In the following examples, the authentication to GitHub is being done using a token, meaning the authentication is being done using a classic token or a fine grained token. For example, if using a classic Personal Access Token, the token will need the repo permission.

Here is an example of how to list the variables in one of your repos using curl.

curl --location \
--header "Accept: application/vnd.github+json" \
--header "Authorization: Bearer <your token>" \
--header "X-GitHub-Api-Version: 2022-11-28" \
--url "https://api.github.com/repos/<your organization>/<repo>/actions/variables"

For example.

curl --location \
--header "Accept: application/vnd.github+json" \
--header "Authorization: Bearer abc123" \
--header "X-GitHub-Api-Version: 2022-11-28" \
--url "https://api.github.com/repos/my-org/my-repo/actions/variables"

Something like this should be returned.

{
  "variables": [
    {
      "name": "FOO",
      "value": "hello",
      "created_at": "2025-05-28T03:16:42Z",
      "updated_at": "2025-05-28T03:45:16Z"
    },
    {
      "name": "BAR",
      "value": "world",
      "created_at": "2025-05-28T03:17:05Z",
      "updated_at": "2025-05-28T03:17:05Z"
    }

  ],
  "total_count": 2
}