PUT/orgs/{org}/actions/permissions/selected-actions

Set allowed actions and reusable workflows for an organization

Sets the actions and reusable workflows that are allowed in an organization. To use this endpoint, the organization permission policy for allowed_actions must be configured to selected. For more information, see "Set GitHub Actions permissions for an organization."

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

RetriesRetries up to 2×, 500ms backoff, 30s timeout.

1 parameter · 3 body fields

orgstringrequired

The organization name. The name is not case sensitive.

github_owned_allowedbooleanoptional

Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.

verified_allowedbooleanoptional

Whether actions from GitHub Marketplace verified creators are allowed. Set to `true` to allow all actions by GitHub Marketplace verified creators.

patterns_allowedarray<string>optional

Specifies a list of string-matching patterns to allow specific action(s) and reusable workflow(s). Wildcards, tags, and SHAs are allowed. For example, `monalisa/octocat@*`, `monalisa/octocat@v2`, `monalisa/*`. > [!NOTE] > The `patterns_allowed` setting only applies to public repositories.

1 status code

204Response

import { Client } from "acme-sdk";

const client = new Client({
  baseUrl: "https://api.acme.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.selectedActions.update({
  org: "acme-inc",
  githubOwnedAllowed: true,
  verifiedAllowed: true,
  patternsAllowed: [],
});