kind:change

title:Audit organization members for two-factor authentication

created_at:2014-01-29

author_name:pengwynn

We've added a[new filter][filter] for listing members of an organization without

[two-factor authentication][2fa-blog] enabled:

<preclass="terminal">

$ curl -H "Authorization: token [yours]" \

https://api.github.com/orgs/octokit/members\?filter\=2fa_disabled

</pre>

The new filter is available for owners of organizations with private

repositories. Happy auditing and[send us your feedback or questions][contact].

[filter]:/v3/orgs/members/#audit-two-factor-auth

[2fa-blog]:https://github.com/blog/1614-two-factor-authentication

[contact]:https://github.com/contact?form[subject]=API+2FA+filter

we can tell the API to give us the resource again, only if it has changed:

<preclass="terminal">

$ curl -i -H 'If-None-Match: "644b5b0155e6404a9cc4bd9d8b1ae730"' \

$ curl -i -H 'If-None-Match: "bfd85cbf23ac0b0c8a29bee02e7117c6"' \

https://api.github.com/users/defunkt

HTTP/1.1 304OK

HTTP/1.1 304Not Modified

</pre>

The`304` status indicates that the resource hasn't changed since the last time

<preclass="terminal">

$ curl https://api.github.com?callback=foo

foo({

/**/foo({

"meta": {

"status": 200,

"X-RateLimit-Limit": "5000",

})

</pre>

You can write a JavaScript handler to process the callback like this:

You can write a JavaScript handler to process the callback. Here's a minimal example you can try out:

<pre><codeclass="language-javascript">function foo(response) {

<pre><codeclass="language-html">&lt;html>

&lt;head>

&lt;script type="text/javascript">

function foo(response) {

var meta = response.meta

var data = response.data

console.log(meta)

console.log(data)

}</code></pre>

}

var script = document.createElement('script');

script.src = 'https://api.github.com?callback=foo'

document.getElementsByTagName('head')[0].appendChild(script);

&lt;/script>

&lt;/head>

&lt;body>

&lt;p>Open up your browser's console.&lt;/p>

&lt;/body>

&lt;/html></code></pre>

All of the headers are the same String value as the HTTP Headers with one

notable exception: Link. Link headers are pre-parsed for you and come

<%= headers 200 %>

<%= json:repo_subscription %>

<%= headers 404 %>

<%= headers 201,

:Location => "https://api.github.com/git/:owner/:repo/blob/:sha" %>

<%= json:sha => "3a0f86fb8db8eea7ccbb9a95f325ddbedfb25e15" %>

:Location => "https://api.github.com/repos/octocat/example/git/blobs/3a0f86fb8db8eea7ccbb9a95f325ddbedfb25e15" %>

<%= json:blob_after_create %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`message`|`string` |**Required**. The commit message

`tree`|`string` |**Required**. The SHA of the tree object this commit points to

Both the`author` and`commiter` parameters have the same keys:

Name | Type | Description

Name | Type | Description

-----|------|-------------

`name`|`string` | The name of the author (or commiter) of the commit

`email`|`string` | The email of the author (or commiter) of the commit

<%= headers 201,

:Location => "https://api.github.com/git/:owner/:repo/commit/:sha" %>

:Location => "https://api.github.com/repos/octocat/Hello-World/git/commits/7638417db6d59f3c431d3e1f261cc637155684cd" %>

<%= json:new_commit %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`ref`|`type`| The name of the fully qualified reference (ie:`refs/heads/master`). If it doesn't start with 'refs' and have at least two slashes, it will be rejected.

`sha`|`type`| The SHA1 value to set this reference to

<%= json "ref"=>"refs/heads/master",\

"sha"=>"827efc6d56897b048c772eb4087f854f46256132" %>

<%= json "ref"=>"refs/heads/featureA",\

"sha"=>"aa218f56b14c9653891f9e74264a383fa43fefbd" %>

<%= headers 201 %>

<%= headers 201,\

:Location => "https://api.github.com/repos/octocat/Hello-World/git/refs/heads/featureA" %>

<%= json:ref %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`sha`|`type`| The SHA1 value to set this reference to

`force`|`boolean`| Indicates whether to force the update or to make sure the update is a fast-forward update. Leaving this out or setting it to`false` will make sure you're not overwriting work. Default:`false`

<%= headers 200,\

:Location => "https://api.github.com/git/:owner/:repo/commit/:sha" %>

<%= headers 200 %>

<%= json:ref %>

<%= headers 204 %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`tag`|`string`| The tag

`message`|`string`| The tag message

The`tagger` hash contains the following keys:

Name | Type | Description

Name | Type | Description

-----|------|--------------

`name`|`string`| The name of the author of the tag

`email`|`string`| The email of the author of the tag

<%= headers 201,

:Location => "https://api.github.com/repos/:owner/:repo/git/tags/:sha" %>

:Location => "https://api.github.com/repos/octocat/Hello-World/git/tags/940bd336248efae0f9ee5bc7b2d5c985887b16ac" %>

<%= json:gittag %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`tree`|`array` of`hash`es |**Required**. Objects (of`path`,`mode`,`type`, and`sha`) specifying a tree structure

`base_tree`|`string` | The SHA1 of the tree you want to update with new data. If you don't set this, the commit will be created on top of everything; however, it will only contain your change, the rest of your files will show up as deleted.

The`tree` parameter takes the following keys:

Name | Type | Description

Name | Type | Description

-----|------|--------------

`path`|`string`| The file referenced in the tree

`mode`|`string`| The file mode; one of`100644` for file (blob),`100755` for executable (blob),`040000` for subdirectory (tree),`160000` for submodule (commit), or`120000` for a blob that specifies the path of a symlink

<%= headers 201,

:Location => "https://api.github.com/repos/:owner/:repo/git/trees/:sha" %>

:Location => "https://api.github.com/repos/octocat/Hello-World/trees/cd8274d15fa3ae2ab983129fb037999f264ba9a7" %>

<%= json:tree_new %>

Check out the[Basics of Authentication guide][basics auth guide] which

provides tips on handling modifiable token scopes.

When requesting multiple scopes, the token will be saved with a normalized list

of scopes, discarding those that are implicitly included by another requested

scope. For example, requesting`user,gist,user:email` will result in a

token with`user` and`gist` scopes only since the access granted with

`user:email` scope[is included](#scopes) in the`user` scope.

The access token allows you to make requests to the API on a behalf of a user.

Name | Description

-----|-----------|

`(no scope)`| Grants read-only access to public information (includes public user profile info, public repository info, and gists)

`user` | Grants read/write access to profile info only. Note that this scope includes`user:email` and`user:follow`.

`user` | Grants read/write access to profile info only. Note: this scope includes`user:email` and`user:follow`.

`user:email`| Grants read access to a user's email addresses.

`user:follow`| Grants access to follow or unfollow other users.

`public_repo`| Grants read/write access to code, commit statuses, and deployment statuses for public repositories and organizations.

`repo`| Grants read/write access to code, commit statuses, and deployment statuses for public and private repositories and organizations.

`repo:status`| Grants read/write access to public and private repository commit statuses. This scope is only necessary to grant other users or services access to private repository commit statuses*without* granting access to the code.

`repo:deployment`| Grants access to[deployment statuses][deployments] for public and private repositories. This scope is only necessary to grant other users or services access to deployment statuses,*without* granting access to the code.

`repo:status`| Grants read/write access to public and private repository commit statuses. This scope is only necessary to grant other users or services access to private repository commit statuses*without* granting access to the code.

`delete_repo`| Grants access to delete adminable repositories.

`notifications`| Grants read access to a user's notifications.`repo` also provides this access.

`gist`| Grants write access to gists.

Name | Type | Description

--------|---------|--------------

`filter`|`string` | Filter members returned in the list. Can be one of:<br/>*`2fa_disabled`: Members without[two-factor authentication][2fa-blog] enabled. Available for owners of organizations with private repositories.<br/>*`all`: All members the authenticated user can see.<br/><br/>Default:`all`

[2fa-blog]:https://github.com/blog/1614-two-factor-authentication

<%= headers 200 %>

-----|-----------|

`self`| The API location of this Pull Request.

`html`| The HTML location of this Pull Request.

`comments`| The API location of this Pull Request's Issue comments.

`review_comments`| The API location of this Pull Request's Review comments.

`statuses`| The API location of this Pull Request's commit statuses, which are the statuses of its`head` branch.

`issue`| The API location of this Pull Request's[Issue](/v3/issues/).

`comments`| The API location of this Pull Request's[Issue comments](/v3/issues/comments/).

`review_comments`| The API location of this Pull Request's[Review comments](/v3/pulls/comments/).

`review_comment`| The[URL template](/v3/#hypermedia) to construct the API location for a[Review comment](/v3/pulls/comments/) in this Pull Request's repository.

`commits`|The API location of this Pull Request's[commits](#list-commits-on-a-pull-request).

`statuses`| The API location of this Pull Request's[commit statuses](/v3/repos/statuses/), which are the statuses of its`head` branch.

Name | Type | Description

Name | Type | Description

-----|------|--------------

`state`|`string` | Either`open` or`closed` to filter by state. Default:`open`

`head`|`string` | Filter pulls by head user and branch name in the format of`user:ref-name`. Example:`github:new-script-format`.

You can also create a Pull Request from an existing Issue by passing an

Issue number instead of`title` and`body`.

Name | Type | Description

Name | Type | Description

-----|------|--------------

`issue`|`number` |**Required**. The issue number in this repository to turn into a Pull Request.

Name | Type | Description

Name | Type | Description

-----|------|--------------

`title`|`string` | The title of the pull request.

`body`|`string` | The contents of the pull request.

Name | Type | Description

Name | Type | Description

-----|------|-------------

`commit_message`|`string`| The message that will be used for the merge commit

Name | Type | Description

Name | Type | Description

-----|------|--------------

`sort`|`string` | Can be either`created` or`updated`. Default:`created`

`direction`|`string` | Can be either`asc` or`desc`. Ignored without`sort` parameter.

Name | Type | Description

Name | Type | Description

-----|------|--------------

`body`|`string` |**Required**. The text of the comment

`commit_id`|`string` |**Required**. The SHA of the commit to comment on.

Instead of passing`commit_id`,`path`, and`position` you can reply to

an existing Pull Request Comment like this:

Name | Type | Description

Name | Type | Description

-----|------|--------------

`body`|`string` |**Required**. The text of the comment

`in_reply_to`|`number` |**Required**. The comment id to reply to.

<%= headers 201,

:Location =>

"https://api.github.com/repos/:owner/:repo/pulls/comments/1" %>

"https://api.github.com/repos/octocat/Hello-World/pulls/comments/1" %>

<%= json:pull_comment %>

Name | Type | Description

Name | Type | Description

-----|------|--------------

`body`|`string` |**Required**. The text of the comment

List contributors to the specified repository, sorted by the number of commits per contributor in descending order.