← All permissions
Enterprise permission·enterprise_credentials:write
Enterprise credentials: Write
Tier 1 · High
Why Tier 1
Authorizes and revokes credentials for the enterprise. Revoking all of them locks every member's tokens and keys out at once.
- Target
- Enterprise
- Plane
- ManagementTokens: Personal access token approval, revocation and credential authorizations.
- Granted by
- GitHub App
- Available on
- Enterprise Cloud, EMU
What it unlocks
6 REST endpoints need this permission. A few of them:
- POST /enterprises/{enterprise}/credential-authorizations
- DELETE /enterprises/{enterprise}/credential-authorizations
- POST /enterprises/{enterprise}/credential-authorizations/revoke-all
- POST /enterprises/{enterprise}/credential-authorizations/revoke-credential-type
Roles that include it
- T0Enterprise ownerEvery organization in the enterprise
Classic scopes that reach it
- T0admin:enterprisedocumented
Attack paths
No attack technique, escalation or incident on ghtier goes through this yet.
Other levels
GitHub Docs: Enterprise permissions for "Enterprise credentials"