Skip to main content
Use a classic token from a managed user. GitHub limits the setup user (username ending in _admin) to single sign-on and SCIM setup. Classic tokens must be allowed in the enterprise’s Policies > Personal access tokens > Tokens (classic), or in each organization’s Settings > Personal access tokens > Settings when the enterprise leaves it to organizations. If your enterprise uses an IP allow list, it must allow StackOne’s IP addresses. If your identity provider’s Conditional Access policy limits IP addresses, it must allow them too.

​
Find your GHE.com subdomain

The GHE.com subdomain is the part before .ghe.com in your enterprise’s address.

  • Format: https://<subdomain>.ghe.com
  • Example: if your address is https://acme.ghe.com, your subdomain is acme

​
Create a personal access token (classic)

Create the token as a managed user who owns each organization StackOne should read. To list the whole enterprise, use a managed enterprise owner who also owns those organizations.

1

Name the token and set an expiration

Sign in to https://<subdomain>.ghe.com, then open Settings > Developer settings > Personal access tokens > Tokens (classic).

  • Click Generate new token.
  • Select Generate new token (classic).
  • Note: StackOne
  • Expiration: a period that fits your rotation policy
2

Select scopes for user access reviews

Enables actions: Check Organization Membership, Get Authenticated User, Get Organization, Get Organization Membership, Get Team, Get Unified Group, Get Unified Organization, Get Unified User, Get User, List Authenticated User Organization Memberships, List Authenticated User Organizations, List Collaborators, List Organization Audit Log, List Organization Members, List Organization Members With Two-Factor Status, List Outside Collaborators, List Team Members, List Team Repositories, List Teams, List Unified Groups, List Unified Organizations, List Unified Users, List User Organizations, List Users

Select each scope listed.

3

Add scopes for compliance checks

Enables actions: Add Collaborator, Add Team Member, Add Team Repository, Cancel Workflow Run, Check Organization Membership, Create Deployment, Create Deployment Status, Create Git Reference, Create Issue, Create Issue Comment, Create Or Update File, Create Organization Repository, Create Pull Request, Create Pull Request Review, Create Pull Request Review Comment, Create Release, Create Team, Create User Repository, Delete Deployment, Delete File, Delete Git Reference, Delete Release, Delete Team, Download Artifact, Fork Repository, Get Branch, Get Branch Protection, Get Branch Rules, Get Combined Status For Ref, Get Commit, Get Git Reference, Get Issue, Get Latest Release, Get Organization, Get Organization Membership, Get Organization Ruleset, Get Pull Request, Get Repository, Get Repository Content, Get Repository Ruleset, Get Team, Get Workflow Run, List Artifacts, List Authenticated User Organizations, List Authenticated User Repositories, List Branches, List Check Runs For Ref, List Code Scanning Alerts, List Collaborators, List Commits, List Dependabot Alerts, List Deployments, List Enterprise Audit Log, List Forks, List Issue Comments, List Issues, List Matching Git References, List Organization Audit Log, List Organization Branch Protection, List Organization Members, List Organization Members With Two-Factor Status, List Organization Repositories, List Organization Rulesets, List Outside Collaborators, List Pull Request Reviews, List Pull Requests, List Pull Requests For Commit, List Releases, List Repository Rulesets, List Repository Teams, List Secret Scanning Alerts, List Team Members, List Team Repositories, List Teams, List User Organizations, List Workflow Jobs, List Workflow Runs, Merge Pull Request, Re-run Workflow, Remove Collaborator, Remove Organization Member, Remove Team Member, Search Code, Search Issues, Search Pull Requests With Reviews, Search Repositories, Star Repository, Trigger Workflow, Unstar Repository, Update Code Scanning Alert, Update Dependabot Alert, Update Git Reference, Update Issue, Update Organization, Update Pull Request, Update Release, Update Repository, Update Secret Scanning Alert, Update Team

admin:org adds organization rulesets. repo reads private repositories, pull requests, reviews, branch protection and collaborators. read:audit_log reads the organization audit log for an organization owner and the enterprise audit log for an enterprise owner.

4

Add scopes for other actions

Enables actions: Create Deployment, Create Deployment Status, Create Webhook, Delete Deployment, Delete Repository, Delete Webhook, Get Authenticated User, Get Webhook, List Code Scanning Alerts, List Dependabot Alerts, List Deployments, List Secret Scanning Alerts, List Webhooks, Ping Webhook, Update Code Scanning Alert, Update Dependabot Alert, Update Secret Scanning Alert, Update User, Update Webhook

Add only the scopes your actions need. If you selected repo, it already includes repo_deployment and security_events.

5

Generate the token

Scroll to the bottom of the form.

  • Click Generate token.
6

Copy the token

GitHub shows the new token on the page that opens.

  • Copy the token across. GitHub shows it only once.
7

Authorize the token for single sign-on

If a Configure SSO button appears next to the token, authorize it. Otherwise skip this step.

  • Click Configure SSO.
  • Click Authorize next to your enterprise or each organization.

​
Find your organization ID

The Organization ID is the organization name in your organization’s address on GHE.com.

  • Format: https://<subdomain>.ghe.com/<organization ID>
  • Example: if the organization’s address is https://acme.ghe.com/acme-engineering, the organization ID is acme-engineering

​
Find your enterprise slug

The Enterprise slug is the last part of your enterprise’s address, usually the same as your subdomain.

  • Format: https://<subdomain>.ghe.com/enterprises/<enterprise slug>
  • Example: if the enterprise’s address is https://acme.ghe.com/enterprises/acme, the enterprise slug is acme
  • A user appears once they sign in or join an organization. Enterprise members who never signed in and belong to no organization are not listed.
  • Someone whose only tie is a pending organization invitation shows as pending.

​
What GitHub reports for managed users

Managed users sign in and use two-factor authentication through your identity provider, so the two-factor status GitHub shows for them is always off.

1

Connect

  • Click Connect.
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup.
2

Use Actions

Connect an AI platform to the linked account’s actions. See AI Platforms.Other ways to call actions are listed in Protocols & SDKs.

​
Next Steps

Webhooks setup

Configure receiving Events for GitHub into StackOne.