curl -X PUT 'https://api.github.com/repos/example-owner/example-repo/actions/permissions/selected-actions' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

# PUT /repos/{owner}/{repo}/actions/permissions/selected-actions (GitHub API)
Base URL: https://api.github.com
Auth: Authorization; GitHub token; required.
Request formats: application/json.
Last verified: 2026-10-20

> Set allowed actions and reusable workflows for a repository

## Critical Gotchas
* GitHub recommends an `Accept: application/vnd.github+json` header and an explicit `X-GitHub-Api-Version` header.
* Fine-grained tokens only authorize repositories and permissions selected when the token is created.

## cURL
curl -X PUT 'https://api.github.com/repos/example-owner/example-repo/actions/permissions/selected-actions' \
  -H "Authorization: Bearer $GITHUB_TOKEN" \
  -H 'Accept: application/vnd.github+json' \
  -H 'X-GitHub-Api-Version: 2026-03-10' \
  -H 'Content-Type: application/json' \
  -d '{}'

## Parameters
| Name | In | Type | Required | Description |
| :--- | :--- | :--- | :--- | :--- |
| owner | path | string | Yes | The account owner of the repository. The name is not case sensitive. |
| repo | path | string | Yes | The name of the repository without the `.git` extension. The name is not case... |
| github_owned_allowed | body | boolean | No | Whether GitHub-owned actions are allowed. For example, this includes the acti... |
| verified_allowed | body | boolean | No | Whether actions from GitHub Marketplace verified creators are allowed. Set to... |
| patterns_allowed | body | string[] | No | Specifies a list of string-matching patterns to allow specific action(s) and... |

## Response example
null

---
Need an API key? Get one at https://github.com/settings/tokens

PUT

PUT /repos/{owner}/{repo}/actions/permissions/selected-actions — GitHub API

GitHub token (required); https://api.github.com

GitHub API

Set allowed actions and reusable workflows for a repository

Base URL: https://api.github.com
Auth: Authorization: Bearer <GITHUB_API_KEY>
Last verified: 2026-10-20 · upstream hash matched

Actions Try in browser→

Agents: curl -H "Accept: text/markdown" this URL
→ 299 tokens · Vary: Accept

Critical gotchas

GitHub recommends an Accept: application/vnd.github+json header and an explicit X-GitHub-Api-Version header.

Fine-grained tokens only authorize repositories and permissions selected when the token is created.

cURL

curl -X PUT 'https://api.github.com/repos/example-owner/example-repo/actions/permissions/selected-actions' \  -H "Authorization: Bearer $GITHUB_TOKEN" \  -H 'Accept: application/vnd.github+json' \  -H 'X-GitHub-Api-Version: 2026-03-10' \  -H 'Content-Type: application/json' \  -d '{}'

Parameters

Name	In	Type	Required	Description
owner	path	string	Yes	The account owner of the repository. The name is not case sensitive.
repo	path	string	Yes	The name of the repository without the `.git` extension. The name is not case sensitive.
github_owned_allowed	body	boolean	No	Whether GitHub-owned actions are allowed. For example, this includes the actions in the `actions` organization.
verified_allowed	body	boolean	No	Whether actions from GitHub Marketplace verified creators are allowed. Set to `true` to allow all actions by GitHub Marketplace verified creators.
patterns_allowed	body	string[]	No	Specifies a list of string-matching patterns to allow specific action(s) and reusable workflow(s). Wildcards, tags, and SHAs are allowed. For example, `monalisa/octocat@`, `monalisa/octocat@v2`, `monalisa/`. > [!NOTE] > The `patterns_allowed` setting only applies to public repositories.

Response 200 OK

null

Get a free GitHub API key → sponsored

Affiliate link - we may earn a commission, at no extra cost to you.