npm / @octokit/rest
@octokit/rest
What changed in @octokit/rest 17 to 22, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-23.
76 breaking1 security32 deprecations79 new APIs and options2 behavior and defaults
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@octokit/rest 223 changes
Breaking changes 3
Deprecated Copilot usage metrics endpoints were removed.
Support for NodeJS v18 was dropped.
Deprecated Projects endpoints were removed.
@octokit/rest 211 changes
Breaking changes 1
The package is now ESM, changing how developers import and use it.
@octokit/rest 203 changes
Breaking changes 3
Support for NodeJS v14 and v16 was dropped.
The agent option was removed from octokit.request().
Preview support for the REST API was removed.
@octokit/rest 191 changes
Breaking changes 1
Support for NodeJS v10 and v12 was dropped, so applications using this release need a newer NodeJS version.
@octokit/rest 1844 changes
Breaking changes 44
Renamed from
octokit.actions.createOrUpdateSecretForRepo().The parameter was renamed from
nametosecret_name.Renamed from
octokit.actions.createRegistrationToken().Renamed from
octokit.actions.createRemoveToken().Renamed from
octokit.actions.deleteSecretFromRepo().The parameter was renamed from
nametosecret_name.Renamed from
octokit.actions.removeSelfHostedRunner().Renamed from
octokit.actions.downloadWorkflowJobLogs().Renamed from
octokit.actions.listWorkflowJobLogs().Renamed from
octokit.actions.listWorkflowRunLogs().Renamed from
octokit.actions.getWorkflowJob().Renamed from
octokit.actions.getPublicKey().Renamed from
octokit.actions.getSecret().The parameter was renamed from
nametosecret_name.Renamed from
octokit.actions.getSelfHostedRunner().Renamed from
octokit.actions.listSecretsForRepo().Renamed from
octokit.actions.listDownloadsForSelfHostedRunnerApplication().Renamed from
octokit.actions.listRepoWorkflowRuns().Renamed from
octokit.activity.checkStarringRepo().Renamed from
octokit.activity.listFeeds().Renamed from
octokit.activity.getThreadSubscription().Renamed from
octokit.activity.listEventsForUser().Renamed from
octokit.activity.listNotifications().Renamed from
octokit.activity.listEventsForOrg().Renamed from
octokit.activity.listPublicEventsForOrg().Renamed from
octokit.activity.listNotificationsForRepo().Renamed from
octokit.activity.markAsRead().Renamed from
octokit.activity.markNotificationsAsReadForRepo().Renamed from
octokit.activity.starRepo().Renamed method for unstarring a repository for the authenticated user.
Renamed from
octokit.apps.createInstallationToken().Renamed from
octokit.apps.checkAccountIsAssociatedWithAny().Renamed from
octokit.apps.checkAccountIsAssociatedWithAnyStubbed().Renamed from
octokit.apps.listAccountsUserOrOrgOnPlan().Renamed from
octokit.apps.listAccountsUserOrOrgOnPlanStubbed().Renamed from
octokit.apps.listRepos().Renamed from
octokit.apps.listMarketplacePurchasesForAuthenticatedUser().Renamed from
octokit.apps.listMarketplacePurchasesForAuthenticatedUserStubbed().Renamed from
octokit.apps.revokeInstallationToken().No longer accepts an array as its first argument; pass plugins as multiple arguments instead.
The deprecated API has been removed.
The deprecated API has been removed.
The deprecated API has been removed.
The deprecated API has been removed.
@octokit/rest 17138 changes
Breaking changes 24
All deprecated methods and options have been removed; use replacement methods or octokit.request where specified.
Endpoint parameters are no longer validated on the client; the notes recommend TypeScript or its definitions in JavaScript.
Node 8 is no longer supported.
The constructor must be invoked with new; calling Octokit() throws a TypeError.
Replaced by octokit.apps.checkToken.
Replaced by octokit.apps.resetToken.
Replaced by octokit.apps.deleteToken.
Replaced by octokit.apps.deleteAuthorization.
The parameter formerly named current_name is now name, and name is now new_name.
Removed; use octokit.request with POST /authorizations instead.
Removed; use octokit.request with DELETE /authorizations/:authorization_id instead.
Removed; use octokit.request with DELETE /applications/grants/:grant_id instead.
Removed; use octokit.request with GET /authorizations/:authorization_id instead.
Removed; use octokit.request with GET /applications/grants/:grant_id instead.
Removed; use octokit.request with PUT /authorizations/clients/:client_id instead.
Removed; use octokit.request with PUT /authorizations/clients/:client_id/:fingerprint instead.
Removed; use octokit.request with GET /authorizations instead.
Removed; use octokit.request with GET /applications/grants instead.
Removed; use octokit.request with PATCH /authorizations/:authorization_id instead.
Always returns an array, including when the response is a single object.
Removed; use octokit.request with POST /repos/:owner/:repo/pulls instead.
The endpoint registration method has been removed; use request.defaults and assign the resulting methods or return them from a plugin.
Removed; use octokit.request with GET /repos/:owner/:repo/commits/:ref instead.
Plugins must return an object to extend the Octokit instance, which is required for TypeScript support.
Security 1
Checks OAuth token validity without exceeding normal rate limits for failed login attempts.
Deprecations 32
This method is deprecated and has been renamed to gists.listForUser.
This method is deprecated and renamed to apps.listSubscriptionsForAuthenticatedUser.
This method is deprecated and renamed to apps.listSubscriptionsForAuthenticatedUserStubbed.
Deprecated in favor of activity.listNotificationsForAuthenticatedUser.
Deprecated in favor of activity.listRepoNotificationsForAuthenticatedUser.
Deprecated in favor of activity.listPublicOrgEvents.
Deprecated in favor of activity.markNotificationsAsRead.
Deprecated in favor of activity.markRepoNotificationsAsRead.
Deprecated in favor of actions.createRegistrationTokenForRepo.
Deprecated in favor of actions.createRemoveTokenForRepo.
Use this renamed method to force removal of a self-hosted runner from a repository.
Use this renamed method to get a redirect URL for downloading workflow job logs.
Use this renamed method to get a redirect URL for downloading workflow run logs.
Deprecated in favor of actions.getSelfHostedRunnerForRepo.
Deprecated in favor of actions.listRunnerApplicationsForRepo.
This method is deprecated; use actions.downloadWorkflowJobLogs instead.
This method is deprecated; use actions.downloadWorkflowRunLogs instead.
This method is deprecated; use actions.deleteSelfHostedRunnerFromRepo instead.
This method is deprecated; use activity.checkRepoIsStarredByAuthenticatedUser instead.
This method is deprecated; use activity.getThreadSubscriptionForAuthenticatedUser instead.
This method is deprecated; use activity.listOrgEventsForAuthenticatedUser instead.
This method is deprecated; use activity.listEventsForAuthenticatedUser instead.
This method is deprecated; use activity.getFeeds instead.
Deprecated; use octokit.activity.unstarRepoForAuthenticatedUser instead.
Deprecated; use octokit.apps.getSubscriptionPlanForAccount instead.
Deprecated; use octokit.apps.getSubscriptionPlanForAccountStubbed instead.
Deprecated; use octokit.apps.listAccountsForPlan instead.
Deprecated; use octokit.apps.listAccountsForPlanStubbed instead.
Use this method to list all codes of conduct; it is the replacement for listConductCodes.
This method is deprecated and has been renamed to codesOfConduct.getAllCodesOfConduct.
octokit.registerEndpoints() is deprecated; register custom methods by assigning defaults from octokit.request, and plugins should return an object instead.
Deprecated in favor of activity.starRepoForAuthenticatedUser.
New APIs and options 79
Creates a check run for a commit, supporting output annotations, images, and requested actions.
Manually creates a check suite when automatic creation has been disabled.
Gets a single check run by its ID.
Gets a single check suite by its ID.
Lists repositories the authenticated user can access for an installation, including each repository’s permissions.
Lists installations; this endpoint requires a JWT.
Lists installations of the GitHub App that the authenticated user has permission to access.
Lists all plans that are part of a GitHub Marketplace listing.
Lists all plans that are part of a GitHub Marketplace listing using the stubbed endpoint.
Lists repositories that an installation can access; this endpoint requires an installation access token.
Lists active subscriptions for the authenticated user.
Lists active subscriptions for the authenticated user using the stubbed endpoint.
Creates or updates a repository secret using an encrypted value.
Creates a registration token for an organization’s self-hosted runners.
Creates a registration token for repository self-hosted runners.
Creates a removal token for an organization’s self-hosted runners.
Creates a removal token for repository self-hosted runners.
Deletes an artifact for a workflow run.
Deletes a repository secret by name.
Forces removal of a self-hosted runner from an organization.
Forces removal of a self-hosted runner from a repository.
Deletes all logs for a workflow run.
Gets a redirect URL to download an artifact archive; the URL expires after one minute.
Gets a redirect URL to download workflow job logs; the link expires after one minute.
Gets a redirect URL to download workflow run logs; the link expires after one minute.
Gets a specific artifact for a workflow run.
Gets the public key required to encrypt repository secrets.
Gets a repository secret without revealing its encrypted value.
Gets a specific self-hosted runner for an organization.
Gets a specific self-hosted runner for a repository.
Gets a specific workflow by ID or workflow file name.
Gets a specific job in a workflow run.
Gets a specific workflow run.
Lists all artifacts for a repository.
Lists jobs for a workflow run, with parameters to narrow the results.
Lists workflow runs for a repository, with optional parameters to narrow results.
Lists the workflows in a repository.
Lists downloadable runner application binaries for an organization.
Lists downloadable runner application binaries for a repository.
Lists repository secrets without revealing their encrypted values.
Lists all self-hosted runners for an organization.
Lists all self-hosted runners for a repository.
Lists artifacts for a workflow run.
Lists workflow runs for a workflow, with optional parameters to narrow results.
Re-runs a workflow run using its ID.
Checks whether a repository is starred by the authenticated user.
Deletes a repository subscription to stop watching the repository.
Mutes future notifications for a conversation until you comment on the thread or are mentioned.
Lists timeline feeds available to the authenticated user.
Gets a repository subscription.
Gets a thread.
Checks whether the authenticated user is subscribed to a thread.
Lists events for the authenticated user; private events are visible when authenticated as that user.
Lists events on the authenticated user's organization dashboard.
Adds a single repository to an installation; the authenticated user must have admin access to the repository.
Creates an attachment under a content reference URL in an issue or pull request body or comment.
Completes the handshake for the GitHub App Manifest flow and retrieves the app details.
Creates an installation access token; repository_ids can restrict the token to specific repositories.
Revokes an OAuth application grant for a specific user and deletes that user's associated OAuth tokens.
Uninstalls a GitHub App from a user, organization, or business account.
Revokes a single token for an OAuth application.
Returns the GitHub App associated with the authentication credentials.
Gets a GitHub App by its URL-friendly name.
Gets an installation using a JWT.
Finds an organization's installation information for an authenticated GitHub App.
Finds a repository's installation information for an authenticated GitHub App.
Gets the subscription plan associated with a user or organization account.
Gets stubbed subscription plan information for a user or organization account.
Finds a user's installation information for an authenticated GitHub App.
Lists user and organization accounts associated with a plan, including free plans.
Lists repository and organization accounts associated with a plan, including free plans.
Adds an async method that returns the currently used authentication based on the configured authStrategy.
The REST library now provides a graphql method alongside request.
The method now accepts owner, repo, and release_id URL parameters; passing url still works but is not recommended.
Removes a repository from an installation; the authenticated user must have admin access to the repository.
Resets a valid OAuth token without end-user involvement; applications must save the response’s token property because changes take effect immediately.
Revokes the installation token in use, which must be replaced before other endpoints requiring it can be used.
Suspends a GitHub App installation, blocking access to the account’s resources; the feature is in beta and requires opt-in.
Removes a GitHub App installation suspension.
Behavior and default changes 2
URL parameters, including options.base and options.head for compareCommits, are automatically encoded; callers no longer need encodeURIComponent().
The header now identifies the package as octokit-rest.js rather than octokit.js.