'As an organization owner, you can control access by apps and {% data variables.product.pat_generic %}s to your organization.' -redirect_from: - - /articles/managing-access-to-your-organization-s-apps - - /articles/managing-access-to-your-organizations-apps - - /github/setting-up-and-managing-organizations-and-teams/managing-access-to-your-organizations-apps - - /organizations/managing-access-to-your-organizations-apps -versions: - fpt: '*' - ghes: '*' - ghec: '*' -topics: - - Organizations - - Teams -children: - - /about-programmatic-access-in-your-organization - - /adding-and-removing-github-app-managers-in-your-organization - - /reviewing-github-apps-installed-in-your-organization - - /setting-a-personal-access-token-policy-for-your-organization - - /managing-requests-for-personal-access-tokens-in-your-organization - - /reviewing-and-revoking-personal-access-tokens-in-your-organization - - /limiting-oauth-app-and-github-app-access-requests - - /viewing-api-insights-in-your-organization -shortTitle: Manage programmatic access ---- diff --git a/content/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests.md b/content/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests.md deleted file mode 100644 index 43aaf45898d7..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/limiting-oauth-app-and-github-app-access-requests.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Limiting OAuth app and GitHub App access requests -intro: 'As an organization owner, you can choose whether to allow outside collaborators to request organization access for {% data variables.product.prodname_oauth_apps %} and {% data variables.product.prodname_github_apps %}.' -versions: - fpt: '*' - ghes: '*' - ghec: '*' -permissions: Organization owners can limit who can make app access requests to the organization. -topics: - - Organizations - - GitHub Apps - - OAuth apps -shortTitle: Limit app access requests -redirect_from: - - /organizations/managing-organization-settings/limiting-oauth-app-and-github-app-access-requests ---- - -## About integration access requests - -When integration access requests are enabled, outside collaborators can request organization access for {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} which have not yet been approved by your organization. If you disable integration access requests, only organization members will be able to request organization access for unapproved {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %}. Outside collaborators will still be able to consent to pre-approved {% data variables.product.prodname_github_apps %} and {% data variables.product.prodname_oauth_apps %} accessing the same resources the requesting outside collaborator has access to. - -By default, integration access requests are enabled. If your organization has a large number of outside collaborators, you may want to disable integration access requests, to reduce the number of requests you have to review. - -## Enabling or disabling integration access requests - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -{% data reusables.profile.org_member_privileges %} -1. Under "Integration access requests" select or deselect **Allow integration requests from outside collaborators** and click **Save**. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization.md deleted file mode 100644 index 308f4db24ee3..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Managing requests for personal access tokens in your organization -intro: 'Organization owners can approve or deny {% data variables.product.pat_v2 %}s that request access to their organization.' -versions: - fpt: '*' - ghes: '*' - ghec: '*' -shortTitle: Manage token requests ---- - -## About {% data variables.product.pat_v2 %} requests - -When organization members create a {% data variables.product.pat_v2 %} to access resources owned by the organization, if the organization requires approval for {% data variables.product.pat_v2 %}s, then an organization owner must approve the token before it can be used to access any resources that are not public. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization). - -{% data variables.product.company_short %} will notify organization owners with a daily email about all {% data variables.product.pat_v2 %}s that are awaiting approval. When a token is denied or approved, the user who created the token will receive an email notification. - -> [!NOTE] -> Only {% data variables.product.pat_v2 %}s, not {% data variables.product.pat_v1_plural %}, are subject to approval. Unless the organization has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources without prior approval. For more information, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization). - -Organization owners can also use the REST API to review and manage {% data variables.product.pat_v2 %} requests. These endpoints can only be called by {% data variables.product.prodname_github_apps %}, and cannot be called with {% data variables.product.pat_generic_plural %} or {% data variables.product.prodname_oauth_apps %}. For more information, see [AUTOTITLE](/rest/orgs/orgs#list-requests-to-access-organization-resources-with-fine-grained-personal-access-tokens). - -## Managing {% data variables.product.pat_v2 %} requests - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Pending requests**. If any tokens are pending approval for your organization, they will be displayed. -1. Click the name of the token that you want to approve or deny. -1. Review the access and permissions that the token is requesting. -1. To grant the token access to the organization, click **Approve**. To deny the token access to the organization, click **Deny**. -1. If you denied the request, in the confirmation box, optionally enter the reason that you denied the token. This reason will be shared in the notification that is sent to the token owner. Then, click **Deny**. - -Alternatively, you can approve or deny multiple tokens at once: - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Pending requests**. If any tokens are pending approval for your organization, they will be displayed. -{% data reusables.user-settings.patv2-filters %} -1. Select each token that you want to approve or reject. -1. Select the **request selected...** dropdown menu and click **Approve...** or **Deny...**. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization.md deleted file mode 100644 index 8f1df9f5bb84..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Reviewing and revoking personal access tokens in your organization -intro: 'Organization owners can review the {% data variables.product.pat_v2 %}s that can access their organization. They can also revoke access of specific {% data variables.product.pat_v2 %}s.' -versions: - fpt: '*' - ghes: '*' - ghec: '*' -shortTitle: Review token access ---- - -## About reviewing and revoking {% data variables.product.pat_v2 %}s - -Organization owners can view all {% data variables.product.pat_v2 %}s that can access resources owned by the organization. Organization owners can also revoke access by {% data variables.product.pat_v2 %}s. When a {% data variables.product.pat_v2 %} is revoked, SSH keys created by the token will continue to work and the token will still be able to read public resources within the organization. - -When a token is revoked, the user who created the token will receive an email notification. - -Organization owners can only view and revoke {% data variables.product.pat_v2_plural %} in this UI, not {% data variables.product.pat_v1_plural %}. Unless the organization {% ifversion ghec or ghes %}or enterprise {% endif %}has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources until the token expires. For more information about restricting access by {% data variables.product.pat_v1_plural %}, see [AUTOTITLE](/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization){% ifversion ghec or ghes %} and [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise){% endif %}. - -{% ifversion ghec %} Organization owners can also view and revoke {% data variables.product.pat_v1_plural %} if their organization requires SAML single-sign on. For more information, see [AUTOTITLE](/admin/user-management/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-authorized-credentials). For more information about using the REST API to do this, see [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) and [Remove a SAML SSO authorization for an organization](/rest/orgs/orgs#remove-a-saml-sso-authorization-for-an-organization).{% endif %} - -Organization owners can also use the REST API to review and revoke {% data variables.product.pat_v2 %}s. These endpoints can only be called by {% data variables.product.prodname_github_apps %}, and cannot be called with {% data variables.product.pat_generic_plural %} or {% data variables.product.prodname_oauth_apps %}. For more information, see [AUTOTITLE](/rest/orgs/orgs#list-fine-grained-personal-access-tokens-with-access-to-organization-resources). - -## Reviewing and revoking {% data variables.product.pat_v2 %}s - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Active tokens**. Any {% data variables.product.pat_v2 %}s that can access your organization will be displayed. -1. Click the name of the token that you want review or revoke. -1. Review the access and permissions that the token has. -1. To revoke access by the token to the organization, click **Revoke**. - -Alternatively, you can revoke multiple tokens at once: - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Active tokens**. Any {% data variables.product.pat_v2 %}s that can access your organization will be displayed. -{% data reusables.user-settings.patv2-filters %} -1. Select each token that you want to revoke. -1. Select the **tokens selected...** dropdown menu and click **Revoke...**. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/reviewing-github-apps-installed-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/reviewing-github-apps-installed-in-your-organization.md deleted file mode 100644 index 3a86a6e58eae..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/reviewing-github-apps-installed-in-your-organization.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Reviewing GitHub Apps installed in your organization -intro: "You can review the permissions and change the repository access for {% data variables.product.prodname_github_apps %} installed on your organization. You can also temporarily or permanently prevent a {% data variables.product.prodname_github_app %} from accessing resources owned by your organization." -redirect_from: - - /articles/reviewing-your-organization-s-installed-integrations - - /articles/reviewing-your-organizations-installed-integrations - - /github/setting-up-and-managing-organizations-and-teams/reviewing-your-organizations-installed-integrations - - /organizations/keeping-your-organization-secure/reviewing-your-organizations-installed-integrations - - /organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-your-organizations-installed-integrations - - /organizations/managing-programmatic-access-to-your-organization/reviewing-your-organizations-installed-integrations -versions: - fpt: '*' - ghes: '*' - ghec: '*' -topics: - - Organizations - - Teams -shortTitle: Review installed GitHub Apps ---- - -Organization owners can review the {% data variables.product.prodname_github_apps %} that are installed on their organization. They can view the permissions granted to the app and change the repositories that the {% data variables.product.prodname_github_app %} can access. They can also suspend or delete the {% data variables.product.prodname_github_app %} to prevent the app from accessing resources owned by the organization. For more information, see [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps). - -Organization owners can also use the REST API to view the {% data variables.product.prodname_github_apps %} installed on their organization, along with the permissions and repository access granted to each {% data variables.product.prodname_github_app %}. For more information, see [AUTOTITLE](/rest/orgs/orgs#list-app-installations-for-an-organization). diff --git a/content/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization.md deleted file mode 100644 index 195901b6cdfc..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Setting a personal access token policy for your organization -intro: 'Organization owners can control access to resources by applying policies to {% data variables.product.pat_generic_plural %}' -versions: - fpt: '*' - ghes: '*' - ghec: '*' -shortTitle: Set a token policy ---- - -## Restricting access by {% data variables.product.pat_generic_plural %} - -Organization owners can prevent {% data variables.product.pat_generic_plural %} from accessing resources owned by the organization with the following options: -* **Restrict access via {% data variables.product.pat_generic_plural %}:** {% data variables.product.pat_v1_caps_plural %} or {% data variables.product.pat_v2_plural %} cannot access resources owned by the organization. SSH keys created by {% data variables.product.pat_generic_plural %} will continue to work. -* **Allow access via {% data variables.product.pat_generic_plural %}:** {% data variables.product.pat_v1_caps_plural %} or {% data variables.product.pat_v2_plural %} can access resources owned by the organization. - -Regardless of the chosen policy, {% data variables.product.pat_generic_caps_plural %} will have access to public resources within the organization. {% ifversion fpt or ghec or ghes > 3.16 %}By default, both {% data variables.product.pat_v1_caps_plural %} and {% data variables.product.pat_v2_plural %} are enabled.{% endif %} - -{% ifversion ghec or ghes %} If your organization is owned by an enterprise, and your enterprise owner has restricted access by {% data variables.product.pat_generic_caps_plural %}, you cannot override the policy in your organization. For more information, see [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise).{% endif %} - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Settings**. {% ifversion tabbed-pat-settings-ui %} -1. Select either the **Fine-grained tokens** or **Tokens (classic)** tab to enforce this policy based on the token type. {% endif %} -1. Under **{% data variables.product.pat_v2_caps_plural %}** or **Restrict {% data variables.product.pat_v1_plural %} from accessing your organizations**, select your access policy. -1. Click **Save**. - -{% ifversion pats-maximum-lifetime %} - -## Enforcing a maximum lifetime policy for {% data variables.product.pat_generic_plural %} - -Organization owners can set maximum lifetime allowances for both {% data variables.product.pat_v2_plural %} and {% data variables.product.pat_v1_plural %} to control access to organization resources. {% ifversion ghec or ghes %} However, these policies cannot exceed the maximum lifetime set at the enterprise level or disable the expiration policy set at the enterprise level. See [Enforcing a maximum lifetime policy for {% data variables.product.pat_generic_plural %}](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise#enforcing-a-maximum-lifetime-policy-for-personal-access-tokens) {% endif %} - -For {% data variables.product.pat_v2_plural %}, the default the maximum lifetime policy for organizations is set to expire within 366 days. {% data variables.product.pat_v1_caps_plural %} do not have an expiration requirement. - -When you set a policy, tokens with non-compliant lifetimes will be blocked from accessing your organization if the token belongs to a member of your organization. Setting this policy does not revoke or disable these tokens. Users will learn that their existing token is non-compliant when API calls for your organization are rejected. - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, click **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**. -1. Select either the **Fine-grained tokens** or **Tokens (classic)** tab to enforce this policy based on the token type. -1. Under **Set maximum lifetimes for {% data variables.product.pat_generic_plural %}**, set the maximum lifetime. -1. Click **Save**. -{% endif %} - -## Enforcing an approval policy for {% data variables.product.pat_v2_plural %} - -Organization owners can manage approval requirements for each {% data variables.product.pat_v2 %} that can access the organization with the following options: - * **Require administrator approval:** An organization owner must approve each {% data variables.product.pat_v2 %} that can access the organization. {% data variables.product.pat_v2_caps_plural %} created by organization owners will not need approval. This is the default value. - * **Do not require administrator approval:** {% data variables.product.pat_v2_caps %}s created by organization members can access resources in the organization without prior approval. - -{% data variables.product.pat_v2_caps_plural %} will still be able to read public resources within the organization without approval. - -{% ifversion ghec or ghes %} If your organization is owned by an enterprise, and your enterprise owner has set an approval policy for {% data variables.product.pat_v2 %}s, then you cannot override the policy in your organization. For more information, see [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise).{% endif %} - -> [!NOTE] -> Only {% data variables.product.pat_v2_plural %}, not {% data variables.product.pat_v1_plural %}, are subject to approval. Unless the organization has restricted access by {% data variables.product.pat_v1_plural %}, any {% data variables.product.pat_v1 %} can access organization resources without prior approval. For more information, see [Restricting access by {% data variables.product.pat_generic_plural %}](#restricting-access-by-personal-access-tokens) on this page. - -{% data reusables.profile.access_org %} -{% data reusables.profile.org_settings %} -1. In the left sidebar, under **{% octicon "key" aria-hidden="true" aria-label="key" %} {% data variables.product.pat_generic_caps %}s**, click **Settings**. {% ifversion tabbed-pat-settings-ui %} -1. Select the **Fine-grained tokens** tab. {% endif %} -1. Under **Require approval of {% data variables.product.pat_v2_plural %}**, select the option that meets your needs: -1. Click **Save**. diff --git a/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md b/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md deleted file mode 100644 index e69d4bd55091..000000000000 --- a/content/organizations/managing-programmatic-access-to-your-organization/viewing-api-insights-in-your-organization.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Viewing API insights in your organization -shortTitle: Viewing API insights -intro: "You can view REST API activity for your entire organization or specific apps and users." -permissions: 'Organization owners and users with the "View organization API insights" permission.' -product: 'Your organization must be on a {% data variables.product.prodname_ghe_cloud %} plan.' -versions: - feature: 'api-insights' -topics: - - API - - Organizations - - REST ---- - -## About API insights - -As a {% data variables.product.prodname_ghe_cloud %} organization owner, you and your designated users can view REST API activity for your entire organization or specific apps and users. This helps you understand the sources of your REST API activity and manage against your primary rate limits, giving you visibility into the timeframe, apps, and API endpoints involved. To learn more about primary rate limits, see [AUTOTITLE](/rest/using-the-rest-api/rate-limits-for-the-rest-api#about-primary-rate-limits). - -> [!NOTE] Currently, this feature supports only the `core` category of REST API endpoints and primary rate limits. API activity for search, {% data variables.product.prodname_actions %} (using the [`GITHUB_TOKEN`](/actions/security-for-github-actions/security-guides/automatic-token-authentication) secret), and secondary rate-limiting are not supported. For information about API categories, see [AUTOTITLE](/rest/rate-limit/rate-limit). To learn more about primary and secondary rate limits, see [AUTOTITLE](/rest/using-the-rest-api/rate-limits-for-the-rest-api). - -## Enabling access to API insights - -Organization owners can create custom organization roles to allow people to view API insights for their organization. To provide users with access, select the **View organization API insights** permission when creating a custom organization role. Then assign the custom role to an organization member or team. For more information, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles). - ->[!WARNING] Granting access to organization non-owners will allow them to view API insights for all users and apps in the organization, so privacy should be considered. - -## Understanding API insights aggregation - -The time period selection feature allows you to view API insights over predefined periods or a custom period, as detailed in the following table. By default, data is presented in Coordinated Universal Time (UTC). You can change the data displayed from UTC to your browser's time zone in the "Period" drop down menu at the top-right of the page. - -{% rowheaders %} - -| Period | Description | -|-----------------|------------------------------------------------------------------------------------------------------------| -| Last 30 minutes | Data from the last 30 minutes to when the page is viewed. | -| Last 1 hour | Data from the last 1 hour to when the page is viewed. | -| Last 3 hours | Data from the last 3 hours to when the page is viewed. | -| Last 12 hours | Data from the last 12 hours to when the page is viewed. | -| Last 24 hours | (Default) Data from the last 24 hours to when the page is viewed. | -| Last 7 days | Data from the last 7 days to when the page is viewed. | -| Last 31 days | Data from the last 31 days to when the page is viewed. | -| Custom | Data from a custom date and time range that you provide. Custom ranges must begin within the last 31 days. | - -{% endrowheaders %} - -## Viewing API insights for an organization - -{% data reusables.profile.access_org %} -{% data reusables.user-settings.access_org %} -{% data reusables.organizations.insights %} -1. In the "Insights" navigation menu, click **REST API**. -1. Optionally, to select a time period to view API insights for, choose an option from the **Period** drop down menu at the top-right of the page. For more information, see [Understanding API insights aggregation](#understanding-api-insights-aggregation). -1. Optionally, to switch between displaying dates and times in Coordinated Universal Time (UTC) or the local time zone used by your browser, select "UTC" or "Local" from the **Period** drop down menu at the top-right of the page. -1. Optionally, to select how granularly to display REST API requests on the chart, choose an option from the **Interval** drop down menu at the top-right of the page. Large intervals show summaries of the API activity on the chart while smaller intervals show greater detail for the selected time period. The chart does not automatically update to show new activity. - -The selected period and interval automatically become part of the page URL so that if you share the URL with someone, they will see the same view. - -## Viewing API insights for an organization's apps and users - -The "Actors" table displays {% data variables.product.prodname_github_apps %} and users that made REST API requests in the current organization within the selected time period. The table does not automatically update to show new activity. - -1. First, view API insights for an organization using the steps above in [Viewing API insights for an organization](#viewing-api-insights-for-an-organization). -1. Filter the apps and users displayed in the "Actors" table. - 1. To filter by name, enter the first few letters of the name in the search field above the "Actors" table. Then press enter. - 1. To filter by type of actor (app or user), choose an option from the **Type** drop down menu above the top-right of the "Actors" table. - 1. To filter by type of request (all or primary-rate-limited), choose an option from the **Requests** drop down menu above the top-right of the "Actors" table. - -## Viewing API insights for a specific app or user in an organization - -1. First, view API insights for an organization using the steps above in [Viewing API insights for an organization](#viewing-api-insights-for-an-organization). -1. Optionally, select an app in the "Actors" table to display its REST API activity and any primary-rate-limiting. The resulting view will be specific to the selected app and will display the API endpoints it accessed. -1. Optionally, select a user in the "Actors" table to display their personal REST API activity. The resulting view will be specific to the selected user and will display API activity of their {% data variables.product.pat_generic_plural %} and requests made by {% data variables.product.prodname_oauth_apps %} on their behalf. Both contribute to a user’s personal primary rate limit. For information about primary rate limits for users, and {% data variables.product.prodname_oauth_apps %} that act on their behalf, see [AUTOTITLE](/rest/using-the-rest-api/rate-limits-for-the-rest-api#primary-rate-limit-for-authenticated-users). - 1. Optionally, in the user-specific view, click on a {% data variables.product.pat_generic %} or {% data variables.product.prodname_oauth_app %} to view its REST API activity made on behalf of the user.