{ "generatedAt": "2026-10-12T16:01:05.493Z", "sourceFetchedAt": "2026-10-11", "source": "https://github.com/github/docs/tree/main/src/github-apps/data/ghec-2026-03-10", "tierDefinitions": { "0": "Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.", "1": "Management/pipeline plane. Control over deployments, CI/CD, or secrets.", "2": "User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.", "3": "Low impact. Reading, or changes that touch no access, code, credentials or availability." }, "tieringRules": [ "Start from the plane: control plane Tier 0, management plane Tier 1, data plane Tier 2 for write.", "Go up a tier when one documented step reaches a higher one, and name that step in the reason. Workflows: write is on the data plane, but a workflow can ask for its repository's secrets, so it is Tier 1.", "Reading is Tier 3, unless what is read is itself a credential, such as a leaked secret in a secret scanning alert.", "Go down when the permission cannot change anything that matters for security, such as stars, follows or a profile picture, and say so.", "Tiers are about impact, not about read or write. A write that can stop work, such as cutting spend or removing licenses, is at least Tier 2.", "Breadth counts for roles: admin on every repository in an organization is Tier 0, because it reaches every repository's visibility, secrets and protections at once." ], "planes": [ { "plane": "control", "title": "Control plane", "defaultTier": 0, "summary": "Identity and administration: who is a member, who is an owner, and which roles exist." }, { "plane": "management", "title": "Management plane", "defaultTier": 1, "summary": "Settings and pipelines: policies, protections, tokens, App installs, runners and webhooks." }, { "plane": "data", "title": "Data plane", "defaultTier": 2, "summary": "The workload: code, workflow runs, secrets, alerts, releases and day-to-day collaboration." } ], "areas": [ { "id": "identity", "plane": "control", "title": "Identity", "covers": "Members, teams, SCIM provisioning and the credentials attached to an account." }, { "id": "admins", "plane": "control", "title": "Roles", "covers": "Custom organization, repository and enterprise roles." }, { "id": "org-policy", "plane": "management", "title": "Organization policy", "covers": "Org and enterprise settings, rulesets, Actions policy, custom properties and Copilot controls." }, { "id": "tokens", "plane": "management", "title": "Tokens", "covers": "Personal access token approval, revocation and credential authorizations." }, { "id": "apps", "plane": "management", "title": "Apps", "covers": "Which repositories and organizations a GitHub App is installed on." }, { "id": "runners", "plane": "management", "title": "Runners", "covers": "Self-hosted runners, runner groups, hosted runner images and their networks." }, { "id": "repo-settings", "plane": "management", "title": "Repository settings", "covers": "Repository administration: protection, collaborators, deploy keys, visibility." }, { "id": "webhooks", "plane": "management", "title": "Webhooks", "covers": "Where repository and organization events are delivered." }, { "id": "code", "plane": "data", "title": "Code", "covers": "Repository contents, branches, tags, pull requests, checks and commit signing keys." }, { "id": "workflows", "plane": "data", "title": "Workflows", "covers": "Workflow files and runs, variables, deployments, environments and Pages." }, { "id": "secrets", "plane": "data", "title": "Secrets", "covers": "Actions, environment, Dependabot, Codespaces and agent secrets, private registries and OIDC." }, { "id": "code-security", "plane": "data", "title": "Code security", "covers": "Code scanning, Dependabot and secret scanning alerts, advisories, dismissals and bypasses." }, { "id": "releases", "plane": "data", "title": "Releases and packages", "covers": "Packages, attestations and artifact metadata." }, { "id": "agents", "plane": "data", "title": "AI agents", "covers": "Copilot agent settings and Copilot Spaces." }, { "id": "codespaces", "plane": "data", "title": "Codespaces", "covers": "Creating and running cloud development environments." }, { "id": "collaboration", "plane": "data", "title": "Collaboration", "covers": "Issues, discussions, projects and issue configuration." }, { "id": "insights", "plane": "data", "title": "Insights and billing", "covers": "Metrics, events, usage, billing and licensing." }, { "id": "account", "plane": "data", "title": "Account", "covers": "A user's own profile, follows, stars, gists and blocks." } ], "setups": [ { "id": "free", "label": "GitHub Free", "short": "Free", "description": "Free organizations and personal accounts. Several protections only work on public repositories.", "docsUrl": "https://docs.github.com/en/get-started/learning-about-github/githubs-plans" }, { "id": "team", "label": "GitHub Team", "short": "Team", "description": "Paid organizations without an enterprise account. Branch protection, rulesets and environments work on private repositories too.", "docsUrl": "https://docs.github.com/en/get-started/learning-about-github/githubs-plans" }, { "id": "enterprise-cloud", "label": "GitHub Enterprise Cloud", "short": "Enterprise Cloud", "description": "Organizations in an enterprise account, with personal accounts that members bring themselves.", "docsUrl": "https://docs.github.com/en/get-started/learning-about-github/githubs-plans" }, { "id": "emu", "label": "Enterprise Managed Users", "short": "EMU", "description": "Enterprise Cloud where the identity provider creates and controls every account.", "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/understanding-iam-for-enterprises/about-enterprise-managed-users" }, { "id": "ghes", "label": "GitHub Enterprise Server", "short": "Server", "description": "GitHub run on your own infrastructure. Some cloud features, such as Copilot and Codespaces, are missing.", "docsUrl": "https://docs.github.com/en/enterprise-server@latest/admin/overview/about-github-enterprise-server" } ], "installationKeyAliases": { "email_addresses": "emails", "git_ssh_keys": "keys" }, "permissions": [ { "id": "enterprise_custom_enterprise_roles:write", "key": "enterprise_custom_enterprise_roles", "level": "write", "title": "Custom enterprise roles", "target": "enterprise", "tier": 0, "area": "admins", "why": "Creates enterprise roles and assigns them to teams, so it can hand out enterprise-level admin powers.", "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "DELETE /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}", "PUT /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}/{role_id}", "DELETE /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}/{role_id}", "DELETE /enterprises/{enterprise}/enterprise-roles/users/{username}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-custom-enterprise-roles", "source": "github-docs", "slug": "enterprise-custom-enterprise-roles-write" }, { "id": "enterprise_scim:write", "key": "enterprise_scim", "level": "write", "title": "Enterprise SCIM", "target": "enterprise", "tier": 0, "area": "identity", "why": "Creates, changes and removes enterprise identities through SCIM, which decides who exists in the enterprise at all.", "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 8, "sampleEndpoints": [ "POST /scim/v2/enterprises/{enterprise}/Groups", "PUT /scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}", "PATCH /scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}", "DELETE /scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-scim", "source": "github-docs", "slug": "enterprise-scim-write" }, { "id": "enterprise_teams:write", "key": "enterprise_teams", "level": "write", "title": "Enterprise teams", "target": "enterprise", "tier": 0, "area": "identity", "why": "Adds people to enterprise teams and teams to organizations. Teams carry enterprise and organization roles, so membership is role assignment.", "contextDependent": true, "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 11, "sampleEndpoints": [ "POST /enterprises/{enterprise}/teams", "POST /enterprises/{enterprise}/teams/{enterprise-team}/memberships/add", "POST /enterprises/{enterprise}/teams/{enterprise-team}/memberships/remove", "PUT /enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-teams", "source": "github-docs", "slug": "enterprise-teams-write" }, { "id": "organization_administration:write", "key": "organization_administration", "level": "write", "title": "Administration", "target": "organization", "tier": 0, "area": "org-policy", "why": "Changes org settings including the base repository permission, org rulesets, Actions policy, the OIDC subject format and which team is security manager. Enough to switch off every org-wide guard at once.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 71, "sampleEndpoints": [ "PUT /organizations/{org}/actions/cache/retention-limit", "PUT /organizations/{org}/actions/cache/storage-limit", "PATCH /orgs/{org}", "DELETE /orgs/{org}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-administration", "source": "github-docs", "slug": "organization-administration-write" }, { "id": "members:write", "key": "members", "level": "write", "title": "Members", "target": "organization", "tier": 0, "area": "identity", "why": "Sets organization membership, including the owner role, invites people, manages teams and assigns organization roles. This is who controls the organization.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 41, "sampleEndpoints": [ "POST /orgs/{org}/invitations", "DELETE /orgs/{org}/invitations/{invitation_id}", "DELETE /orgs/{org}/members/{username}", "PUT /orgs/{org}/memberships/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-members", "source": "github-docs", "slug": "members-write" }, { "id": "enterprise_custom_properties:write", "key": "enterprise_custom_properties", "level": "write", "title": "Custom properties", "target": "enterprise", "tier": 1, "area": "org-policy", "why": "Defines custom properties. Rulesets and OIDC claims can be targeted by property, so changing them changes which rules and cloud trusts apply.", "contextDependent": true, "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "PATCH /enterprises/{enterprise}/properties/schema", "PUT /enterprises/{enterprise}/properties/schema/organizations/{org}/{custom_property_name}/promote", "PUT /enterprises/{enterprise}/properties/schema/{custom_property_name}", "DELETE /enterprises/{enterprise}/properties/schema/{custom_property_name}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-custom-properties", "source": "github-docs", "slug": "enterprise-custom-properties-write" }, { "id": "enterprise_credentials:write", "key": "enterprise_credentials", "level": "write", "title": "Enterprise credentials", "target": "enterprise", "tier": 1, "area": "tokens", "why": "Authorizes and revokes credentials for the enterprise. Revoking all of them locks every member's tokens and keys out at once.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "POST /enterprises/{enterprise}/credential-authorizations", "DELETE /enterprises/{enterprise}/credential-authorizations", "POST /enterprises/{enterprise}/credential-authorizations/revoke-all", "POST /enterprises/{enterprise}/credential-authorizations/revoke-credential-type" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-credentials", "source": "github-docs", "slug": "enterprise-credentials-write" }, { "id": "enterprise_custom_properties_for_organizations:admin", "key": "enterprise_custom_properties_for_organizations", "level": "admin", "title": "Enterprise custom properties for organizations", "target": "enterprise", "tier": 1, "area": "org-policy", "why": "Defines organization custom properties, which policies can target.", "contextDependent": true, "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "PATCH /enterprises/{enterprise}/org-properties/schema", "PUT /enterprises/{enterprise}/org-properties/schema/{custom_property_name}", "DELETE /enterprises/{enterprise}/org-properties/schema/{custom_property_name}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-custom-properties-for-organizations", "source": "github-docs", "slug": "enterprise-custom-properties-for-organizations-admin" }, { "id": "enterprise_custom_properties_for_organizations:write", "key": "enterprise_custom_properties_for_organizations", "level": "write", "title": "Enterprise custom properties for organizations", "target": "enterprise", "tier": 1, "area": "org-policy", "why": "Sets property values on organizations, which policies can target.", "contextDependent": true, "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /enterprises/{enterprise}/org-properties/values" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-custom-properties-for-organizations", "source": "github-docs", "slug": "enterprise-custom-properties-for-organizations-write" }, { "id": "enterprise_organization_installation_repositories:write", "key": "enterprise_organization_installation_repositories", "level": "write", "title": "Enterprise organization installation repositories", "target": "enterprise", "tier": 1, "area": "apps", "why": "Changes which repositories an enterprise-owned App installation can reach.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-organization-installation-repositories", "source": "github-docs", "slug": "enterprise-organization-installation-repositories-write" }, { "id": "enterprise_organization_installations:write", "key": "enterprise_organization_installations", "level": "write", "title": "Enterprise organization installations", "target": "enterprise", "tier": 1, "area": "apps", "why": "Installs enterprise-owned Apps into organizations, giving them whatever permissions the App asks for there.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "POST /enterprises/{enterprise}/apps/organizations/{org}/installations", "DELETE /enterprises/{enterprise}/apps/organizations/{org}/installations/{installation_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-organization-installations", "source": "github-docs", "slug": "enterprise-organization-installations-write" }, { "id": "organization_custom_org_roles:write", "key": "organization_custom_org_roles", "level": "write", "title": "Custom organization roles", "target": "organization", "tier": 1, "area": "admins", "why": "Creates and changes custom organization roles. Editing a role that is already assigned changes what every holder can do; assigning roles needs Members: write.", "contextDependent": true, "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/organization-roles", "PATCH /orgs/{org}/organization-roles/{role_id}", "DELETE /orgs/{org}/organization-roles/{role_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-organization-roles", "source": "github-docs", "slug": "organization-custom-org-roles-write" }, { "id": "organization_custom_properties:admin", "key": "organization_custom_properties", "level": "admin", "title": "Custom properties", "target": "organization", "tier": 1, "area": "org-policy", "why": "Defines custom properties that rulesets and OIDC claims can use.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "PATCH /orgs/{org}/properties/schema", "PUT /orgs/{org}/properties/schema/{custom_property_name}", "DELETE /orgs/{org}/properties/schema/{custom_property_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-properties", "source": "github-docs", "slug": "organization-custom-properties-admin" }, { "id": "organization_custom_properties:write", "key": "organization_custom_properties", "level": "write", "title": "Custom properties", "target": "organization", "tier": 1, "area": "org-policy", "why": "Sets property values on repositories. Rulesets and OIDC claims can be targeted by property, so values decide which rules and cloud trusts apply.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /orgs/{org}/properties/values" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-properties", "source": "github-docs", "slug": "organization-custom-properties-write" }, { "id": "organization_custom_roles:write", "key": "organization_custom_roles", "level": "write", "title": "Custom repository roles", "target": "organization", "tier": 1, "area": "admins", "why": "Creates and edits custom repository roles. Editing an assigned role widens access for everyone who has it.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/custom-repository-roles", "PATCH /orgs/{org}/custom-repository-roles/{role_id}", "DELETE /orgs/{org}/custom-repository-roles/{role_id}", "POST /orgs/{org}/custom_roles" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-repository-roles", "source": "github-docs", "slug": "organization-custom-roles-write" }, { "id": "organization_network_configurations:write", "key": "organization_network_configurations", "level": "write", "title": "Network configurations", "target": "organization", "tier": 1, "area": "runners", "why": "Connects GitHub-hosted runners to private networks, putting workflow code inside internal networks.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/settings/network-configurations", "PATCH /orgs/{org}/settings/network-configurations/{network_configuration_id}", "DELETE /orgs/{org}/settings/network-configurations/{network_configuration_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-network-configurations", "source": "github-docs", "slug": "organization-network-configurations-write" }, { "id": "organization_private_registries:write", "key": "organization_private_registries", "level": "write", "title": "Organization private registries", "target": "organization", "tier": 1, "area": "secrets", "why": "Changes private registry configurations and their credentials, which decides where dependencies are resolved from. Pointing a registry elsewhere redirects dependency resolution for every repository that uses it.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/private-registries", "PATCH /orgs/{org}/private-registries/{secret_name}", "DELETE /orgs/{org}/private-registries/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-private-registries", "source": "github-docs", "slug": "organization-private-registries-write" }, { "id": "organization_personal_access_token_requests:write", "key": "organization_personal_access_token_requests", "level": "write", "title": "Personal access token requests", "target": "organization", "tier": 1, "area": "tokens", "why": "Approves or denies fine-grained PAT requests, deciding whose tokens reach the organization's resources.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "POST /orgs/{org}/personal-access-token-requests", "POST /orgs/{org}/personal-access-token-requests/{pat_request_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-personal-access-token-requests", "source": "github-docs", "slug": "organization-personal-access-token-requests-write" }, { "id": "organization_secrets:write", "key": "organization_secrets", "level": "write", "title": "Secrets", "target": "organization", "tier": 1, "area": "secrets", "why": "Creates and overwrites organization Actions secrets and changes which repositories can use them. Swapping a deploy credential redirects every pipeline that reads it.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /orgs/{org}/actions/secrets/{secret_name}", "DELETE /orgs/{org}/actions/secrets/{secret_name}", "PUT /orgs/{org}/actions/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-secrets", "source": "github-docs", "slug": "organization-secrets-write" }, { "id": "organization_self_hosted_runners:write", "key": "organization_self_hosted_runners", "level": "write", "title": "Self-hosted runners", "target": "organization", "tier": 1, "area": "runners", "why": "Registers runners and changes runner groups. A runner the attacker controls receives the jobs, and the secrets, of every repository allowed to use it.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 17, "sampleEndpoints": [ "POST /orgs/{org}/actions/runner-groups", "PATCH /orgs/{org}/actions/runner-groups/{runner_group_id}", "DELETE /orgs/{org}/actions/runner-groups/{runner_group_id}", "PUT /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-self-hosted-runners", "source": "github-docs", "slug": "organization-self-hosted-runners-write" }, { "id": "organization_hooks:write", "key": "organization_hooks", "level": "write", "title": "Webhooks", "target": "organization", "tier": 1, "area": "webhooks", "why": "Creates organization webhooks, which send events from every repository to any URL. A quiet, lasting way to watch everything that happens.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/hooks", "PATCH /orgs/{org}/hooks/{hook_id}", "DELETE /orgs/{org}/hooks/{hook_id}", "PATCH /orgs/{org}/hooks/{hook_id}/config" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-webhooks", "source": "github-docs", "slug": "organization-hooks-write" }, { "id": "actions:write", "key": "actions", "level": "write", "title": "Actions", "target": "repository", "tier": 1, "area": "workflows", "why": "Starts, re-runs and cancels workflows and deletes caches and artifacts. Starting a privileged publish or deploy job by hand was the step that mattered in the Nx incident.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "actions", "endpointCount": 15, "sampleEndpoints": [ "DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}", "DELETE /repos/{owner}/{repo}/actions/caches", "DELETE /repos/{owner}/{repo}/actions/caches/{cache_id}", "POST /repos/{owner}/{repo}/actions/jobs/{job_id}/rerun" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-actions", "source": "github-docs", "slug": "actions-write" }, { "id": "administration:write", "key": "administration", "level": "write", "title": "Administration", "target": "repository", "tier": 1, "area": "repo-settings", "why": "Changes branch protection and rulesets, adds collaborators and deploy keys, registers runners, and can rename, transfer, make public or delete the repository.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 107, "sampleEndpoints": [ "PATCH /repos/{owner}/{repo}", "DELETE /repos/{owner}/{repo}", "PUT /repos/{owner}/{repo}/actions/cache/retention-limit", "PUT /repos/{owner}/{repo}/actions/cache/storage-limit" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-administration", "source": "github-docs", "slug": "administration-write" }, { "id": "repository_custom_properties:write", "key": "repository_custom_properties", "level": "write", "title": "Custom properties", "target": "repository", "tier": 1, "area": "repo-settings", "why": "Sets the repository's custom property values. Rulesets and OIDC claims can be targeted by property.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /repos/{owner}/{repo}/properties/values" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-custom-properties", "source": "github-docs", "slug": "repository-custom-properties-write" }, { "id": "environments:write", "key": "environments", "level": "write", "title": "Environments", "target": "repository", "tier": 1, "area": "secrets", "why": "Creates and overwrites environment secrets and variables, which production deploy jobs read.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}", "DELETE /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}", "POST /repos/{owner}/{repo}/environments/{environment_name}/variables", "PATCH /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-environments", "source": "github-docs", "slug": "environments-write" }, { "id": "installation_repositories:write", "key": "installation_repositories", "level": "write", "title": "GitHub App installation repository access", "target": "repository", "tier": 1, "area": "apps", "why": "Adds repositories to a GitHub App installation the user can manage, giving the App its permissions on them.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /user/installations/{installation_id}/repositories/{repository_id}", "DELETE /user/installations/{installation_id}/repositories/{repository_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-github-app-installation-repository-access", "source": "github-docs", "slug": "installation-repositories-write" }, { "id": "id_token:write", "key": "id_token", "level": "write", "title": "OIDC ID token", "target": "repository", "tier": 1, "area": "secrets", "why": "Lets the job request an OIDC token and trade it for cloud credentials. The cloud trust policy is the only check left; a wildcard subject turns this into cloud admin.", "contextDependent": true, "plane": "data", "availableIn": [ "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "id-token", "endpointCount": 0, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions", "source": "github-token-only", "slug": "id-token-write" }, { "id": "packages:write", "key": "packages", "level": "write", "title": "Packages", "target": "repository", "tier": 1, "area": "releases", "why": "Publishes packages. Whatever is published is pulled by everyone who depends on it.", "contextDependent": true, "plane": "data", "availableIn": [ "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "packages", "endpointCount": 0, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions", "source": "github-token-only", "slug": "packages-write" }, { "id": "secret_scanning_alerts:read", "key": "secret_scanning_alerts", "level": "read", "title": "Secret scanning alerts", "target": "repository", "tier": 1, "area": "code-security", "why": "Reads secret scanning alerts, which include the leaked secret values themselves. Reading this is reading credentials.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 18, "sampleEndpoints": [ "GET /orgs/{org}/secret-scanning/alerts", "DELETE /repos/{owner}/{repo}/bypass-responses/secret-scanning/{bypass_response_id}", "GET /repos/{owner}/{repo}/secret-scanning/alerts", "GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-alerts", "source": "github-docs", "slug": "secret-scanning-alerts-read" }, { "id": "secrets:write", "key": "secrets", "level": "write", "title": "Secrets", "target": "repository", "tier": 1, "area": "secrets", "why": "Creates and overwrites repository Actions secrets. Swapping a deploy credential redirects the pipeline that reads it.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}", "DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secrets", "source": "github-docs", "slug": "secrets-write" }, { "id": "repository_hooks:write", "key": "repository_hooks", "level": "write", "title": "Webhooks", "target": "repository", "tier": 1, "area": "webhooks", "why": "Creates repository webhooks that send every push, pull request and issue event to any URL.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/hooks", "PATCH /repos/{owner}/{repo}/hooks/{hook_id}", "DELETE /repos/{owner}/{repo}/hooks/{hook_id}", "PATCH /repos/{owner}/{repo}/hooks/{hook_id}/config" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-webhooks", "source": "github-docs", "slug": "repository-hooks-write" }, { "id": "workflows:write", "key": "workflows", "level": "write", "title": "Workflows", "target": "repository", "tier": 1, "area": "workflows", "why": "Changes files under .github/workflows. A changed workflow runs with the repository's secrets and can ask for any token permission, so this is a direct path to secrets and cloud access.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-workflows", "source": "github-docs", "slug": "workflows-write" }, { "id": "keys:write", "key": "keys", "level": "write", "title": "Git SSH keys", "target": "user", "tier": 1, "area": "identity", "why": "Adds SSH keys to the user's account. A key added here gives lasting Git access as that user in every organization they belong to.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "POST /user/keys", "DELETE /user/keys/{key_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-git-ssh-keys", "source": "github-docs", "slug": "keys-write" }, { "id": "enterprise_ai_controls:write", "key": "enterprise_ai_controls", "level": "write", "title": "Enterprise AI controls", "target": "enterprise", "tier": 2, "area": "org-policy", "why": "Changes Copilot content exclusions and agent controls, deciding which files and agents Copilot may use.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "PUT /enterprises/{enterprise}/copilot/content_exclusion", "PUT /enterprises/{enterprise}/copilot/custom-agents/source", "DELETE /enterprises/{enterprise}/copilot/custom-agents/source" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-ai-controls", "source": "github-docs", "slug": "enterprise-ai-controls-write" }, { "id": "enterprise_billing:write", "key": "enterprise_billing", "level": "write", "title": "Enterprise billing", "target": "enterprise", "tier": 2, "area": "insights", "why": "Changes budgets. Grants no access, but cutting spend can stop Actions, Codespaces and other paid features for the whole enterprise, which is an availability risk.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 8, "sampleEndpoints": [ "POST /enterprises/{enterprise}/settings/billing/budgets", "PATCH /enterprises/{enterprise}/settings/billing/budgets/{budget_id}", "DELETE /enterprises/{enterprise}/settings/billing/budgets/{budget_id}", "POST /enterprises/{enterprise}/settings/billing/cost-centers" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-billing", "source": "github-docs", "slug": "enterprise-billing-write" }, { "id": "enterprise_licensing:write", "key": "enterprise_licensing", "level": "write", "title": "Enterprise Licensing", "target": "enterprise", "tier": 2, "area": "insights", "why": "Assigns and removes licenses. Grants no access to code or settings, but removing a license locks that person out, which is an availability risk.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /enterprises/{enterprise}/visual-studio-subscriptions/{visual_studio_subscription_id}", "DELETE /enterprises/{enterprise}/visual-studio-subscriptions/{visual_studio_subscription_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-licensing", "source": "github-docs", "slug": "enterprise-licensing-write" }, { "id": "organization_agent_secrets:write", "key": "organization_agent_secrets", "level": "write", "title": "Agent secrets", "target": "organization", "tier": 2, "area": "secrets", "why": "Creates and overwrites secrets given to the Copilot agent's environment. The agent's changes still go through a pull request, so this does not reach production on its own.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /orgs/{org}/agents/secrets/{secret_name}", "DELETE /orgs/{org}/agents/secrets/{secret_name}", "PUT /orgs/{org}/agents/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-agent-secrets", "source": "github-docs", "slug": "organization-agent-secrets-write" }, { "id": "organization_agent_variables:write", "key": "organization_agent_variables", "level": "write", "title": "Agent variables", "target": "organization", "tier": 2, "area": "agents", "why": "Changes variables in the Copilot agent's environment.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/agents/variables", "PATCH /orgs/{org}/agents/variables/{name}", "DELETE /orgs/{org}/agents/variables/{name}", "PUT /orgs/{org}/agents/variables/{name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-agent-variables", "source": "github-docs", "slug": "organization-agent-variables-write" }, { "id": "organization_copilot_agent_settings:write", "key": "organization_copilot_agent_settings", "level": "write", "title": "Copilot agent settings", "target": "organization", "tier": 2, "area": "agents", "why": "Turns the Copilot coding agent on for repositories, which lets it open pull requests there.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "PUT /orgs/{org}/copilot/coding-agent/permissions", "PUT /orgs/{org}/copilot/coding-agent/permissions/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-agent-settings", "source": "github-docs", "slug": "organization-copilot-agent-settings-write" }, { "id": "org_copilot_content_exclusion:write", "key": "org_copilot_content_exclusion", "level": "write", "title": "Copilot content exclusion", "target": "organization", "tier": 2, "area": "org-policy", "why": "Changes which files Copilot must ignore, so sensitive files can be put back in reach of Copilot.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "PUT /orgs/{org}/copilot/content_exclusion" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-content-exclusion", "source": "github-docs", "slug": "org-copilot-content-exclusion-write" }, { "id": "organization_copilot_spaces:write", "key": "organization_copilot_spaces", "level": "write", "title": "Copilot Spaces", "target": "organization", "tier": 2, "area": "agents", "why": "Creates and edits Copilot Spaces, which decide what context Copilot answers from.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/copilot-spaces", "PUT /orgs/{org}/copilot-spaces/{space_number}", "DELETE /orgs/{org}/copilot-spaces/{space_number}", "POST /orgs/{org}/copilot-spaces/{space_number}/resources" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-spaces", "source": "github-docs", "slug": "organization-copilot-spaces-write" }, { "id": "custom_properties_for_organizations:write", "key": "custom_properties_for_organizations", "level": "write", "title": "Custom properties for organizations", "target": "organization", "tier": 2, "area": "org-policy", "why": "Sets the organization's own property values, which enterprise policies can target.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /organizations/{org}/org-properties/values" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-properties-for-organizations", "source": "github-docs", "slug": "custom-properties-for-organizations-write" }, { "id": "organization_external_properties_for_repos:admin", "key": "organization_external_properties_for_repos", "level": "admin", "title": "External custom properties for repositories", "target": "organization", "tier": 2, "area": "org-policy", "why": "Lets Apps provide repository properties.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "POST /orgs/{org}/properties/installations", "GET /orgs/{org}/properties/installations" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-external-custom-properties-for-repositories", "source": "github-docs", "slug": "organization-external-properties-for-repos-admin" }, { "id": "organization_external_properties_for_repos:write", "key": "organization_external_properties_for_repos", "level": "write", "title": "External custom properties for repositories", "target": "organization", "tier": 2, "area": "org-policy", "why": "Sets App-provided property values on repositories.", "contextDependent": true, "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "PATCH /orgs/{org}/properties/installations/values", "PATCH /orgs/{org}/properties/installations/values/{property_name}", "DELETE /orgs/{org}/properties/installations/values/{property_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-external-custom-properties-for-repositories", "source": "github-docs", "slug": "organization-external-properties-for-repos-write" }, { "id": "organization_runner_custom_images:write", "key": "organization_runner_custom_images", "level": "write", "title": "Hosted runner custom images", "target": "organization", "tier": 2, "area": "runners", "why": "Deletes custom hosted runner images and their versions.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "DELETE /orgs/{org}/actions/hosted-runners/images/custom/{image_definition_id}", "DELETE /orgs/{org}/actions/hosted-runners/images/custom/{image_definition_id}/versions/{version}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-hosted-runner-custom-images", "source": "github-docs", "slug": "organization-runner-custom-images-write" }, { "id": "organization_secret_scanning_bypass_requests:write", "key": "organization_secret_scanning_bypass_requests", "level": "write", "title": "Organization bypass requests for secret scanning", "target": "organization", "tier": 2, "area": "code-security", "why": "Approves pushes that contain a detected secret.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-bypass-requests-for-secret-scanning", "source": "github-docs", "slug": "organization-secret-scanning-bypass-requests-write" }, { "id": "organization_codespaces:write", "key": "organization_codespaces", "level": "write", "title": "Organization codespaces", "target": "organization", "tier": 2, "area": "codespaces", "why": "Stops and deletes members' codespaces.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-codespaces", "source": "github-docs", "slug": "organization-codespaces-write" }, { "id": "organization_codespaces_secrets:write", "key": "organization_codespaces_secrets", "level": "write", "title": "Organization codespaces secrets", "target": "organization", "tier": 2, "area": "secrets", "why": "Creates and overwrites secrets injected into members' codespaces. Unlike Actions and Dependabot secrets, nothing deploys or resolves dependencies with them on its own; they reach a developer's environment.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /orgs/{org}/codespaces/secrets/{secret_name}", "DELETE /orgs/{org}/codespaces/secrets/{secret_name}", "PUT /orgs/{org}/codespaces/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-codespaces-secrets", "source": "github-docs", "slug": "organization-codespaces-secrets-write" }, { "id": "organization_codespaces_settings:write", "key": "organization_codespaces_settings", "level": "write", "title": "Organization codespaces settings", "target": "organization", "tier": 2, "area": "org-policy", "why": "Decides which members may use Codespaces paid for by the organization.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "PUT /orgs/{org}/codespaces/access", "POST /orgs/{org}/codespaces/access/selected_users", "DELETE /orgs/{org}/codespaces/access/selected_users" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-codespaces-settings", "source": "github-docs", "slug": "organization-codespaces-settings-write" }, { "id": "organization_dependabot_secrets:write", "key": "organization_dependabot_secrets", "level": "write", "title": "Organization dependabot secrets", "target": "organization", "tier": 2, "area": "secrets", "why": "Creates and overwrites the secrets Dependabot uses for private registries. It only replaces a credential: the registry URL lives in dependabot.yml or the organization's private registry settings, so a swap breaks updates rather than redirecting them.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /orgs/{org}/dependabot/secrets/{secret_name}", "DELETE /orgs/{org}/dependabot/secrets/{secret_name}", "PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dependabot-secrets", "source": "github-docs", "slug": "organization-dependabot-secrets-write" }, { "id": "organization_code_scanning_dismissal_requests:write", "key": "organization_code_scanning_dismissal_requests", "level": "write", "title": "Organization dismissal requests for code scanning", "target": "organization", "tier": 2, "area": "code-security", "why": "Approves requests to dismiss code scanning alerts, so findings can be closed without a fix.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dismissal-requests-for-code-scanning", "source": "github-docs", "slug": "organization-code-scanning-dismissal-requests-write" }, { "id": "organization_dependabot_dismissal_requests:write", "key": "organization_dependabot_dismissal_requests", "level": "write", "title": "Organization dismissal requests for Dependabot", "target": "organization", "tier": 2, "area": "code-security", "why": "Approves requests to dismiss Dependabot alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dismissal-requests-for-dependabot", "source": "github-docs", "slug": "organization-dependabot-dismissal-requests-write" }, { "id": "organization_personal_access_tokens:write", "key": "organization_personal_access_tokens", "level": "write", "title": "Personal access tokens", "target": "organization", "tier": 2, "area": "tokens", "why": "Revokes fine-grained PAT access to the organization. Can cut off automation, but cannot grant access.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "POST /orgs/{org}/personal-access-tokens", "POST /orgs/{org}/personal-access-tokens/{pat_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-personal-access-tokens", "source": "github-docs", "slug": "organization-personal-access-tokens-write" }, { "id": "secret_scanning_dismissal_requests:write", "key": "secret_scanning_dismissal_requests", "level": "write", "title": "Secret scanning alert dismissal requests", "target": "organization", "tier": 2, "area": "code-security", "why": "Approves requests to dismiss secret scanning alerts, so a leaked credential can be marked as handled.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-secret-scanning-alert-dismissal-requests", "source": "github-docs", "slug": "secret-scanning-dismissal-requests-write" }, { "id": "organization_actions_variables:write", "key": "organization_actions_variables", "level": "write", "title": "Variables", "target": "organization", "tier": 2, "area": "workflows", "why": "Changes organization Actions variables. Workflows that put a variable into a shell command can be steered by it.", "contextDependent": true, "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/actions/variables", "PATCH /orgs/{org}/actions/variables/{name}", "DELETE /orgs/{org}/actions/variables/{name}", "PUT /orgs/{org}/actions/variables/{name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-variables", "source": "github-docs", "slug": "organization-actions-variables-write" }, { "id": "agent_secrets:write", "key": "agent_secrets", "level": "write", "title": "Agent secrets", "target": "repository", "tier": 2, "area": "secrets", "why": "Creates and overwrites secrets given to the Copilot agent's environment for this repository. The agent's changes still go through a pull request.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /repos/{owner}/{repo}/agents/secrets/{secret_name}", "DELETE /repos/{owner}/{repo}/agents/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-agent-secrets", "source": "github-docs", "slug": "agent-secrets-write" }, { "id": "agent_variables:write", "key": "agent_variables", "level": "write", "title": "Agent variables", "target": "repository", "tier": 2, "area": "agents", "why": "Changes variables in the Copilot agent's environment.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/agents/variables", "PATCH /repos/{owner}/{repo}/agents/variables/{name}", "DELETE /repos/{owner}/{repo}/agents/variables/{name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-agent-variables", "source": "github-docs", "slug": "agent-variables-write" }, { "id": "artifact_metadata:write", "key": "artifact_metadata", "level": "write", "title": "Artifact metadata", "target": "repository", "tier": 2, "area": "releases", "why": "Writes artifact deployment records.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "githubTokenKey": "artifact-metadata", "endpointCount": 4, "sampleEndpoints": [ "POST /orgs/{org}/artifacts/metadata/deployment-record", "POST /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}", "POST /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}/jobs", "POST /orgs/{org}/artifacts/metadata/storage-record" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-artifact-metadata", "source": "github-docs", "slug": "artifact-metadata-write" }, { "id": "attestations:write", "key": "attestations", "level": "write", "title": "Attestations", "target": "repository", "tier": 2, "area": "releases", "why": "Uploads and deletes attestations. Deleting one makes a genuine artifact fail verification.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "githubTokenKey": "attestations", "endpointCount": 7, "sampleEndpoints": [ "POST /orgs/{org}/attestations/delete-request", "DELETE /orgs/{org}/attestations/digest/{subject_digest}", "DELETE /orgs/{org}/attestations/{attestation_id}", "POST /repos/{owner}/{repo}/attestations" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-attestations", "source": "github-docs", "slug": "attestations-write" }, { "id": "checks:write", "key": "checks", "level": "write", "title": "Checks", "target": "repository", "tier": 2, "area": "code", "why": "Creates and completes check runs, which can satisfy required checks named in branch rules.", "plane": "data", "availableIn": [ "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "checks", "endpointCount": 6, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/check-runs", "PATCH /repos/{owner}/{repo}/check-runs/{check_run_id}", "POST /repos/{owner}/{repo}/check-runs/{check_run_id}/rerequest", "POST /repos/{owner}/{repo}/check-suites" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-checks", "source": "github-docs", "slug": "checks-write" }, { "id": "security_events:write", "key": "security_events", "level": "write", "title": "Code scanning alerts", "target": "repository", "tier": 2, "area": "code-security", "why": "Dismisses code scanning alerts and uploads analyses, so findings can disappear without a fix.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "security-events", "endpointCount": 4, "sampleEndpoints": [ "PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}", "POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix", "DELETE /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}", "POST /repos/{owner}/{repo}/code-scanning/sarifs" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-code-scanning-alerts", "source": "github-docs", "slug": "security-events-write" }, { "id": "codespaces:write", "key": "codespaces", "level": "write", "title": "Codespaces", "target": "repository", "tier": 2, "area": "codespaces", "why": "Creates codespaces, which run the repository's dev container with the user's access.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 9, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/codespaces", "POST /repos/{owner}/{repo}/pulls/{pull_number}/codespaces", "POST /user/codespaces", "PATCH /user/codespaces/{codespace_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces", "source": "github-docs", "slug": "codespaces-write" }, { "id": "codespaces_lifecycle_admin:write", "key": "codespaces_lifecycle_admin", "level": "write", "title": "Codespaces lifecycle admin", "target": "repository", "tier": 2, "area": "codespaces", "why": "Starts, stops and exports codespaces.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "POST /user/codespaces/{codespace_name}/exports", "POST /user/codespaces/{codespace_name}/start", "POST /user/codespaces/{codespace_name}/stop" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces-lifecycle-admin", "source": "github-docs", "slug": "codespaces-lifecycle-admin-write" }, { "id": "codespaces_secrets:write", "key": "codespaces_secrets", "level": "write", "title": "Codespaces secrets", "target": "repository", "tier": 2, "area": "secrets", "why": "Creates and overwrites secrets injected into codespaces for this repository. They reach a developer's environment, not a pipeline that deploys.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /repos/{owner}/{repo}/codespaces/secrets/{secret_name}", "DELETE /repos/{owner}/{repo}/codespaces/secrets/{secret_name}", "GET /repos/{owner}/{repo}/codespaces/secrets", "GET /repos/{owner}/{repo}/codespaces/secrets/public-key" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces-secrets", "source": "github-docs", "slug": "codespaces-secrets-write" }, { "id": "statuses:write", "key": "statuses", "level": "write", "title": "Commit statuses", "target": "repository", "tier": 2, "area": "code", "why": "Sets commit statuses. A required status check that does not pin its source can be marked green by anyone with this.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "statuses", "endpointCount": 1, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/statuses/{sha}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-commit-statuses", "source": "github-docs", "slug": "statuses-write" }, { "id": "contents:write", "key": "contents", "level": "write", "title": "Contents", "target": "repository", "tier": 2, "area": "code", "why": "Pushes commits, creates and moves branches and tags, and edits releases. Cannot change workflow files without Workflows: write. On a repository other projects consume, moving a tag changes what they run.", "contextDependent": true, "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "contents", "endpointCount": 46, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/branches/{branch}/rename", "POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix/commits", "DELETE /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}", "POST /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-contents", "source": "github-docs", "slug": "contents-write" }, { "id": "vulnerability_alerts:write", "key": "vulnerability_alerts", "level": "write", "title": "Dependabot alerts", "target": "repository", "tier": 2, "area": "code-security", "why": "Dismisses Dependabot alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-dependabot-alerts", "source": "github-docs", "slug": "vulnerability-alerts-write" }, { "id": "dependabot_secrets:write", "key": "dependabot_secrets", "level": "write", "title": "Dependabot secrets", "target": "repository", "tier": 2, "area": "secrets", "why": "Creates and overwrites the secrets Dependabot uses for private registries. It only replaces a credential: the registry URL lives in dependabot.yml or the organization's private registry settings, so a swap breaks updates rather than redirecting them.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name}", "DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-dependabot-secrets", "source": "github-docs", "slug": "dependabot-secrets-write" }, { "id": "deployments:write", "key": "deployments", "level": "write", "title": "Deployments", "target": "repository", "tier": 2, "area": "workflows", "why": "Creates deployments, and approves or rejects pending ones where the caller is a required reviewer or the custom protection rule.", "contextDependent": true, "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "deployments", "endpointCount": 5, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/actions/runs/{run_id}/deployment_protection_rule", "POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments", "POST /repos/{owner}/{repo}/deployments", "DELETE /repos/{owner}/{repo}/deployments/{deployment_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-deployments", "source": "github-docs", "slug": "deployments-write" }, { "id": "discussions:write", "key": "discussions", "level": "write", "title": "Discussions", "target": "repository", "tier": 2, "area": "collaboration", "why": "Creates and edits discussions. GitHub Discussions has been used as a command channel for malware.", "plane": "data", "availableIn": [ "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "discussions", "endpointCount": 0, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions", "source": "github-token-only", "slug": "discussions-write" }, { "id": "issues:write", "key": "issues", "level": "write", "title": "Issues", "target": "repository", "tier": 2, "area": "collaboration", "why": "Creates and edits issues and comments. Text in issues is what prompt injection against AI agents uses.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "issues", "endpointCount": 37, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/issues", "PUT /repos/{owner}/{repo}/issues/comments/{comment_id}/pin", "DELETE /repos/{owner}/{repo}/issues/comments/{comment_id}/pin", "POST /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-issues", "source": "github-docs", "slug": "issues-write" }, { "id": "pages:write", "key": "pages", "level": "write", "title": "Pages", "target": "repository", "tier": 2, "area": "workflows", "why": "Builds and deploys GitHub Pages. Can publish content on the repository's Pages site.", "contextDependent": true, "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "pages", "endpointCount": 7, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/pages/builds", "POST /repos/{owner}/{repo}/pages/deployments", "POST /repos/{owner}/{repo}/pages/deployments/{pages_deployment_id}/cancel" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-pages", "source": "github-docs", "slug": "pages-write" }, { "id": "pull_requests:write", "key": "pull_requests", "level": "write", "title": "Pull requests", "target": "repository", "tier": 2, "area": "code", "why": "Opens, reviews, approves and merges pull requests. An approval can satisfy a review rule when the approver counts as a reviewer.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "pull-requests", "endpointCount": 43, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/pulls", "PATCH /repos/{owner}/{repo}/pulls/comments/{comment_id}", "DELETE /repos/{owner}/{repo}/pulls/comments/{comment_id}", "POST /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-pull-requests", "source": "github-docs", "slug": "pull-requests-write" }, { "id": "repository_creation:write", "key": "repository_creation", "level": "write", "title": "Repository creation", "target": "repository", "tier": 2, "area": "code", "why": "Creates repositories in the organization.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-repository-creation", "source": "github-docs", "slug": "repository-creation-write" }, { "id": "repository_advisories:write", "key": "repository_advisories", "level": "write", "title": "Repository security advisories", "target": "repository", "tier": 2, "area": "code-security", "why": "Creates and edits security advisories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/security-advisories", "POST /repos/{owner}/{repo}/security-advisories/reports", "PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id}", "POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-repository-security-advisories", "source": "github-docs", "slug": "repository-advisories-write" }, { "id": "repo_secret_scanning_dismissal_requests:write", "key": "repo_secret_scanning_dismissal_requests", "level": "write", "title": "Secret scanning alert dismissal requests", "target": "repository", "tier": 2, "area": "code-security", "why": "Approves requests to dismiss secret scanning alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-alert-dismissal-requests", "source": "github-docs", "slug": "repo-secret-scanning-dismissal-requests-write" }, { "id": "secret_scanning_alerts:write", "key": "secret_scanning_alerts", "level": "write", "title": "Secret scanning alerts", "target": "repository", "tier": 2, "area": "code-security", "why": "Closes secret scanning alerts, so a leaked credential can be marked as handled.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-alerts", "source": "github-docs", "slug": "secret-scanning-alerts-write" }, { "id": "secret_scanning_bypass_requests:write", "key": "secret_scanning_bypass_requests", "level": "write", "title": "Secret scanning push protection bypass requests", "target": "repository", "tier": 2, "area": "code-security", "why": "Approves pushes that contain a detected secret.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-push-protection-bypass-requests", "source": "github-docs", "slug": "secret-scanning-bypass-requests-write" }, { "id": "actions_variables:write", "key": "actions_variables", "level": "write", "title": "Variables", "target": "repository", "tier": 2, "area": "workflows", "why": "Changes repository Actions variables. Workflows that put a variable into a shell command can be steered by it.", "contextDependent": true, "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "POST /repos/{owner}/{repo}/actions/variables", "PATCH /repos/{owner}/{repo}/actions/variables/{name}", "DELETE /repos/{owner}/{repo}/actions/variables/{name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-variables", "source": "github-docs", "slug": "actions-variables-write" }, { "id": "codespaces_user_secrets:write", "key": "codespaces_user_secrets", "level": "write", "title": "Codespaces user secrets", "target": "user", "tier": 2, "area": "secrets", "why": "Creates and overwrites secrets injected into the user's codespaces.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "PUT /user/codespaces/secrets/{secret_name}", "DELETE /user/codespaces/secrets/{secret_name}", "PUT /user/codespaces/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-codespaces-user-secrets", "source": "github-docs", "slug": "codespaces-user-secrets-write" }, { "id": "emails:write", "key": "emails", "level": "write", "title": "Email addresses", "target": "user", "tier": 2, "area": "identity", "why": "Adds and removes email addresses and changes their visibility.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "PATCH /user/email/visibility", "POST /user/emails", "DELETE /user/emails" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-email-addresses", "source": "github-docs", "slug": "emails-write" }, { "id": "gpg_keys:write", "key": "gpg_keys", "level": "write", "title": "GPG keys", "target": "user", "tier": 2, "area": "code", "why": "Adds GPG keys, so commits signed with them show as Verified for this user.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "POST /user/gpg_keys", "DELETE /user/gpg_keys/{gpg_key_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-gpg-keys", "source": "github-docs", "slug": "gpg-keys-write" }, { "id": "git_signing_ssh_public_keys:write", "key": "git_signing_ssh_public_keys", "level": "write", "title": "SSH signing keys", "target": "user", "tier": 2, "area": "code", "why": "Adds SSH signing keys, so commits signed with them show as Verified for this user.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "POST /user/ssh_signing_keys", "DELETE /user/ssh_signing_keys/{ssh_signing_key_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-ssh-signing-keys", "source": "github-docs", "slug": "git-signing-ssh-public-keys-write" }, { "id": "enterprise_copilot_usage:read", "key": "enterprise_copilot_usage", "level": "read", "title": "Copilot usage records", "target": "enterprise", "tier": 3, "area": "insights", "why": "Reads Copilot usage records.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-copilot-usage-records", "source": "github-docs", "slug": "enterprise-copilot-usage-read" }, { "id": "enterprise_custom_enterprise_roles:read", "key": "enterprise_custom_enterprise_roles", "level": "read", "title": "Custom enterprise roles", "target": "enterprise", "tier": 3, "area": "admins", "why": "Lists custom enterprise roles and who holds them.", "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /enterprises/{enterprise}/enterprise-roles", "GET /enterprises/{enterprise}/enterprise-roles/{role_id}", "GET /enterprises/{enterprise}/enterprise-roles/{role_id}/teams", "GET /enterprises/{enterprise}/enterprise-roles/{role_id}/users" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-custom-enterprise-roles", "source": "github-docs", "slug": "enterprise-custom-enterprise-roles-read" }, { "id": "enterprise_custom_properties:read", "key": "enterprise_custom_properties", "level": "read", "title": "Custom properties", "target": "enterprise", "tier": 3, "area": "org-policy", "why": "Reads the enterprise's custom property definitions.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /enterprises/{enterprise}/properties/schema", "GET /enterprises/{enterprise}/properties/schema/{custom_property_name}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-custom-properties", "source": "github-docs", "slug": "enterprise-custom-properties-read" }, { "id": "enterprise_ai_controls:read", "key": "enterprise_ai_controls", "level": "read", "title": "Enterprise AI controls", "target": "enterprise", "tier": 3, "area": "org-policy", "why": "Reads Copilot content exclusions and agent controls.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /enterprises/{enterprise}/copilot/content_exclusion", "GET /enterprises/{enterprise}/copilot/custom-agents", "GET /enterprises/{enterprise}/copilot/custom-agents/source" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-ai-controls", "source": "github-docs", "slug": "enterprise-ai-controls-read" }, { "id": "enterprise_billing:read", "key": "enterprise_billing", "level": "read", "title": "Enterprise billing", "target": "enterprise", "tier": 3, "area": "insights", "why": "Reads billing usage and budgets.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 12, "sampleEndpoints": [ "GET /enterprises/{enterprise}/settings/billing/ai_credit/usage", "GET /enterprises/{enterprise}/settings/billing/budgets", "GET /enterprises/{enterprise}/settings/billing/budgets/{budget_id}", "GET /enterprises/{enterprise}/settings/billing/budgets/{budget_id}/user-states" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-billing", "source": "github-docs", "slug": "enterprise-billing-read" }, { "id": "enterprise_copilot_metrics:read", "key": "enterprise_copilot_metrics", "level": "read", "title": "Enterprise Copilot metrics", "target": "enterprise", "tier": 3, "area": "insights", "why": "Reads Copilot usage metrics.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "GET /enterprises/{enterprise}/copilot/metrics/reports/enterprise-1-day", "GET /enterprises/{enterprise}/copilot/metrics/reports/enterprise-28-day/latest", "GET /enterprises/{enterprise}/copilot/metrics/reports/repos-1-day", "GET /enterprises/{enterprise}/copilot/metrics/reports/user-teams-1-day" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-copilot-metrics", "source": "github-docs", "slug": "enterprise-copilot-metrics-read" }, { "id": "enterprise_credentials:read", "key": "enterprise_credentials", "level": "read", "title": "Enterprise credentials", "target": "enterprise", "tier": 3, "area": "tokens", "why": "Lists the credentials members have authorized for SAML SSO and can export that list.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /enterprises/{enterprise}/credentials", "POST /enterprises/{enterprise}/credentials/exports", "GET /enterprises/{enterprise}/credentials/exports/{export_id}", "GET /enterprises/{enterprise}/credentials/{inventory_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-credentials", "source": "github-docs", "slug": "enterprise-credentials-read" }, { "id": "enterprise_custom_properties_for_organizations:read", "key": "enterprise_custom_properties_for_organizations", "level": "read", "title": "Enterprise custom properties for organizations", "target": "enterprise", "tier": 3, "area": "org-policy", "why": "Reads organization custom property definitions and values.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /enterprises/{enterprise}/org-properties/schema", "GET /enterprises/{enterprise}/org-properties/schema/{custom_property_name}", "GET /enterprises/{enterprise}/org-properties/values" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-custom-properties-for-organizations", "source": "github-docs", "slug": "enterprise-custom-properties-for-organizations-read" }, { "id": "enterprise_innersource_vulnerabilities:write", "key": "enterprise_innersource_vulnerabilities", "level": "write", "title": "Enterprise innersource vulnerabilities", "target": "enterprise", "tier": 3, "area": "code-security", "why": "Syncs innersource vulnerability data. Changes reporting, not access, code, credentials or availability.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "POST /enterprises/{enterprise}/innersource-vulnerabilities/sync", "GET /enterprises/{enterprise}/innersource-vulnerabilities/sync/status/{job_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-innersource-vulnerabilities", "source": "github-docs", "slug": "enterprise-innersource-vulnerabilities-write" }, { "id": "enterprise_licensing:read", "key": "enterprise_licensing", "level": "read", "title": "Enterprise Licensing", "target": "enterprise", "tier": 3, "area": "insights", "why": "Reads Visual Studio subscription license assignments.", "plane": "data", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /enterprises/{enterprise}/visual-studio-subscriptions" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-licensing", "source": "github-docs", "slug": "enterprise-licensing-read" }, { "id": "enterprise_organization_installation_repositories:read", "key": "enterprise_organization_installation_repositories", "level": "read", "title": "Enterprise organization installation repositories", "target": "enterprise", "tier": 3, "area": "apps", "why": "Lists which repositories an enterprise-owned App installation can reach.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-organization-installation-repositories", "source": "github-docs", "slug": "enterprise-organization-installation-repositories-read" }, { "id": "enterprise_organization_installations:read", "key": "enterprise_organization_installations", "level": "read", "title": "Enterprise organization installations", "target": "enterprise", "tier": 3, "area": "apps", "why": "Lists which organizations an enterprise-owned App is installed in.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "GET /enterprises/{enterprise}/apps/installable_organizations", "GET /enterprises/{enterprise}/apps/organizations/{org}/installations" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-organization-installations", "source": "github-docs", "slug": "enterprise-organization-installations-read" }, { "id": "enterprise_scim:read", "key": "enterprise_scim", "level": "read", "title": "Enterprise SCIM", "target": "enterprise", "tier": 3, "area": "identity", "why": "Reads provisioned enterprise users and groups.", "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "GET /scim/v2/enterprises/{enterprise}/Groups", "GET /scim/v2/enterprises/{enterprise}/Groups/{scim_group_id}", "GET /scim/v2/enterprises/{enterprise}/Users", "GET /scim/v2/enterprises/{enterprise}/Users/{scim_user_id}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-scim", "source": "github-docs", "slug": "enterprise-scim-read" }, { "id": "enterprise_teams:read", "key": "enterprise_teams", "level": "read", "title": "Enterprise teams", "target": "enterprise", "tier": 3, "area": "identity", "why": "Lists enterprise teams, their members and organizations.", "plane": "control", "availableIn": [ "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 7, "sampleEndpoints": [ "GET /enterprises/{enterprise}/members/{username}/teams", "GET /enterprises/{enterprise}/teams", "GET /enterprises/{enterprise}/teams/{enterprise-team}/memberships", "GET /enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#enterprise-permissions-for-enterprise-teams", "source": "github-docs", "slug": "enterprise-teams-read" }, { "id": "organization_administration:read", "key": "organization_administration", "level": "read", "title": "Administration", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads organization settings, Actions policy, rulesets and security configurations.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 48, "sampleEndpoints": [ "GET /organizations/{org}/actions/cache/retention-limit", "GET /organizations/{org}/actions/cache/storage-limit", "GET /orgs/{org}/actions/cache/usage", "GET /orgs/{org}/actions/cache/usage-by-repository" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-administration", "source": "github-docs", "slug": "organization-administration-read" }, { "id": "organization_agent_secrets:read", "key": "organization_agent_secrets", "level": "read", "title": "Agent secrets", "target": "organization", "tier": 3, "area": "secrets", "why": "Lists organization agent secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/agents/secrets", "GET /orgs/{org}/agents/secrets/public-key", "GET /orgs/{org}/agents/secrets/{secret_name}", "GET /orgs/{org}/agents/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-agent-secrets", "source": "github-docs", "slug": "organization-agent-secrets-read" }, { "id": "organization_agent_variables:read", "key": "organization_agent_variables", "level": "read", "title": "Agent variables", "target": "organization", "tier": 3, "area": "agents", "why": "Reads organization agent variables.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/agents/variables", "GET /orgs/{org}/agents/variables/{name}", "GET /orgs/{org}/agents/variables/{name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-agent-variables", "source": "github-docs", "slug": "organization-agent-variables-read" }, { "id": "organization_api_insights:read", "key": "organization_api_insights", "level": "read", "title": "API Insights", "target": "organization", "tier": 3, "area": "insights", "why": "Reads API usage statistics per actor, which shows which tokens and Apps are active.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 9, "sampleEndpoints": [ "GET /orgs/{org}/insights/api/route-stats/{actor_type}/{actor_id}", "GET /orgs/{org}/insights/api/subject-stats", "GET /orgs/{org}/insights/api/summary-stats", "GET /orgs/{org}/insights/api/summary-stats/users/{user_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-api-insights", "source": "github-docs", "slug": "organization-api-insights-read" }, { "id": "organization_user_blocking:read", "key": "organization_user_blocking", "level": "read", "title": "Blocking users", "target": "organization", "tier": 3, "area": "org-policy", "why": "Lists users blocked from the organization.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/blocks", "GET /orgs/{org}/blocks/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-blocking-users", "source": "github-docs", "slug": "organization-user-blocking-read" }, { "id": "organization_user_blocking:write", "key": "organization_user_blocking", "level": "write", "title": "Blocking users", "target": "organization", "tier": 3, "area": "org-policy", "why": "Blocks and unblocks users. Moderation only.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /orgs/{org}/blocks/{username}", "DELETE /orgs/{org}/blocks/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-blocking-users", "source": "github-docs", "slug": "organization-user-blocking-write" }, { "id": "organization_campaigns:read", "key": "organization_campaigns", "level": "read", "title": "Campaigns", "target": "organization", "tier": 3, "area": "code-security", "why": "Reads security campaigns.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/campaigns", "GET /orgs/{org}/campaigns/{campaign_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-campaigns", "source": "github-docs", "slug": "organization-campaigns-read" }, { "id": "organization_campaigns:write", "key": "organization_campaigns", "level": "write", "title": "Campaigns", "target": "organization", "tier": 3, "area": "code-security", "why": "Creates security campaigns. Organizes remediation work, changes no alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/campaigns", "PATCH /orgs/{org}/campaigns/{campaign_number}", "DELETE /orgs/{org}/campaigns/{campaign_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-campaigns", "source": "github-docs", "slug": "organization-campaigns-write" }, { "id": "organization_copilot_agent_settings:read", "key": "organization_copilot_agent_settings", "level": "read", "title": "Copilot agent settings", "target": "organization", "tier": 3, "area": "agents", "why": "Reads where the Copilot coding agent is allowed.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/copilot/coding-agent/permissions", "GET /orgs/{org}/copilot/coding-agent/permissions/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-agent-settings", "source": "github-docs", "slug": "organization-copilot-agent-settings-read" }, { "id": "org_copilot_content_exclusion:read", "key": "org_copilot_content_exclusion", "level": "read", "title": "Copilot content exclusion", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads which files Copilot must ignore.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/copilot/content_exclusion" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-content-exclusion", "source": "github-docs", "slug": "org-copilot-content-exclusion-read" }, { "id": "organization_copilot_spaces:read", "key": "organization_copilot_spaces", "level": "read", "title": "Copilot Spaces", "target": "organization", "tier": 3, "area": "agents", "why": "Reads Copilot Spaces and the context they hold.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/copilot-spaces", "GET /orgs/{org}/copilot-spaces/{space_number}", "GET /orgs/{org}/copilot-spaces/{space_number}/resources", "GET /orgs/{org}/copilot-spaces/{space_number}/resources/{space_resource_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-copilot-spaces", "source": "github-docs", "slug": "organization-copilot-spaces-read" }, { "id": "organization_custom_org_roles:read", "key": "organization_custom_org_roles", "level": "read", "title": "Custom organization roles", "target": "organization", "tier": 3, "area": "admins", "why": "Lists custom organization roles and their permissions.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/organization-fine-grained-permissions", "GET /orgs/{org}/organization-roles", "GET /orgs/{org}/organization-roles/{role_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-organization-roles", "source": "github-docs", "slug": "organization-custom-org-roles-read" }, { "id": "organization_custom_properties:read", "key": "organization_custom_properties", "level": "read", "title": "Custom properties", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads custom property definitions.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/properties/schema", "GET /orgs/{org}/properties/schema/{custom_property_name}", "GET /orgs/{org}/properties/values" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-properties", "source": "github-docs", "slug": "organization-custom-properties-read" }, { "id": "custom_properties_for_organizations:read", "key": "custom_properties_for_organizations", "level": "read", "title": "Custom properties for organizations", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads the organization's own property values.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "GET /organizations/{org}/org-properties/values" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-properties-for-organizations", "source": "github-docs", "slug": "custom-properties-for-organizations-read" }, { "id": "organization_custom_roles:read", "key": "organization_custom_roles", "level": "read", "title": "Custom repository roles", "target": "organization", "tier": 3, "area": "admins", "why": "Lists custom repository roles.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-custom-repository-roles", "source": "github-docs", "slug": "organization-custom-roles-read" }, { "id": "organization_events:read", "key": "organization_events", "level": "read", "title": "Events", "target": "organization", "tier": 3, "area": "insights", "why": "Reads organization activity events.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "GET /users/{username}/events/orgs/{org}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-events", "source": "github-docs", "slug": "organization-events-read" }, { "id": "organization_external_properties_for_repos:read", "key": "organization_external_properties_for_repos", "level": "read", "title": "External custom properties for repositories", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads property definitions provided by installed Apps.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/properties/installations/schema" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-external-custom-properties-for-repositories", "source": "github-docs", "slug": "organization-external-properties-for-repos-read" }, { "id": "organization_copilot_seat_management:read", "key": "organization_copilot_seat_management", "level": "read", "title": "GitHub Copilot Business", "target": "organization", "tier": 3, "area": "insights", "why": "Reads Copilot seat assignments.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/copilot-spaces/{space_number}/collaborators" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-github-copilot-business", "source": "github-docs", "slug": "organization-copilot-seat-management-read" }, { "id": "organization_copilot_seat_management:write", "key": "organization_copilot_seat_management", "level": "write", "title": "GitHub Copilot Business", "target": "organization", "tier": 3, "area": "insights", "why": "Assigns Copilot seats. Billing only.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 7, "sampleEndpoints": [ "POST /orgs/{org}/copilot-spaces/{space_number}/collaborators", "PUT /orgs/{org}/copilot-spaces/{space_number}/collaborators/{actor_type}/{actor_identifier}", "DELETE /orgs/{org}/copilot-spaces/{space_number}/collaborators/{actor_type}/{actor_identifier}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-github-copilot-business", "source": "github-docs", "slug": "organization-copilot-seat-management-write" }, { "id": "organization_runner_custom_images:read", "key": "organization_runner_custom_images", "level": "read", "title": "Hosted runner custom images", "target": "organization", "tier": 3, "area": "runners", "why": "Lists custom images for hosted runners.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/actions/hosted-runners/images/custom", "GET /orgs/{org}/actions/hosted-runners/images/custom/{image_definition_id}", "GET /orgs/{org}/actions/hosted-runners/images/custom/{image_definition_id}/versions", "GET /orgs/{org}/actions/hosted-runners/images/custom/{image_definition_id}/versions/{version}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-hosted-runner-custom-images", "source": "github-docs", "slug": "organization-runner-custom-images-read" }, { "id": "issue_fields:read", "key": "issue_fields", "level": "read", "title": "Issue Fields", "target": "organization", "tier": 3, "area": "collaboration", "why": "Reads issue field definitions.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/issue-fields" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-issue-fields", "source": "github-docs", "slug": "issue-fields-read" }, { "id": "issue_fields:write", "key": "issue_fields", "level": "write", "title": "Issue Fields", "target": "organization", "tier": 3, "area": "collaboration", "why": "Defines issue fields. Configuration of issue forms only.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/issue-fields", "PATCH /orgs/{org}/issue-fields/{issue_field_id}", "DELETE /orgs/{org}/issue-fields/{issue_field_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-issue-fields", "source": "github-docs", "slug": "issue-fields-write" }, { "id": "issue_types:read", "key": "issue_types", "level": "read", "title": "Issue Types", "target": "organization", "tier": 3, "area": "collaboration", "why": "Reads issue type definitions.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/issue-types" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-issue-types", "source": "github-docs", "slug": "issue-types-read" }, { "id": "issue_types:write", "key": "issue_types", "level": "write", "title": "Issue Types", "target": "organization", "tier": 3, "area": "collaboration", "why": "Defines issue types. Configuration of issues only.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "POST /orgs/{org}/issue-types", "PUT /orgs/{org}/issue-types/{issue_type_id}", "DELETE /orgs/{org}/issue-types/{issue_type_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-issue-types", "source": "github-docs", "slug": "issue-types-write" }, { "id": "members:read", "key": "members", "level": "read", "title": "Members", "target": "organization", "tier": 3, "area": "identity", "why": "Lists members, teams, invitations and role assignments. Useful recon for picking targets.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 34, "sampleEndpoints": [ "GET /orgs/{org}/failed_invitations", "GET /orgs/{org}/invitations", "GET /orgs/{org}/invitations/{invitation_id}/teams", "GET /orgs/{org}/members" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-members", "source": "github-docs", "slug": "members-read" }, { "id": "organization_network_configurations:read", "key": "organization_network_configurations", "level": "read", "title": "Network configurations", "target": "organization", "tier": 3, "area": "runners", "why": "Reads private network settings for hosted runners.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/settings/network-configurations", "GET /orgs/{org}/settings/network-configurations/{network_configuration_id}", "GET /orgs/{org}/settings/network-settings/{network_settings_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-network-configurations", "source": "github-docs", "slug": "organization-network-configurations-read" }, { "id": "organization_announcement_banners:read", "key": "organization_announcement_banners", "level": "read", "title": "Organization announcement banners", "target": "organization", "tier": 3, "area": "org-policy", "why": "Reads the organization banner.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/announcement" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-announcement-banners", "source": "github-docs", "slug": "organization-announcement-banners-read" }, { "id": "organization_announcement_banners:write", "key": "organization_announcement_banners", "level": "write", "title": "Organization announcement banners", "target": "organization", "tier": 3, "area": "org-policy", "why": "Sets the banner shown to members. Could carry a phishing link, but grants no access.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "PATCH /orgs/{org}/announcement", "DELETE /orgs/{org}/announcement" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-announcement-banners", "source": "github-docs", "slug": "organization-announcement-banners-write" }, { "id": "organization_secret_scanning_bypass_requests:read", "key": "organization_secret_scanning_bypass_requests", "level": "read", "title": "Organization bypass requests for secret scanning", "target": "organization", "tier": 3, "area": "code-security", "why": "Reads requests to push past secret scanning push protection.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-bypass-requests-for-secret-scanning", "source": "github-docs", "slug": "organization-secret-scanning-bypass-requests-read" }, { "id": "organization_codespaces:read", "key": "organization_codespaces", "level": "read", "title": "Organization codespaces", "target": "organization", "tier": 3, "area": "codespaces", "why": "Lists codespaces in the organization.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-codespaces", "source": "github-docs", "slug": "organization-codespaces-read" }, { "id": "organization_codespaces_secrets:read", "key": "organization_codespaces_secrets", "level": "read", "title": "Organization codespaces secrets", "target": "organization", "tier": 3, "area": "secrets", "why": "Lists organization Codespaces secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/codespaces/secrets", "GET /orgs/{org}/codespaces/secrets/public-key", "GET /orgs/{org}/codespaces/secrets/{secret_name}", "GET /orgs/{org}/codespaces/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-codespaces-secrets", "source": "github-docs", "slug": "organization-codespaces-secrets-read" }, { "id": "organization_copilot_metrics:read", "key": "organization_copilot_metrics", "level": "read", "title": "Organization Copilot metrics", "target": "organization", "tier": 3, "area": "insights", "why": "Reads Copilot usage metrics.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 6, "sampleEndpoints": [ "GET /orgs/{org}/copilot/metrics/reports/organization-1-day", "GET /orgs/{org}/copilot/metrics/reports/organization-28-day/latest", "GET /orgs/{org}/copilot/metrics/reports/repos-1-day", "GET /orgs/{org}/copilot/metrics/reports/user-teams-1-day" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-copilot-metrics", "source": "github-docs", "slug": "organization-copilot-metrics-read" }, { "id": "organization_dependabot_secrets:read", "key": "organization_dependabot_secrets", "level": "read", "title": "Organization dependabot secrets", "target": "organization", "tier": 3, "area": "secrets", "why": "Lists organization Dependabot secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/dependabot/secrets", "GET /orgs/{org}/dependabot/secrets/public-key", "GET /orgs/{org}/dependabot/secrets/{secret_name}", "GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dependabot-secrets", "source": "github-docs", "slug": "organization-dependabot-secrets-read" }, { "id": "organization_code_scanning_dismissal_requests:read", "key": "organization_code_scanning_dismissal_requests", "level": "read", "title": "Organization dismissal requests for code scanning", "target": "organization", "tier": 3, "area": "code-security", "why": "Reads requests to dismiss code scanning alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/dismissal-requests/code-scanning" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dismissal-requests-for-code-scanning", "source": "github-docs", "slug": "organization-code-scanning-dismissal-requests-read" }, { "id": "organization_dependabot_dismissal_requests:read", "key": "organization_dependabot_dismissal_requests", "level": "read", "title": "Organization dismissal requests for Dependabot", "target": "organization", "tier": 3, "area": "code-security", "why": "Reads requests to dismiss Dependabot alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [ "GET /orgs/{org}/dismissal-requests/dependabot" ], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-dismissal-requests-for-dependabot", "source": "github-docs", "slug": "organization-dependabot-dismissal-requests-read" }, { "id": "organization_private_registries:read", "key": "organization_private_registries", "level": "read", "title": "Organization private registries", "target": "organization", "tier": 3, "area": "secrets", "why": "Lists private registry configurations. Credentials are not returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/private-registries", "GET /orgs/{org}/private-registries/public-key", "GET /orgs/{org}/private-registries/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-organization-private-registries", "source": "github-docs", "slug": "organization-private-registries-read" }, { "id": "organization_personal_access_token_requests:read", "key": "organization_personal_access_token_requests", "level": "read", "title": "Personal access token requests", "target": "organization", "tier": 3, "area": "tokens", "why": "Lists pending fine-grained PAT requests.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/personal-access-token-requests", "GET /orgs/{org}/personal-access-token-requests/{pat_request_id}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-personal-access-token-requests", "source": "github-docs", "slug": "organization-personal-access-token-requests-read" }, { "id": "organization_personal_access_tokens:read", "key": "organization_personal_access_tokens", "level": "read", "title": "Personal access tokens", "target": "organization", "tier": 3, "area": "tokens", "why": "Lists fine-grained PATs with access to the organization and what they reach.", "plane": "management", "availableIn": [ "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/personal-access-tokens", "GET /orgs/{org}/personal-access-tokens/{pat_id}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-personal-access-tokens", "source": "github-docs", "slug": "organization-personal-access-tokens-read" }, { "id": "organization_projects:read", "key": "organization_projects", "level": "read", "title": "Projects", "target": "organization", "tier": 3, "area": "collaboration", "why": "Reads organization projects.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 7, "sampleEndpoints": [ "GET /orgs/{org}/projectsV2", "GET /orgs/{org}/projectsV2/{project_number}", "GET /orgs/{org}/projectsV2/{project_number}/fields", "GET /orgs/{org}/projectsV2/{project_number}/fields/{field_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-projects", "source": "github-docs", "slug": "organization-projects-read" }, { "id": "organization_projects:write", "key": "organization_projects", "level": "write", "title": "Projects", "target": "organization", "tier": 3, "area": "collaboration", "why": "Edits organization projects. Planning data only.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 6, "sampleEndpoints": [ "POST /orgs/{org}/projectsV2/{project_number}/drafts", "POST /orgs/{org}/projectsV2/{project_number}/fields", "POST /orgs/{org}/projectsV2/{project_number}/items", "PATCH /orgs/{org}/projectsV2/{project_number}/items/{item_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-projects", "source": "github-docs", "slug": "organization-projects-write" }, { "id": "secret_scanning_dismissal_requests:read", "key": "secret_scanning_dismissal_requests", "level": "read", "title": "Secret scanning alert dismissal requests", "target": "organization", "tier": 3, "area": "code-security", "why": "Reads requests to dismiss secret scanning alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-secret-scanning-alert-dismissal-requests", "source": "github-docs", "slug": "secret-scanning-dismissal-requests-read" }, { "id": "organization_secrets:read", "key": "organization_secrets", "level": "read", "title": "Secrets", "target": "organization", "tier": 3, "area": "secrets", "why": "Lists organization Actions secret names and which repositories can use them. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "GET /orgs/{org}/actions/secrets", "GET /orgs/{org}/actions/secrets/public-key", "GET /orgs/{org}/actions/secrets/{secret_name}", "GET /orgs/{org}/actions/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-secrets", "source": "github-docs", "slug": "organization-secrets-read" }, { "id": "organization_self_hosted_runners:read", "key": "organization_self_hosted_runners", "level": "read", "title": "Self-hosted runners", "target": "organization", "tier": 3, "area": "runners", "why": "Lists self-hosted runners and runner groups.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 10, "sampleEndpoints": [ "GET /orgs/{org}/actions/runner-groups", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/hosted-runners", "GET /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-self-hosted-runners", "source": "github-docs", "slug": "organization-self-hosted-runners-read" }, { "id": "organization_actions_variables:read", "key": "organization_actions_variables", "level": "read", "title": "Variables", "target": "organization", "tier": 3, "area": "workflows", "why": "Reads organization Actions variables.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/actions/variables", "GET /orgs/{org}/actions/variables/{name}", "GET /orgs/{org}/actions/variables/{name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-variables", "source": "github-docs", "slug": "organization-actions-variables-read" }, { "id": "organization_hooks:read", "key": "organization_hooks", "level": "read", "title": "Webhooks", "target": "organization", "tier": 3, "area": "webhooks", "why": "Lists organization webhooks and their delivery settings.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "GET /orgs/{org}/hooks", "GET /orgs/{org}/hooks/{hook_id}", "GET /orgs/{org}/hooks/{hook_id}/config", "GET /orgs/{org}/hooks/{hook_id}/deliveries" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#organization-permissions-for-webhooks", "source": "github-docs", "slug": "organization-hooks-read" }, { "id": "actions:read", "key": "actions", "level": "read", "title": "Actions", "target": "repository", "tier": 3, "area": "workflows", "why": "Reads workflow runs, logs, artifacts and caches. Logs and artifacts sometimes contain tokens that were not masked.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "actions", "endpointCount": 34, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/actions/artifacts", "GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}", "GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}", "GET /repos/{owner}/{repo}/actions/cache/storage-limit" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-actions", "source": "github-docs", "slug": "actions-read" }, { "id": "administration:read", "key": "administration", "level": "read", "title": "Administration", "target": "repository", "tier": 3, "area": "repo-settings", "why": "Reads repository settings, protection rules, collaborators and Actions settings.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 43, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/actions/cache/retention-limit", "GET /repos/{owner}/{repo}/actions/permissions", "GET /repos/{owner}/{repo}/actions/permissions/access", "GET /repos/{owner}/{repo}/actions/permissions/artifact-and-log-retention" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-administration", "source": "github-docs", "slug": "administration-read" }, { "id": "agent_secrets:read", "key": "agent_secrets", "level": "read", "title": "Agent secrets", "target": "repository", "tier": 3, "area": "secrets", "why": "Lists agent secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/agents/organization-secrets", "GET /repos/{owner}/{repo}/agents/secrets", "GET /repos/{owner}/{repo}/agents/secrets/public-key", "GET /repos/{owner}/{repo}/agents/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-agent-secrets", "source": "github-docs", "slug": "agent-secrets-read" }, { "id": "agent_variables:read", "key": "agent_variables", "level": "read", "title": "Agent variables", "target": "repository", "tier": 3, "area": "agents", "why": "Reads agent variables for this repository.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/agents/organization-variables", "GET /repos/{owner}/{repo}/agents/variables", "GET /repos/{owner}/{repo}/agents/variables/{name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-agent-variables", "source": "github-docs", "slug": "agent-variables-read" }, { "id": "artifact_metadata:read", "key": "artifact_metadata", "level": "read", "title": "Artifact metadata", "target": "repository", "tier": 3, "area": "releases", "why": "Reads artifact deployment records.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "githubTokenKey": "artifact-metadata", "endpointCount": 3, "sampleEndpoints": [ "GET /orgs/{org}/artifacts/metadata/deployment-record/cluster/{cluster}/jobs/{job_id}", "GET /orgs/{org}/artifacts/{subject_digest}/metadata/deployment-records", "GET /orgs/{org}/artifacts/{subject_digest}/metadata/storage-records" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-artifact-metadata", "source": "github-docs", "slug": "artifact-metadata-read" }, { "id": "attestations:read", "key": "attestations", "level": "read", "title": "Attestations", "target": "repository", "tier": 3, "area": "releases", "why": "Reads build provenance attestations.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "githubTokenKey": "attestations", "endpointCount": 2, "sampleEndpoints": [ "GET /orgs/{org}/attestations/repositories", "GET /repos/{owner}/{repo}/attestations/{subject_digest}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-attestations", "source": "github-docs", "slug": "attestations-read" }, { "id": "checks:read", "key": "checks", "level": "read", "title": "Checks", "target": "repository", "tier": 3, "area": "code", "why": "Reads check runs and suites.", "plane": "data", "availableIn": [ "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "checks", "endpointCount": 6, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/check-runs/{check_run_id}", "GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations", "GET /repos/{owner}/{repo}/check-suites/{check_suite_id}", "GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-checks", "source": "github-docs", "slug": "checks-read" }, { "id": "code_quality:read", "key": "code_quality", "level": "read", "title": "Code quality", "target": "repository", "tier": 3, "area": "code", "why": "Reads code quality findings.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/code-quality/findings", "GET /repos/{owner}/{repo}/code-quality/findings/{finding_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-code-quality", "source": "github-docs", "slug": "code-quality-read" }, { "id": "security_events:read", "key": "security_events", "level": "read", "title": "Code scanning alerts", "target": "repository", "tier": 3, "area": "code-security", "why": "Reads code scanning alerts and analyses. Shows where the code is weak.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "security-events", "endpointCount": 12, "sampleEndpoints": [ "GET /orgs/{org}/code-scanning/alerts", "GET /repos/{owner}/{repo}/code-scanning/ai-scan", "GET /repos/{owner}/{repo}/code-scanning/alerts", "GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-code-scanning-alerts", "source": "github-docs", "slug": "security-events-read" }, { "id": "codespaces:read", "key": "codespaces", "level": "read", "title": "Codespaces", "target": "repository", "tier": 3, "area": "codespaces", "why": "Lists codespaces for the repository.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 5, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/codespaces", "GET /user/codespaces", "GET /user/codespaces/{codespace_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces", "source": "github-docs", "slug": "codespaces-read" }, { "id": "codespaces_lifecycle_admin:read", "key": "codespaces_lifecycle_admin", "level": "read", "title": "Codespaces lifecycle admin", "target": "repository", "tier": 3, "area": "codespaces", "why": "Reads codespace export status.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /user/codespaces/{codespace_name}/exports/{export_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces-lifecycle-admin", "source": "github-docs", "slug": "codespaces-lifecycle-admin-read" }, { "id": "codespaces_metadata:read", "key": "codespaces_metadata", "level": "read", "title": "Codespaces metadata", "target": "repository", "tier": 3, "area": "codespaces", "why": "Reads dev container and machine type options.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/codespaces/devcontainers", "GET /repos/{owner}/{repo}/codespaces/machines", "GET /user/codespaces/{codespace_name}/machines" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-codespaces-metadata", "source": "github-docs", "slug": "codespaces-metadata-read" }, { "id": "statuses:read", "key": "statuses", "level": "read", "title": "Commit statuses", "target": "repository", "tier": 3, "area": "code", "why": "Reads commit statuses.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "statuses", "endpointCount": 2, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/commits/{ref}/status", "GET /repos/{owner}/{repo}/commits/{ref}/statuses" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-commit-statuses", "source": "github-docs", "slug": "statuses-read" }, { "id": "contents:read", "key": "contents", "level": "read", "title": "Contents", "target": "repository", "tier": 3, "area": "code", "why": "Reads code, commits, branches, tags and releases. On a private repository this is the source code itself.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "contents", "endpointCount": 49, "sampleEndpoints": [ "POST /markdown", "GET /repos/{owner}/{repo}/activity", "GET /repos/{owner}/{repo}/branches", "GET /repos/{owner}/{repo}/branches/{branch}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-contents", "source": "github-docs", "slug": "contents-read" }, { "id": "copilot_agent_settings:read", "key": "copilot_agent_settings", "level": "read", "title": "Copilot agent settings", "target": "repository", "tier": 3, "area": "agents", "why": "Reads the Copilot cloud agent configuration.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/copilot/cloud-agent/configuration" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-copilot-agent-settings", "source": "github-docs", "slug": "copilot-agent-settings-read" }, { "id": "vulnerability_alerts:read", "key": "vulnerability_alerts", "level": "read", "title": "Dependabot alerts", "target": "repository", "tier": 3, "area": "code-security", "why": "Reads Dependabot alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 8, "sampleEndpoints": [ "GET /orgs/{org}/dependabot/alerts", "GET /repos/{owner}/{repo}/dependabot/alerts", "GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}", "GET /repos/{owner}/{repo}/dismissal-requests/dependabot" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-dependabot-alerts", "source": "github-docs", "slug": "vulnerability-alerts-read" }, { "id": "dependabot_secrets:read", "key": "dependabot_secrets", "level": "read", "title": "Dependabot secrets", "target": "repository", "tier": 3, "area": "secrets", "why": "Lists repository Dependabot secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/dependabot/secrets", "GET /repos/{owner}/{repo}/dependabot/secrets/public-key", "GET /repos/{owner}/{repo}/dependabot/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-dependabot-secrets", "source": "github-docs", "slug": "dependabot-secrets-read" }, { "id": "deployments:read", "key": "deployments", "level": "read", "title": "Deployments", "target": "repository", "tier": 3, "area": "workflows", "why": "Reads deployments and their statuses.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "deployments", "endpointCount": 4, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/deployments", "GET /repos/{owner}/{repo}/deployments/{deployment_id}", "GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses", "GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses/{status_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-deployments", "source": "github-docs", "slug": "deployments-read" }, { "id": "discussions:read", "key": "discussions", "level": "read", "title": "Discussions", "target": "repository", "tier": 3, "area": "collaboration", "why": "Reads discussions.", "plane": "data", "availableIn": [ "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "discussions", "endpointCount": 0, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions", "source": "github-token-only", "slug": "discussions-read" }, { "id": "environments:read", "key": "environments", "level": "read", "title": "Environments", "target": "repository", "tier": 3, "area": "secrets", "why": "Lists environment secret names and environment variables. Secret values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 5, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/environments/{environment_name}/secrets", "GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key", "GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}", "GET /repos/{owner}/{repo}/environments/{environment_name}/variables" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-environments", "source": "github-docs", "slug": "environments-read" }, { "id": "issues:read", "key": "issues", "level": "read", "title": "Issues", "target": "repository", "tier": 3, "area": "collaboration", "why": "Reads issues and comments.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "issues", "endpointCount": 27, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/issues", "GET /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions", "GET /repos/{owner}/{repo}/issues/events", "GET /repos/{owner}/{repo}/issues/{issue_number}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-issues", "source": "github-docs", "slug": "issues-read" }, { "id": "metadata:read", "key": "metadata", "level": "read", "title": "Metadata", "target": "repository", "tier": 3, "area": "code", "why": "Reads basic repository information. Every App and fine-grained PAT gets this.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 35, "sampleEndpoints": [ "GET /orgs/{org}/repos", "GET /repos/{owner}/{repo}", "GET /repos/{owner}/{repo}/collaborators", "GET /repos/{owner}/{repo}/collaborators/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-metadata", "source": "github-docs", "slug": "metadata-read" }, { "id": "packages:read", "key": "packages", "level": "read", "title": "Packages", "target": "repository", "tier": 3, "area": "releases", "why": "Downloads packages from GitHub Packages.", "plane": "data", "availableIn": [ "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "packages", "endpointCount": 0, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions", "source": "github-token-only", "slug": "packages-read" }, { "id": "pages:read", "key": "pages", "level": "read", "title": "Pages", "target": "repository", "tier": 3, "area": "workflows", "why": "Reads the GitHub Pages configuration.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "pages", "endpointCount": 5, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/pages", "GET /repos/{owner}/{repo}/pages/builds", "GET /repos/{owner}/{repo}/pages/builds/latest", "GET /repos/{owner}/{repo}/pages/builds/{build_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-pages", "source": "github-docs", "slug": "pages-read" }, { "id": "pull_requests:read", "key": "pull_requests", "level": "read", "title": "Pull requests", "target": "repository", "tier": 3, "area": "code", "why": "Reads pull requests and reviews.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app", "github-token" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "githubTokenKey": "pull-requests", "endpointCount": 32, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls", "GET /repos/{owner}/{repo}/pulls", "GET /repos/{owner}/{repo}/pulls/comments", "GET /repos/{owner}/{repo}/pulls/comments/{comment_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-pull-requests", "source": "github-docs", "slug": "pull-requests-read" }, { "id": "repository_advisories:read", "key": "repository_advisories", "level": "read", "title": "Repository security advisories", "target": "repository", "tier": 3, "area": "code-security", "why": "Reads security advisories, including drafts about vulnerabilities that are not fixed yet.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 3, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/security-advisories", "GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-repository-security-advisories", "source": "github-docs", "slug": "repository-advisories-read" }, { "id": "repo_secret_scanning_dismissal_requests:read", "key": "repo_secret_scanning_dismissal_requests", "level": "read", "title": "Secret scanning alert dismissal requests", "target": "repository", "tier": 3, "area": "code-security", "why": "Reads requests to dismiss secret scanning alerts.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-alert-dismissal-requests", "source": "github-docs", "slug": "repo-secret-scanning-dismissal-requests-read" }, { "id": "secret_scanning_bypass_requests:read", "key": "secret_scanning_bypass_requests", "level": "read", "title": "Secret scanning push protection bypass requests", "target": "repository", "tier": 3, "area": "code-security", "why": "Reads requests to push past push protection.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secret-scanning-push-protection-bypass-requests", "source": "github-docs", "slug": "secret-scanning-bypass-requests-read" }, { "id": "secrets:read", "key": "secrets", "level": "read", "title": "Secrets", "target": "repository", "tier": 3, "area": "secrets", "why": "Lists repository Actions secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 4, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/actions/organization-secrets", "GET /repos/{owner}/{repo}/actions/secrets", "GET /repos/{owner}/{repo}/actions/secrets/public-key", "GET /repos/{owner}/{repo}/actions/secrets/{secret_name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-secrets", "source": "github-docs", "slug": "secrets-read" }, { "id": "actions_variables:read", "key": "actions_variables", "level": "read", "title": "Variables", "target": "repository", "tier": 3, "area": "workflows", "why": "Reads repository Actions variables.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/actions/organization-variables", "GET /repos/{owner}/{repo}/actions/variables", "GET /repos/{owner}/{repo}/actions/variables/{name}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-variables", "source": "github-docs", "slug": "actions-variables-read" }, { "id": "repository_hooks:read", "key": "repository_hooks", "level": "read", "title": "Webhooks", "target": "repository", "tier": 3, "area": "webhooks", "why": "Lists repository webhooks.", "plane": "management", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 7, "sampleEndpoints": [ "GET /repos/{owner}/{repo}/hooks", "GET /repos/{owner}/{repo}/hooks/{hook_id}", "GET /repos/{owner}/{repo}/hooks/{hook_id}/config", "GET /repos/{owner}/{repo}/hooks/{hook_id}/deliveries" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-webhooks", "source": "github-docs", "slug": "repository-hooks-read" }, { "id": "blocking:read", "key": "blocking", "level": "read", "title": "Block another user", "target": "user", "tier": 3, "area": "account", "why": "Lists users the user has blocked.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "GET /user/blocks", "GET /user/blocks/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-block-another-user", "source": "github-docs", "slug": "blocking-read" }, { "id": "blocking:write", "key": "blocking", "level": "write", "title": "Block another user", "target": "user", "tier": 3, "area": "account", "why": "Blocks and unblocks users.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /user/blocks/{username}", "DELETE /user/blocks/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-block-another-user", "source": "github-docs", "slug": "blocking-write" }, { "id": "codespaces_user_secrets:read", "key": "codespaces_user_secrets", "level": "read", "title": "Codespaces user secrets", "target": "user", "tier": 3, "area": "secrets", "why": "Lists the user's Codespaces secret names. Values are never returned.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 4, "sampleEndpoints": [ "GET /user/codespaces/secrets", "GET /user/codespaces/secrets/public-key", "GET /user/codespaces/secrets/{secret_name}", "GET /user/codespaces/secrets/{secret_name}/repositories" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-codespaces-user-secrets", "source": "github-docs", "slug": "codespaces-user-secrets-read" }, { "id": "emails:read", "key": "emails", "level": "read", "title": "Email addresses", "target": "user", "tier": 3, "area": "identity", "why": "Reads the user's email addresses.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /user/emails", "GET /user/public_emails" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-email-addresses", "source": "github-docs", "slug": "emails-read" }, { "id": "followers:read", "key": "followers", "level": "read", "title": "Followers", "target": "user", "tier": 3, "area": "account", "why": "Lists who the user follows and who follows them.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /user/followers", "GET /user/following", "GET /user/following/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-followers", "source": "github-docs", "slug": "followers-read" }, { "id": "followers:write", "key": "followers", "level": "write", "title": "Followers", "target": "user", "tier": 3, "area": "account", "why": "Follows and unfollows users.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /user/following/{username}", "DELETE /user/following/{username}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-followers", "source": "github-docs", "slug": "followers-write" }, { "id": "gists:write", "key": "gists", "level": "write", "title": "Gists", "target": "user", "tier": 3, "area": "account", "why": "Creates and edits the user's gists. Content outside the organization's repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 9, "sampleEndpoints": [ "POST /gists", "PATCH /gists/{gist_id}", "DELETE /gists/{gist_id}", "POST /gists/{gist_id}/comments" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-gists", "source": "github-docs", "slug": "gists-write" }, { "id": "keys:read", "key": "keys", "level": "read", "title": "Git SSH keys", "target": "user", "tier": 3, "area": "identity", "why": "Lists the user's SSH keys.", "plane": "control", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /user/keys", "GET /user/keys/{key_id}", "GET /users/{username}/keys" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-git-ssh-keys", "source": "github-docs", "slug": "keys-read" }, { "id": "gpg_keys:read", "key": "gpg_keys", "level": "read", "title": "GPG keys", "target": "user", "tier": 3, "area": "code", "why": "Lists the user's GPG keys.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /user/gpg_keys", "GET /user/gpg_keys/{gpg_key_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-gpg-keys", "source": "github-docs", "slug": "gpg-keys-read" }, { "id": "interaction_limits:read", "key": "interaction_limits", "level": "read", "title": "Interaction limits", "target": "user", "tier": 3, "area": "account", "why": "Reads interaction limits on the user's repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 1, "sampleEndpoints": [ "GET /user/interaction-limits" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-interaction-limits", "source": "github-docs", "slug": "interaction-limits-read" }, { "id": "interaction_limits:write", "key": "interaction_limits", "level": "write", "title": "Interaction limits", "target": "user", "tier": 3, "area": "account", "why": "Limits who can comment on the user's repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu" ], "endpointCount": 2, "sampleEndpoints": [ "PUT /user/interaction-limits", "DELETE /user/interaction-limits" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-interaction-limits", "source": "github-docs", "slug": "interaction-limits-write" }, { "id": "private_repository_invitations:read", "key": "private_repository_invitations", "level": "read", "title": "Private repository invitations", "target": "user", "tier": 3, "area": "account", "why": "Reads invitations to private repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 1, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-private-repository-invitations", "source": "github-docs", "slug": "private-repository-invitations-read" }, { "id": "profile:write", "key": "profile", "level": "write", "title": "Profile", "target": "user", "tier": 3, "area": "account", "why": "Edits the user's profile.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "PATCH /user", "POST /user/social_accounts", "DELETE /user/social_accounts" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-profile", "source": "github-docs", "slug": "profile-write" }, { "id": "git_signing_ssh_public_keys:read", "key": "git_signing_ssh_public_keys", "level": "read", "title": "SSH signing keys", "target": "user", "tier": 3, "area": "code", "why": "Lists the user's SSH signing keys.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /user/ssh_signing_keys", "GET /user/ssh_signing_keys/{ssh_signing_key_id}" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-ssh-signing-keys", "source": "github-docs", "slug": "git-signing-ssh-public-keys-read" }, { "id": "starring:read", "key": "starring", "level": "read", "title": "Starring", "target": "user", "tier": 3, "area": "account", "why": "Lists starred repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 3, "sampleEndpoints": [ "GET /user/starred", "GET /users/{username}/starred" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-starring", "source": "github-docs", "slug": "starring-read" }, { "id": "starring:write", "key": "starring", "level": "write", "title": "Starring", "target": "user", "tier": 3, "area": "account", "why": "Stars and unstars repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-starring", "source": "github-docs", "slug": "starring-write" }, { "id": "watching:read", "key": "watching", "level": "read", "title": "Watching", "target": "user", "tier": 3, "area": "account", "why": "Lists watched repositories.", "plane": "data", "availableIn": [ "fine-grained-pat", "github-app" ], "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "endpointCount": 2, "sampleEndpoints": [ "GET /user/subscriptions", "GET /users/{username}/subscriptions" ], "docsUrl": "https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#user-permissions-for-watching", "source": "github-docs", "slug": "watching-read" } ] }