GitHub: List requests to access organization resources with fine-grained personal access tokens

← Orgs operations · Get started

Operation github.orgs_list_pat_grant_requests

Provider route: GET /orgs/{org}/personal-access-token-requests. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["orgs"]["orgsListPatGrantRequests"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.orgs.orgsListPatGrantRequests(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.orgs.orgs_list_pat_grant_requests(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.org	string	Required within parent
query	Model	Optional	Expand List fine-grained personal access tokens with access to organization resources — request body — query

Referenced models: List fine-grained personal access tokens with access to organization resources — request body — query

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	array	Root
$[]	Model	Each item	Expand List requests to access organization resources with fine-grained personal access tokens — response body — item

Referenced models: List requests to access organization resources with fine-grained personal access tokens — response body — item

Schemas

List requests to access organization resources with fine-grained personal access tokens — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	Minimal representation of an organization programmatic access grant request for enumerations
created_at	string	Required within parent	Date and time when the request for access was created.
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Unique identifier of the request for access via fine-grained personal access token. The `pat_request_id` used to review PAT requests.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
owner	Model	Required within parent	Expand List users — response body — item
permissions	object	Required within parent	Permissions requested, categorized by type of permission.
permissions.organization	object	Optional	Additional keys: see wildcard field
permissions.organization.*	string	Additional keys
permissions.other	object	Optional	Additional keys: see wildcard field
permissions.other.*	string	Additional keys
permissions.repository	object	Optional	Additional keys: see wildcard field
permissions.repository.*	string	Additional keys
reason	JSON	Required within parent
reason (anyOf 1)	string	Alternative	Reason for requesting access.
reason (anyOf 2)	null	Alternative
repositories_url	string	Required within parent	URL to the list of repositories requested to be accessed via fine-grained personal access token. Should only be followed when `repository_selection` is `subset`.
repository_selection	string	Required within parent	Type of repository selection requested. Known values: none, all, subset
token_expired	boolean	Required within parent	Whether the associated fine-grained personal access token has expired.
token_expires_at	JSON	Required within parent
token_expires_at (anyOf 1)	string	Alternative	Date and time when the associated fine-grained personal access token expires.
token_expires_at (anyOf 2)	null	Alternative
token_id	JSON	Required within parent
token_id (anyOf 1)	integer	Alternative	Unique identifier of the user's token. This field can also be found in audit log events and the organization's settings for their PAT grants.
token_id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
token_last_used_at	JSON	Required within parent
token_last_used_at (anyOf 1)	string	Alternative	Date and time when the associated fine-grained personal access token was last used for authentication.
token_last_used_at (anyOf 2)	null	Alternative
token_name	string	Required within parent	The name given to the user's token. This field can also be found in an organization's settings page for Active Tokens.

Referenced models: List users — response body — item

List fine-grained personal access tokens with access to organization resources — request body — query

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
per_page	integer	Optional	Default: 30
page	integer	Optional	Default: 1
sort	string	Optional	Default: created_at One of: created_at
direction	string	Optional	Default: desc One of: asc, desc
owner	array	Optional	Maximum items: 10
owner[]	string	Each item
repository	string	Optional
permission	string	Optional
last_used_before	string	Optional	Format: date-time
last_used_after	string	Optional	Format: date-time
token_id	array	Optional	Maximum items: 50
token_id[]	string	Each item

List users — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	A GitHub user.
avatar_url	string	Required within parent	Format: uri
email	JSON	Optional
email (anyOf 1)	string	Alternative
email (anyOf 2)	null	Alternative
events_url	string	Required within parent
followers_url	string	Required within parent	Format: uri
following_url	string	Required within parent
gists_url	string	Required within parent
gravatar_id	JSON	Required within parent
gravatar_id (anyOf 1)	string	Alternative
gravatar_id (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Format: int64
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
login	string	Required within parent
name	JSON	Optional
name (anyOf 1)	string	Alternative
name (anyOf 2)	null	Alternative
node_id	string	Required within parent
organizations_url	string	Required within parent	Format: uri
received_events_url	string	Required within parent	Format: uri
repos_url	string	Required within parent	Format: uri
site_admin	boolean	Required within parent
starred_at	string	Optional
starred_url	string	Required within parent
subscriptions_url	string	Required within parent	Format: uri
type	string	Required within parent
url	string	Required within parent	Format: uri
user_view_type	string	Optional

Policy, approvals and errors

SDK function policy ID: github.orgs_list_pat_grant_requests. Catalog operation: orgs/list-pat-grant-requests. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source