Session Revocation — GitHub

GitHub does not expose a dedicated “SSO session revoke” API. Challenge supports two mutually exclusive actions configured per integration:

Revoke SAML SSO credential authorizations (default) — invalidates SAML-authorized PATs and SSH keys for the org
Remove organization member — removes the user from the org (full cut-off; also removes SAML authorizations)

Credentials

Create a GitHub personal access token (classic) or fine-grained PAT owned by an organization owner.
Required scopes:
- SAML revoke mode: read:org, admin:org
- Remove member mode: admin:org
Enter the organization slug and token in Challenge under Integrations → Session Revocation → GitHub.

Mode	Behavior
Revoke SAML SSO credential authorizations	Lists and deletes each SAML credential authorization for the user
Remove organization member	`DELETE /orgs/{org}/members/{username}`

Only one mode runs per revocation request.

Lookup: GET /orgs/{org}/members/{username} (204 = member exists)

SAML revoke mode:

GET /orgs/{org}/credential-authorizations?login={username}
DELETE /orgs/{org}/credential-authorizations/{credential_id} for each authorization

Remove member mode:

Use the user’s GitHub login (handle), not always their email address.

Symptom	Check
`http_403`	Token owner is not org owner or lacks scopes
`user_not_found`	Wrong GitHub login or user not in org
Remove member fails with 403	Enterprise team indirect membership may remain