About programmatic access
GitHub Apps, OAuth apps, and personal access tokens can be used to make API requests that read or write resources owned by an organization. As an organization owner, you can control access to your organization by GitHub Apps and personal access tokens.
GitHub Apps
Organization owners can install GitHub Apps on their organization. Repository admins can also install a GitHub App on the organization if the app does not request organization resources and if they only grant the app access to repositories where they are an admin. Organization members can submit a request for their organization owner to install a GitHub App on the organization. For more information, see Installing your own GitHub App.
Organization owners can prevent outside collaborators from requesting GitHub Apps or from installing a GitHub App even if the collaborator is a repository admin. For more information, see Limiting OAuth app and GitHub App access requests.
Organization owners can review the GitHub Apps that are installed on their organization and modify the repositories that each app can access. For more information, see Reviewing GitHub Apps installed in your organization.
To help maintain GitHub Apps owned by their organization, organization owners can designate other users in their organization as GitHub App managers. GitHub App managers can manage the settings of some or all of the GitHub Apps that are owned by the organization. The GitHub App manager role does not grant users permission to install GitHub Apps on an organization. For more information, see Adding and removing GitHub App managers in your organization.
Personal access tokens
Organization owners can prevent fine-grained personal access tokens and personal access tokens (classic) from accessing resources owned by the organization. Organization owners can also require approval for each fine-grained personal access token that can access the organization. For more information, see Setting a personal access token policy for your organization.
Organization owners can view all fine-grained personal access tokens that can access resources owned by the organization. Organization owners can also revoke access by fine-grained personal access tokens. For more information, see Reviewing and revoking personal access tokens in your organization.
Site administrators can use the REST API to manage personal access tokens in their enterprise. For more information, see REST API endpoints for enterprise users.