{ "generatedAt": "2026-10-12T16:01:05.493Z", "scopesFetchedAt": "2026-10-12", "source": "https://docs.github.com/en/enterprise-cloud@latest/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps", "restPagesRead": 174, "note": "Each classic scope's reach comes from GitHub's REST docs: an endpoint that needs the scope and needs a fine-grained permission links the two (source: documented). A few are stated by GitHub in prose only (source: inferred). A top-level scope includes its sub-scopes. Tier is the highest tier reached; the ceiling for a real token also depends on its owner's roles.", "scopes": [ { "name": "(no scope)", "parent": null, "children": [], "description": "Grants read-only access to public information (including user profile info, repository info, and gists)", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "metadata:read" ], "permissions": [ { "permissionId": "metadata:read", "source": "inferred", "from": "Grants read-only access to public information." } ], "endpointCount": 0, "note": "Public data only. Any token can read it.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "no-scope" }, { "name": "repo", "parent": null, "children": [ "repo:status", "repo_deployment", "public_repo", "repo:invite", "security_events" ], "description": "Grants full access to public, internal, and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhooks. Note: In addition to repository related resources, the `repo` scope also grants access to manage organization-owned resources including projects, invitations, team memberships and webhooks. This scope also grants the ability to manage projects owned by users.", "tier": 0, "plane": "management", "why": "Tier 0 because it reaches Administration: Write (organization).", "decidingPermissions": [ "organization_administration:write" ], "permissions": [ { "permissionId": "organization_administration:write", "source": "documented", "endpoints": 1 }, { "permissionId": "actions:write", "source": "documented", "endpoints": 15 }, { "permissionId": "administration:write", "source": "documented", "endpoints": 37 }, { "permissionId": "environments:write", "source": "documented", "endpoints": 5 }, { "permissionId": "organization_secrets:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_self_hosted_runners:write", "source": "documented", "endpoints": 4 }, { "permissionId": "repository_hooks:write", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_alerts:read", "source": "documented", "endpoints": 5 }, { "permissionId": "secrets:write", "source": "documented", "endpoints": 2 }, { "permissionId": "workflows:write", "source": "documented", "endpoints": 1 }, { "permissionId": "actions_variables:write", "source": "documented", "endpoints": 3 }, { "permissionId": "agent_secrets:write", "source": "documented", "endpoints": 2 }, { "permissionId": "agent_variables:write", "source": "documented", "endpoints": 3 }, { "permissionId": "codespaces_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "contents:write", "source": "documented", "endpoints": 7 }, { "permissionId": "dependabot_secrets:write", "source": "documented", "endpoints": 2 }, { "permissionId": "deployments:write", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_actions_variables:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_agent_secrets:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_agent_variables:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_code_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "organization_dependabot_dismissal_requests:write", "source": "documented", "endpoints": 2, "from": "Through security_events" }, { "permissionId": "organization_secret_scanning_bypass_requests:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "pages:write", "source": "documented", "endpoints": 4 }, { "permissionId": "repo_secret_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "repository_advisories:write", "source": "documented", "endpoints": 4 }, { "permissionId": "repository_creation:write", "source": "documented", "endpoints": 3 }, { "permissionId": "secret_scanning_alerts:write", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_bypass_requests:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "secret_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "security_events:write", "source": "documented", "endpoints": 1 }, { "permissionId": "statuses:write", "source": "inferred", "from": "Grants read/write access to commit statuses." }, { "permissionId": "vulnerability_alerts:write", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "actions_variables:read", "source": "documented", "endpoints": 3 }, { "permissionId": "actions:read", "source": "documented", "endpoints": 33 }, { "permissionId": "administration:read", "source": "documented", "endpoints": 16 }, { "permissionId": "agent_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "agent_variables:read", "source": "documented", "endpoints": 3 }, { "permissionId": "checks:read", "source": "documented", "endpoints": 6 }, { "permissionId": "code_quality:read", "source": "documented", "endpoints": 2 }, { "permissionId": "contents:read", "source": "documented", "endpoints": 3 }, { "permissionId": "copilot_agent_settings:read", "source": "documented", "endpoints": 1 }, { "permissionId": "dependabot_secrets:read", "source": "documented", "endpoints": 3 }, { "permissionId": "environments:read", "source": "documented", "endpoints": 5 }, { "permissionId": "members:read", "source": "documented", "endpoints": 1 }, { "permissionId": "metadata:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_actions_variables:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_administration:read", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_agent_secrets:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_agent_variables:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_campaigns:read", "source": "documented", "endpoints": 2, "from": "Through security_events" }, { "permissionId": "organization_campaigns:write", "source": "documented", "endpoints": 3, "from": "Through security_events" }, { "permissionId": "organization_code_scanning_dismissal_requests:read", "source": "documented", "endpoints": 3, "from": "Through security_events" }, { "permissionId": "organization_custom_roles:read", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_dependabot_dismissal_requests:read", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "organization_secret_scanning_bypass_requests:read", "source": "documented", "endpoints": 3, "from": "Through security_events" }, { "permissionId": "organization_secrets:read", "source": "documented", "endpoints": 2 }, { "permissionId": "pages:read", "source": "documented", "endpoints": 4 }, { "permissionId": "repository_advisories:read", "source": "documented", "endpoints": 2 }, { "permissionId": "repository_hooks:read", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_bypass_requests:read", "source": "documented", "endpoints": 1, "from": "Through security_events" }, { "permissionId": "secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "security_events:read", "source": "documented", "endpoints": 11, "from": "Through security_events" }, { "permissionId": "vulnerability_alerts:read", "source": "documented", "endpoints": 8, "from": "Through security_events" } ], "endpointCount": 268, "note": "Reaches every repository the user can access, in every organization they belong to; admin endpoints only work where the user is an admin. For an organization owner it reaches much further: GitHub documents repo as enough for PATCH /orgs/{org} (organization settings, including the base repository permission), organization secrets and runner registration. That is why repo is Tier 0 even though most of what it covers is repository-level.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "repo" }, { "name": "repo:status", "parent": "repo", "children": [], "description": "Grants read/write access to commit statuses in public, private, and internal repositories. This scope is only necessary to grant other users or services access to private repository commit statuses *without* granting access to the code.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Commit statuses: Write (repository).", "decidingPermissions": [ "statuses:write" ], "permissions": [ { "permissionId": "statuses:write", "source": "inferred", "from": "Grants read/write access to commit statuses." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "repo-status" }, { "name": "repo_deployment", "parent": "repo", "children": [], "description": "Grants access to deployment statuses for public and private repositories. This scope is only necessary to grant other users or services access to deployment statuses, *without* granting access to the code.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Deployments: Write (repository).", "decidingPermissions": [ "deployments:write" ], "permissions": [ { "permissionId": "deployments:write", "source": "documented", "endpoints": 3 } ], "endpointCount": 3, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "repo-deployment" }, { "name": "public_repo", "parent": "repo", "children": [], "description": "Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositories.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Repository creation: Write (repository), Contents: Write (repository), Deployments: Write (repository) and 1 more.", "decidingPermissions": [ "repository_creation:write", "contents:write", "deployments:write", "statuses:write" ], "permissions": [ { "permissionId": "contents:write", "source": "inferred", "from": "Read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories." }, { "permissionId": "deployments:write", "source": "inferred", "from": "Read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories." }, { "permissionId": "repository_creation:write", "source": "documented", "endpoints": 3 }, { "permissionId": "statuses:write", "source": "inferred", "from": "Read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories." }, { "permissionId": "administration:read", "source": "documented", "endpoints": 1 }, { "permissionId": "contents:read", "source": "documented", "endpoints": 1 } ], "endpointCount": 4, "note": "Same as repo, but only for public repositories. Write access to a widely used public repository is still a supply chain risk.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "public-repo" }, { "name": "repo:invite", "parent": "repo", "children": [], "description": "Grants accept/decline abilities for invitations to collaborate on a repository. This scope is only necessary to grant other users or services access to invites *without* granting access to the code.", "tier": 3, "plane": "data", "why": "It reaches no permission on the reference, so it gets the lowest tier.", "decidingPermissions": [], "permissions": [], "endpointCount": 0, "note": "Accepts or declines the user's own repository invitations. No permission on the reference covers it.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "repo-invite" }, { "name": "security_events", "parent": "repo", "children": [], "description": "Grants: read and write access to security events in the code scanning API read and write access to security events in the secret scanning API This scope is only necessary to grant other users or services access to security events *without* granting access to the code.", "tier": 1, "plane": "data", "why": "Tier 1 because it reaches Secret scanning alerts: Read (repository).", "decidingPermissions": [ "secret_scanning_alerts:read" ], "permissions": [ { "permissionId": "secret_scanning_alerts:read", "source": "documented", "endpoints": 12 }, { "permissionId": "organization_code_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_dependabot_dismissal_requests:write", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_secret_scanning_bypass_requests:write", "source": "documented", "endpoints": 1 }, { "permissionId": "repo_secret_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_alerts:write", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_bypass_requests:write", "source": "documented", "endpoints": 1 }, { "permissionId": "secret_scanning_dismissal_requests:write", "source": "documented", "endpoints": 1 }, { "permissionId": "security_events:write", "source": "documented", "endpoints": 3 }, { "permissionId": "vulnerability_alerts:write", "source": "documented", "endpoints": 1 }, { "permissionId": "contents:read", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_campaigns:read", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_campaigns:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_code_scanning_dismissal_requests:read", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_dependabot_dismissal_requests:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_secret_scanning_bypass_requests:read", "source": "documented", "endpoints": 3 }, { "permissionId": "secret_scanning_bypass_requests:read", "source": "documented", "endpoints": 1 }, { "permissionId": "security_events:read", "source": "documented", "endpoints": 11 }, { "permissionId": "vulnerability_alerts:read", "source": "documented", "endpoints": 8 } ], "endpointCount": 45, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "security-events" }, { "name": "admin:repo_hook", "parent": null, "children": [ "write:repo_hook", "read:repo_hook" ], "description": "Grants read, write, ping, and delete access to repository hooks in public, private, or internal repositories. The `repo` and `public_repo` scopes grant full access to repositories, including repository hooks. Use the `admin:repo_hook` scope to limit access to only repository hooks.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Webhooks: Write (repository).", "decidingPermissions": [ "repository_hooks:write" ], "permissions": [ { "permissionId": "repository_hooks:write", "source": "inferred", "from": "Grants read, write, ping, and delete access to repository hooks." }, { "permissionId": "repository_hooks:read", "source": "documented", "endpoints": 1, "from": "Through read:repo_hook" } ], "endpointCount": 2, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "admin-repo-hook" }, { "name": "write:repo_hook", "parent": "admin:repo_hook", "children": [], "description": "Grants read, write, and ping access to hooks in public, private, or internal repositories.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Webhooks: Write (repository).", "decidingPermissions": [ "repository_hooks:write" ], "permissions": [ { "permissionId": "repository_hooks:write", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "write-repo-hook" }, { "name": "read:repo_hook", "parent": "admin:repo_hook", "children": [], "description": "Grants read and ping access to hooks in public, private, or internal repositories.", "tier": 3, "plane": "management", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "repository_hooks:read" ], "permissions": [ { "permissionId": "repository_hooks:read", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-repo-hook" }, { "name": "admin:org", "parent": null, "children": [ "write:org", "read:org" ], "description": "Fully manage the organization and its teams, projects, and memberships.", "tier": 0, "plane": "control", "why": "Tier 0 because it reaches Administration: Write (organization), Members: Write (organization).", "decidingPermissions": [ "organization_administration:write", "members:write" ], "permissions": [ { "permissionId": "members:write", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_administration:write", "source": "documented", "endpoints": 24 }, { "permissionId": "organization_custom_org_roles:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_custom_roles:write", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_private_registries:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "organization_self_hosted_runners:write", "source": "documented", "endpoints": 17 }, { "permissionId": "codespaces_lifecycle_admin:write", "source": "documented", "endpoints": 1 }, { "permissionId": "codespaces:write", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_actions_variables:write", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_agent_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "organization_agent_variables:write", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_codespaces_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "organization_codespaces_settings:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_codespaces:write", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_copilot_agent_settings:write", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_copilot_spaces:write", "source": "documented", "endpoints": 3, "from": "Through write:org" }, { "permissionId": "organization_dependabot_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "codespaces:read", "source": "documented", "endpoints": 2 }, { "permissionId": "issue_fields:read", "source": "documented", "endpoints": 1, "from": "Through read:org" }, { "permissionId": "issue_fields:write", "source": "documented", "endpoints": 3 }, { "permissionId": "issue_types:read", "source": "documented", "endpoints": 1, "from": "Through read:org" }, { "permissionId": "issue_types:write", "source": "documented", "endpoints": 3 }, { "permissionId": "members:read", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_actions_variables:read", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_administration:read", "source": "documented", "endpoints": 16 }, { "permissionId": "organization_agent_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_agent_variables:read", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_codespaces_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_codespaces:read", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_copilot_agent_settings:read", "source": "documented", "endpoints": 2 }, { "permissionId": "organization_copilot_metrics:read", "source": "documented", "endpoints": 6, "from": "Through read:org" }, { "permissionId": "organization_copilot_seat_management:read", "source": "documented", "endpoints": 1, "from": "Through read:org" }, { "permissionId": "organization_copilot_seat_management:write", "source": "documented", "endpoints": 3, "from": "Through write:org" }, { "permissionId": "organization_copilot_spaces:read", "source": "documented", "endpoints": 4, "from": "Through read:org" }, { "permissionId": "organization_custom_org_roles:read", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_custom_roles:read", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_dependabot_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_private_registries:read", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_self_hosted_runners:read", "source": "documented", "endpoints": 10 } ], "endpointCount": 209, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "admin-org" }, { "name": "write:org", "parent": "admin:org", "children": [], "description": "Read and write access to organization membership and organization projects.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Administration: Write (organization) in part.", "decidingPermissions": [ "organization_administration:write" ], "permissions": [ { "permissionId": "organization_administration:write", "source": "inferred", "from": "Its documented Administration endpoints are code security configurations, secret scanning custom patterns and Dependabot access.", "partial": { "tier": 1, "why": "Only security configuration, but that is enough to switch secret scanning and push protection off across the organization." } }, { "permissionId": "organization_copilot_spaces:write", "source": "documented", "endpoints": 3 }, { "permissionId": "organization_administration:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_copilot_seat_management:write", "source": "documented", "endpoints": 3 } ], "endpointCount": 17, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "write-org" }, { "name": "read:org", "parent": "admin:org", "children": [], "description": "Read-only access to organization membership, organization projects, and team membership.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Copilot Spaces: Write (organization).", "decidingPermissions": [ "organization_copilot_spaces:write" ], "permissions": [ { "permissionId": "organization_copilot_spaces:write", "source": "documented", "endpoints": 2 }, { "permissionId": "issue_fields:read", "source": "documented", "endpoints": 1 }, { "permissionId": "issue_types:read", "source": "documented", "endpoints": 1 }, { "permissionId": "members:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_administration:read", "source": "documented", "endpoints": 10 }, { "permissionId": "organization_copilot_metrics:read", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_copilot_seat_management:read", "source": "documented", "endpoints": 1 }, { "permissionId": "organization_copilot_spaces:read", "source": "documented", "endpoints": 4 } ], "endpointCount": 26, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-org" }, { "name": "admin:public_key", "parent": null, "children": [ "write:public_key", "read:public_key" ], "description": "Fully manage public keys.", "tier": 1, "plane": "control", "why": "Tier 1 because it reaches Git SSH keys: Write (user).", "decidingPermissions": [ "keys:write" ], "permissions": [ { "permissionId": "keys:write", "source": "documented", "endpoints": 1 }, { "permissionId": "keys:read", "source": "documented", "endpoints": 2, "from": "Through read:public_key" } ], "endpointCount": 4, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "admin-public-key" }, { "name": "write:public_key", "parent": "admin:public_key", "children": [], "description": "Create, list, and view details for public keys.", "tier": 1, "plane": "control", "why": "Tier 1 because it reaches Git SSH keys: Write (user).", "decidingPermissions": [ "keys:write" ], "permissions": [ { "permissionId": "keys:write", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "write-public-key" }, { "name": "read:public_key", "parent": "admin:public_key", "children": [], "description": "List and view details for public keys.", "tier": 3, "plane": "control", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "keys:read" ], "permissions": [ { "permissionId": "keys:read", "source": "documented", "endpoints": 2 } ], "endpointCount": 2, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-public-key" }, { "name": "admin:org_hook", "parent": null, "children": [], "description": "Grants read, write, ping, and delete access to organization hooks. Note: OAuth tokens will only be able to perform these actions on organization hooks which were created by the OAuth app. Personal access tokens will only be able to perform these actions on organization hooks created by a user.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Webhooks: Write (organization).", "decidingPermissions": [ "organization_hooks:write" ], "permissions": [ { "permissionId": "organization_hooks:write", "source": "documented", "endpoints": 6 }, { "permissionId": "organization_hooks:read", "source": "documented", "endpoints": 5 } ], "endpointCount": 11, "note": "An OAuth App token only reaches hooks that OAuth App created; a classic PAT reaches all of them.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "admin-org-hook" }, { "name": "gist", "parent": null, "children": [], "description": "Grants write access to gists.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "gists:write" ], "permissions": [ { "permissionId": "gists:write", "source": "inferred", "from": "Grants write access to gists." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "gist" }, { "name": "notifications", "parent": null, "children": [], "description": "Grants: read access to a user's notifications mark as read access to threads watch and unwatch access to a repository, and read, write, and delete access to thread subscriptions.", "tier": 3, "plane": "data", "why": "It reaches no permission on the reference, so it gets the lowest tier.", "decidingPermissions": [], "permissions": [], "endpointCount": 0, "note": "Notifications and watching. No permission on the reference covers it.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "notifications" }, { "name": "user", "parent": null, "children": [ "read:user", "user:email", "user:follow" ], "description": "Grants read/write access to profile info only. Note that this scope includes `user:email` and `user:follow`.", "tier": 2, "plane": "control", "why": "Tier 2 because it reaches Email addresses: Write (user).", "decidingPermissions": [ "emails:write" ], "permissions": [ { "permissionId": "emails:write", "source": "documented", "endpoints": 2 }, { "permissionId": "emails:read", "source": "documented", "endpoints": 2, "from": "Through user:email" }, { "permissionId": "followers:write", "source": "documented", "endpoints": 2, "from": "Through user:follow" }, { "permissionId": "profile:write", "source": "documented", "endpoints": 2 } ], "endpointCount": 8, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "user" }, { "name": "read:user", "parent": "user", "children": [], "description": "Grants access to read a user's profile data.", "tier": 3, "plane": "data", "why": "It reaches no permission on the reference, so it gets the lowest tier.", "decidingPermissions": [], "permissions": [], "endpointCount": 0, "note": "Reads the user's profile. No permission on the reference covers it.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-user" }, { "name": "user:email", "parent": "user", "children": [], "description": "Grants read access to a user's email addresses.", "tier": 3, "plane": "control", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "emails:read" ], "permissions": [ { "permissionId": "emails:read", "source": "documented", "endpoints": 2 } ], "endpointCount": 2, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "user-email" }, { "name": "user:follow", "parent": "user", "children": [], "description": "Grants access to follow or unfollow other users.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "followers:write" ], "permissions": [ { "permissionId": "followers:write", "source": "documented", "endpoints": 2 } ], "endpointCount": 2, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "user-follow" }, { "name": "project", "parent": null, "children": [ "read:project" ], "description": "Grants read/write access to user and organization projects.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "organization_projects:read", "organization_projects:write" ], "permissions": [ { "permissionId": "organization_projects:read", "source": "inferred", "from": "Grants read only access to user and organization projects." }, { "permissionId": "organization_projects:write", "source": "inferred", "from": "Grants read/write access to user and organization projects." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu" ], "slug": "project" }, { "name": "read:project", "parent": "project", "children": [], "description": "Grants read only access to user and organization projects.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "organization_projects:read" ], "permissions": [ { "permissionId": "organization_projects:read", "source": "inferred", "from": "Grants read only access to user and organization projects." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu" ], "slug": "read-project" }, { "name": "delete_repo", "parent": null, "children": [], "description": "Grants access to delete adminable repositories.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Administration: Write (repository).", "decidingPermissions": [ "administration:write" ], "permissions": [ { "permissionId": "administration:write", "source": "inferred", "from": "Grants access to delete adminable repositories." } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "delete-repo" }, { "name": "write:packages", "parent": null, "children": [], "description": "Grants access to upload or publish a package in GitHub Packages. For more information, see Publishing a package.", "tier": 1, "plane": "data", "why": "Tier 1 because it reaches Packages: Write (repository).", "decidingPermissions": [ "packages:write" ], "permissions": [ { "permissionId": "packages:write", "source": "inferred", "from": "Grants access to upload or publish a package in GitHub Packages." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "write-packages" }, { "name": "read:packages", "parent": null, "children": [], "description": "Grants access to download or install packages from GitHub Packages. For more information, see Installing a package.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "packages:read" ], "permissions": [ { "permissionId": "packages:read", "source": "inferred", "from": "Grants access to download or install packages from GitHub Packages." } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-packages" }, { "name": "delete:packages", "parent": null, "children": [], "description": "Grants access to delete packages from GitHub Packages. For more information, see Deleting and restoring a package.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Packages: Write (repository) in part.", "decidingPermissions": [ "packages:write" ], "permissions": [ { "permissionId": "packages:write", "source": "inferred", "from": "Grants access to delete packages from GitHub Packages.", "partial": { "tier": 2, "why": "Deleting packages, not publishing them." } } ], "endpointCount": 0, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "delete-packages" }, { "name": "admin:gpg_key", "parent": null, "children": [ "write:gpg_key", "read:gpg_key" ], "description": "Fully manage GPG keys.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches GPG keys: Write (user).", "decidingPermissions": [ "gpg_keys:write" ], "permissions": [ { "permissionId": "gpg_keys:write", "source": "documented", "endpoints": 1 }, { "permissionId": "gpg_keys:read", "source": "documented", "endpoints": 2, "from": "Through read:gpg_key" } ], "endpointCount": 4, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "admin-gpg-key" }, { "name": "write:gpg_key", "parent": "admin:gpg_key", "children": [], "description": "Create, list, and view details for GPG keys.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches GPG keys: Write (user).", "decidingPermissions": [ "gpg_keys:write" ], "permissions": [ { "permissionId": "gpg_keys:write", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "write-gpg-key" }, { "name": "read:gpg_key", "parent": "admin:gpg_key", "children": [], "description": "List and view details for GPG keys.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "gpg_keys:read" ], "permissions": [ { "permissionId": "gpg_keys:read", "source": "documented", "endpoints": 2 } ], "endpointCount": 2, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-gpg-key" }, { "name": "codespace", "parent": null, "children": [], "description": "Grants the ability to create and manage codespaces. Codespaces can expose a GITHUB_TOKEN which may have a different set of scopes. For more information, see Security in GitHub Codespaces.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Codespaces: Write (repository), Codespaces user secrets: Write (user), Codespaces lifecycle admin: Write (repository).", "decidingPermissions": [ "codespaces:write", "codespaces_user_secrets:write", "codespaces_lifecycle_admin:write" ], "permissions": [ { "permissionId": "codespaces_lifecycle_admin:write", "source": "documented", "endpoints": 3 }, { "permissionId": "codespaces_user_secrets:write", "source": "documented", "endpoints": 5 }, { "permissionId": "codespaces:write", "source": "documented", "endpoints": 8 }, { "permissionId": "codespaces_lifecycle_admin:read", "source": "documented", "endpoints": 1 }, { "permissionId": "codespaces_metadata:read", "source": "documented", "endpoints": 3 }, { "permissionId": "codespaces_user_secrets:read", "source": "documented", "endpoints": 4 }, { "permissionId": "codespaces:read", "source": "documented", "endpoints": 3 } ], "endpointCount": 27, "setups": [ "free", "team", "enterprise-cloud", "emu" ], "slug": "codespace" }, { "name": "workflow", "parent": null, "children": [], "description": "Grants the ability to add and update GitHub Actions workflow files. Workflow files can be committed without this scope if the same file (with both the same path and contents) exists on another branch in the same repository. Workflow files can expose `GITHUB_TOKEN` which may have a different set of scopes. For more information, see Use GITHUB_TOKEN for authentication in workflows.", "tier": 1, "plane": "data", "why": "Tier 1 because it reaches Workflows: Write (repository).", "decidingPermissions": [ "workflows:write" ], "permissions": [ { "permissionId": "workflows:write", "source": "documented", "endpoints": 2 }, { "permissionId": "contents:write", "source": "documented", "endpoints": 2 } ], "endpointCount": 2, "note": "Without it, a classic token cannot push changes under .github/workflows. With it, the holder can change what workflows run and reach their secrets.", "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "workflow" }, { "name": "admin:enterprise", "parent": null, "children": [ "manage_runners:enterprise", "manage_billing:enterprise", "read:enterprise" ], "description": "Gives full control of enterprise functionality. For more information, see Managing enterprise accounts in the GraphQL API documentation. Includes `manage_runners:enterprise`, `manage_billing:enterprise`, and `read:enterprise`.", "tier": 0, "plane": "control", "why": "Tier 0 because it reaches Custom enterprise roles: Write (enterprise).", "decidingPermissions": [ "enterprise_custom_enterprise_roles:write" ], "permissions": [ { "permissionId": "enterprise_custom_enterprise_roles:write", "source": "documented", "endpoints": 6 }, { "permissionId": "enterprise_credentials:write", "source": "documented", "endpoints": 4 }, { "permissionId": "organization_self_hosted_runners:write", "source": "inferred", "from": "Manages self-hosted runners at the enterprise level." }, { "permissionId": "enterprise_ai_controls:write", "source": "documented", "endpoints": 2 }, { "permissionId": "enterprise_billing:write", "source": "inferred", "from": "Manages enterprise billing." }, { "permissionId": "enterprise_ai_controls:read", "source": "documented", "endpoints": 2 }, { "permissionId": "enterprise_copilot_usage:read", "source": "documented", "endpoints": 1, "from": "Through read:enterprise" } ], "endpointCount": 15, "setups": [ "enterprise-cloud", "emu", "ghes" ], "slug": "admin-enterprise" }, { "name": "manage_runners:enterprise", "parent": "admin:enterprise", "children": [], "description": "Gives full control over self-hosted runners within the enterprise. For more information, see Self-hosted runners.", "tier": 1, "plane": "management", "why": "Tier 1 because it reaches Self-hosted runners: Write (organization).", "decidingPermissions": [ "organization_self_hosted_runners:write" ], "permissions": [ { "permissionId": "organization_self_hosted_runners:write", "source": "inferred", "from": "Manages self-hosted runners at the enterprise level." } ], "endpointCount": 0, "setups": [ "enterprise-cloud", "emu", "ghes" ], "slug": "manage-runners-enterprise" }, { "name": "manage_billing:enterprise", "parent": "admin:enterprise", "children": [], "description": "Read and write enterprise billing data. For more information, see REST API endpoints for billing.", "tier": 2, "plane": "data", "why": "Tier 2 because it reaches Enterprise billing: Write (enterprise).", "decidingPermissions": [ "enterprise_billing:write" ], "permissions": [ { "permissionId": "enterprise_billing:write", "source": "inferred", "from": "Manages enterprise billing." } ], "endpointCount": 0, "setups": [ "enterprise-cloud", "emu", "ghes" ], "slug": "manage-billing-enterprise" }, { "name": "read:enterprise", "parent": "admin:enterprise", "children": [], "description": "Read all data on an enterprise profile. Does not include profile data of enterprise members or organizations.", "tier": 3, "plane": "data", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "enterprise_copilot_usage:read" ], "permissions": [ { "permissionId": "enterprise_copilot_usage:read", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "enterprise-cloud", "emu", "ghes" ], "slug": "read-enterprise" }, { "name": "read:audit_log", "parent": null, "children": [], "description": "Read audit log data.", "tier": 3, "plane": "management", "why": "Tier 3 because nothing it reaches goes beyond Tier 3.", "decidingPermissions": [ "organization_administration:read" ], "permissions": [ { "permissionId": "organization_administration:read", "source": "documented", "endpoints": 1 } ], "endpointCount": 1, "setups": [ "free", "team", "enterprise-cloud", "emu", "ghes" ], "slug": "read-audit-log" }, { "name": "offline_access", "parent": null, "children": [], "description": "Requests an expiring access token and a refresh token, even if your OAuth app is not configured to use expiring tokens. Use this scope to test and gradually roll out support for expiring tokens. For more information, see Authorizing OAuth apps.", "tier": 3, "plane": "data", "why": "It reaches no permission on the reference, so it gets the lowest tier.", "decidingPermissions": [], "permissions": [], "endpointCount": 0, "note": "Asks for an expiring token with a refresh token. Grants nothing by itself.", "setups": [ "free", "team", "enterprise-cloud", "emu" ], "slug": "offline-access" }, { "name": "site_admin", "parent": null, "children": [], "description": "Grants site administrators access to GitHub Enterprise Server Administration API endpoints.", "tier": 0, "plane": "control", "why": "Grants site administrator API access on the Enterprise Server instance: users, organizations and repositories across it. That is above every organization and enterprise role (see the Site administrator role).", "decidingPermissions": [], "permissions": [], "endpointCount": 0, "note": "Only on Enterprise Server. Its REST endpoints are not on the Enterprise Cloud pages ghtier reads, so it shows no reach here.", "setups": [ "ghes" ], "slug": "site-admin" } ], "tokenTypes": [ { "id": "classic-pat", "name": "Classic personal access token", "carries": "scopes", "model": "classic-pat-scope", "summary": "A token the user creates with classic scopes. It works in every organization the user belongs to.", "decidedBy": "Its scopes, and the roles of the user who owns it. repo on an organization owner's token reaches Tier 0.", "tip": "Disable classic PATs for the organization where you can, and set a maximum lifetime where you cannot.", "upToTier": 0, "credentialModel": { "vocabulary": "oauth-scope", "principal": "Human", "boundary": "Every organization the user belongs to; SAML SSO orgs also need the token authorized", "lifetime": "Expiry optional; an enterprise or org can set a maximum", "grantedBy": "The user, for themselves" } }, { "id": "oauth-app-token", "name": "OAuth App token", "carries": "scopes", "model": "oauth-app-scope", "summary": "A token an OAuth App holds after a user approves it. Uses the same scopes as a classic PAT and usually does not expire.", "decidedBy": "The scopes on the consent screen, and the roles of the user who approved it.", "tip": "Turn on OAuth App access restrictions so organization data needs an owner's approval.", "upToTier": 0, "credentialModel": { "vocabulary": "oauth-scope", "principal": "Human, through an app", "boundary": "Every organization the user grants it, unless the org restricts OAuth app access", "lifetime": "Usually no expiry; lives until revoked", "grantedBy": "The user, on a consent screen" } }, { "id": "fine-grained-pat", "name": "Fine-grained personal access token", "carries": "permissions", "availability": "fine-grained-pat", "model": "fine-grained-pat-permission", "summary": "A token for one owner (a user or an organization) and chosen repositories, with permissions from the Permissions tab. Expiry is required.", "decidedBy": "The permissions picked when it was created, limited by the user's own access.", "tip": "Require approval for fine-grained PATs and keep the maximum lifetime short.", "upToTier": 0, "credentialModel": { "vocabulary": "resource-permission", "principal": "Human", "boundary": "One resource owner (a user or an org) and the repositories picked for the token", "lifetime": "Expiry required; 366 days by default, an enterprise or org can lower it", "grantedBy": "The user, plus org approval when the org requires it" } }, { "id": "app-installation-token", "name": "GitHub App installation token", "carries": "permissions", "availability": "github-app", "model": "app-token", "summary": "A 1-hour token an App mints with its private key. It has the App's permissions on the installation's repositories, with no user behind it.", "decidedBy": "The App's permissions and which repositories it is installed on. Whoever holds the private key can mint new ones.", "tip": "Review installed Apps' permissions and install on selected repositories only.", "upToTier": 0, "credentialModel": { "vocabulary": "resource-permission", "principal": "App, or App acting for a user", "boundary": "The App's permissions, cut down to the installation's repositories (and the user's own access for user tokens)", "lifetime": "1 hour for installation tokens; 8 hours for user tokens, with a 6-month refresh token", "grantedBy": "Minted by the App with its private key, or by a user signing in to the App" } }, { "id": "app-user-token", "name": "GitHub App user access token", "carries": "permissions", "availability": "github-app", "model": "app-token", "summary": "A token an App holds when a user signs in to it. Capped by both the App's permissions and the user's own access. 8 hours, refreshable for 6 months.", "decidedBy": "The lower of the App's permissions and the user's role.", "tip": "Treat the refresh token as the long-lived secret it is.", "upToTier": 0, "credentialModel": { "vocabulary": "resource-permission", "principal": "App, or App acting for a user", "boundary": "The App's permissions, cut down to the installation's repositories (and the user's own access for user tokens)", "lifetime": "1 hour for installation tokens; 8 hours for user tokens, with a 6-month refresh token", "grantedBy": "Minted by the App with its private key, or by a user signing in to the App" } }, { "id": "github-token", "name": "GITHUB_TOKEN", "carries": "permissions", "availability": "github-token", "model": "actions-token-permission", "summary": "The token every workflow job gets for its own repository, valid for the job. Its permissions come from the workflow's permissions block or the repository default.", "decidedBy": "The permissions block in the workflow, falling back to the organization or repository default.", "tip": "Set the default to read-only and grant write per job.", "upToTier": 1, "credentialModel": { "vocabulary": "resource-permission", "principal": "Workflow run", "boundary": "The one repository the workflow runs in", "lifetime": "The job's duration", "grantedBy": "The workflow file's permissions block, falling back to the org or repo default" } } ] }