GitHub Enterprise Server · REST and GraphQL API · Checked October 25, 2026

GitHub Enterprise Server: why it could not be reached

On GitHub Enterprise Server the REST API is at http(s)://HOSTNAME/api/v3 and the GraphQL API at http(s)://HOSTNAME/api/graphql, where HOSTNAME is the server's name; on GitHub.com they are at api.github.com. Most failures to reach a server are the address, the certificate, or the network in between (checked October 25, 2026).

PKIX path building failed: … unable to find valid certification path to requested target

What goes wrong, and why

The wrong address answers 404: the REST paths come after /api/v3, and GraphQL is one address, /api/graphql. A public report from 2026 found a tool sending GraphQL to HOST/api/graphql/graphql and getting 404 on every call, because its library turns only a base ending in /api/v3 into /api/graphql and adds /graphql to anything else.
A web page instead of data: an address that is not the API, such as the server's web address with an API path but without /api/v3, answers with an HTML page instead of JSON.
The certificate: GitHub's documentation says TLS is set up with a self-signed certificate when the server first starts, and that web browsers and Git clients do not trust it and warn until TLS is turned off or a certificate signed by a trusted authority (such as Let's Encrypt) is uploaded; a certificate signed by an internal certificate authority needs its root and intermediate certificates installed. A Java program that does not trust the certificate stops with javax.net.ssl.SSLHandshakeException and "PKIX path building failed … unable to find valid certification path to requested target", as a public report from 2023 met connecting a Java-based IDE to GitHub Enterprise Server.

What to do

Check the address: give a tool the server's web address (https://HOSTNAME) when it adds /api/v3 itself, and the full https://HOSTNAME/api/v3 only when it asks for the API's base. curl -i https://HOSTNAME/api/v3/meta should answer with JSON, not a web page.
The certificate: ask the server's administrator for a certificate signed by a trusted authority, or have your computer trust the internal certificate authority that signed it.
Inside a company network: connect to it first (a VPN, for example), or ask the administrator whether the API is reachable from where you are.
Reached, but refused: see 401 "Bad credentials" or "Resource not accessible by personal access token".

In IntelliJ IDEA: "Server is unreachable" and "Invalid authentication data."

In the source of the GitHub support built into IntelliJ IDEA (checked October 30, 2026; IntelliJ IDEA: GithubServerPath.java, GHTokenCredentialsUi.kt, GithubApiRequestExecutor.kt, GHEServerVersionChecker.kt, GHAPIExceptionUtil.kt):

The address: the Server field of the token login takes the server's web address, with https when no scheme is typed. IntelliJ IDEA adds /api/v3 for REST and /api/graphql for GraphQL after whatever is typed, path included, so https://HOSTNAME/api/v3 in the field becomes https://HOSTNAME/api/v3/api/v3, the wrong address above. Type https://HOSTNAME. For github.com and addresses ending in .ghe.com, it puts api. in front of the host instead.
At login: an unknown host name reads "Server is unreachable". Any other failure reads "Invalid authentication data." followed by the error's own message, a 404 from a wrong address included, even when the token is not the problem.
The version: when an answer carries x-github-enterprise-version below 3.2, the request fails with "Unsupported GitHub Enterprise server version X.Y. Earliest supported version is 3.2" (at login, after "Invalid authentication data.").
In the Pull Requests tool window, an unknown host reads "Unknown host: HOSTNAME".

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, takes the GitHub Enterprise address in its Settings as the server's web address and removes a pasted /api/v3 or /api/graphql itself; it calls REST at /api/v3 and GraphQL at /api/graphql (and api. in front of a GHE.com address), and sends the token only to that address. Requests go through the IDE's proxy and certificate settings: the operating system's certificate store, the certificates accepted in Server Certificates (Settings | Appearance & Behavior | System Settings since IDE 2025.2, Settings | Tools before; JetBrains: Server Certificates), and the IDE's prompt for an untrusted certificate. When the server answers with a web page, the plugin says so and points to the address in Settings; it does not follow a redirect to another host and names where it pointed; when the IDE does not trust the server's certificate ("PKIX path building failed", a name that does not match), it says so and points to accepting it, adding it under Server Certificates in the IDE settings, or the operating system's trust for the company's root certificate; when the server cannot be reached for another reason, it says so with Java's own reason. The review inbox, diffs and conversations are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.