Permission Reference
The building blocks: one resource at one access level, each with its own tier.
190 entries
Setup
Level
Plane
Target
Granted by
The access level. read: view only. write: create, change and delete. admin: define the thing itself (only custom properties have it). | The resource the permission covers, as GitHub names it, e.g. Contents, Secrets, Members. | Where it applies. repository: the repositories a token or App is given. organization and enterprise: the whole account. user: the user's own account. | One scale for every permission.T0: Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.T1: Management/pipeline plane. Control over deployments, CI/CD, or secrets.T2: User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.T3: Low impact. Reading, or changes that touch no access, code, credentials or availability.* context-dependent: the target decides the real tier. | control: identity and administration. management: settings, policies and pipelines. data: code, runs, secrets and content. | Granted by PAT: fine-grained personal access token. App: GitHub App. TOKEN: a workflow's GITHUB_TOKEN. | How many attack techniques and escalations on the Attack Paths page go through this permission. Open the permission to see them. | How many REST API endpoints need this permission. Expand a row to see some of them. | |
|---|---|---|---|---|---|---|---|---|
| write | Custom enterprise roles | enterprise | T0 | control | App | – | 6 | ↗▼ |
| write | Enterprise SCIM | enterprise | T0 | control | App | – | 8 | ↗▼ |
| write | Enterprise teams | enterprise | T0* | control | App | – | 11 | ↗▼ |
| write | Administration | organization | T0 | management | PAT App | 3 paths | 71 | ↗▼ |
| write | Members | organization | T0 | control | PAT App | 2 paths | 41 | ↗▼ |
| write | Custom properties | enterprise | T1* | management | App | – | 4 | ↗▼ |
| write | Enterprise credentials | enterprise | T1 | management | App | – | 6 | ↗▼ |
| admin | Enterprise custom properties for organizations | enterprise | T1* | management | App | – | 3 | ↗▼ |
| write | Enterprise custom properties for organizations | enterprise | T1* | management | App | – | 1 | ↗▼ |
| write | Enterprise organization installation repositories | enterprise | T1 | management | App | – | 3 | ↗▼ |
| write | Enterprise organization installations | enterprise | T1 | management | App | – | 5 | ↗▼ |
| write | Custom organization roles | organization | T1* | control | PAT App | – | 3 | ↗▼ |
| admin | Custom properties | organization | T1* | management | PAT App | – | 3 | ↗▼ |
| write | Custom properties | organization | T1* | management | PAT App | – | 1 | ↗▼ |
| write | Custom repository roles | organization | T1 | control | PAT App | – | 6 | ↗▼ |
| write | Network configurations | organization | T1 | management | PAT App | – | 3 | ↗▼ |
| write | Organization private registries | organization | T1 | data | PAT App | – | 3 | ↗▼ |
| write | Personal access token requests | organization | T1 | management | App | – | 2 | ↗▼ |
| write | Secrets | organization | T1 | data | PAT App | – | 5 | ↗▼ |
| write | Self-hosted runners | organization | T1 | management | PAT App | 2 paths | 17 | ↗▼ |
| write | Webhooks | organization | T1 | management | PAT App | – | 6 | ↗▼ |
| write | Actions | repository | T1 | data | PAT App TOKEN | 3 paths | 15 | ↗▼ |
| write | Administration | repository | T1 | management | PAT App | 9 paths | 107 | ↗▼ |
| write | Custom properties | repository | T1* | management | PAT App | – | 1 | ↗▼ |
| write | Environments | repository | T1 | data | PAT App | – | 5 | ↗▼ |
| write | GitHub App installation repository access | repository | T1 | management | PAT App | 1 path | 2 | ↗▼ |
| write | OIDC ID token | repository | T1* | data | TOKEN | 1 path | – | ↗▼ |
| write | Packages | repository | T1* | data | TOKEN | 1 path | – | ↗▼ |
| read | Secret scanning alerts | repository | T1 | data | PAT App | 1 path | 18 | ↗▼ |
| write | Secrets | repository | T1 | data | PAT App | – | 2 | ↗▼ |
| write | Webhooks | repository | T1 | management | PAT App | – | 5 | ↗▼ |
| write | Workflows | repository | T1 | data | PAT App | 4 paths | 6 | ↗▼ |
| write | Git SSH keys | user | T1 | control | PAT App | – | 2 | ↗▼ |
| write | Enterprise AI controls | enterprise | T2 | management | App | – | 3 | ↗▼ |
| write | Enterprise billing | enterprise | T2 | data | App | – | 8 | ↗▼ |
| write | Enterprise Licensing | enterprise | T2 | data | App | – | 2 | ↗▼ |
| write | Agent secrets | organization | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Agent variables | organization | T2 | data | PAT App | – | 6 | ↗▼ |
| write | Copilot agent settings | organization | T2 | data | PAT App | – | 4 | ↗▼ |
| write | Copilot content exclusion | organization | T2 | management | PAT App | – | 1 | ↗▼ |
| write | Copilot Spaces | organization | T2 | data | PAT App | – | 6 | ↗▼ |
| write | Custom properties for organizations | organization | T2* | management | PAT App | – | 1 | ↗▼ |
| admin | External custom properties for repositories | organization | T2* | management | PAT App | – | 2 | ↗▼ |
| write | External custom properties for repositories | organization | T2* | management | PAT App | – | 3 | ↗▼ |
| write | Hosted runner custom images | organization | T2 | management | PAT App | – | 2 | ↗▼ |
| write | Organization bypass requests for secret scanning | organization | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Organization codespaces | organization | T2 | data | PAT App | – | 2 | ↗▼ |
| write | Organization codespaces secrets | organization | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Organization codespaces settings | organization | T2 | management | PAT App | – | 3 | ↗▼ |
| write | Organization dependabot secrets | organization | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Organization dismissal requests for code scanning | organization | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Organization dismissal requests for Dependabot | organization | T2 | data | PAT App | – | 2 | ↗▼ |
| write | Personal access tokens | organization | T2 | management | App | – | 2 | ↗▼ |
| write | Secret scanning alert dismissal requests | organization | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Variables | organization | T2* | data | PAT App | – | 6 | ↗▼ |
| write | Agent secrets | repository | T2 | data | PAT App | – | 2 | ↗▼ |
| write | Agent variables | repository | T2 | data | PAT App | – | 3 | ↗▼ |
| write | Artifact metadata | repository | T2 | data | PAT App TOKEN | – | 4 | ↗▼ |
| write | Attestations | repository | T2 | data | PAT App TOKEN | – | 7 | ↗▼ |
| write | Checks | repository | T2 | data | App TOKEN | – | 6 | ↗▼ |
| write | Code scanning alerts | repository | T2 | data | PAT App TOKEN | – | 4 | ↗▼ |
| write | Codespaces | repository | T2 | data | PAT App | – | 9 | ↗▼ |
| write | Codespaces lifecycle admin | repository | T2 | data | PAT App | – | 4 | ↗▼ |
| write | Codespaces secrets | repository | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Commit statuses | repository | T2 | data | PAT App TOKEN | – | 1 | ↗▼ |
| write | Contents | repository | T2* | data | PAT App TOKEN | 14 paths | 46 | ↗▼ |
| write | Dependabot alerts | repository | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Dependabot secrets | repository | T2 | data | PAT App | – | 2 | ↗▼ |
| write | Deployments | repository | T2* | data | PAT App TOKEN | – | 5 | ↗▼ |
| write | Discussions | repository | T2 | data | TOKEN | – | – | ↗▼ |
| write | Issues | repository | T2 | data | PAT App TOKEN | 1 path | 37 | ↗▼ |
| write | Pages | repository | T2* | data | PAT App TOKEN | – | 7 | ↗▼ |
| write | Pull requests | repository | T2 | data | PAT App TOKEN | 6 paths | 43 | ↗▼ |
| write | Repository creation | repository | T2 | data | PAT App | – | 4 | ↗▼ |
| write | Repository security advisories | repository | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Secret scanning alert dismissal requests | repository | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Secret scanning alerts | repository | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Secret scanning push protection bypass requests | repository | T2 | data | PAT App | – | 1 | ↗▼ |
| write | Variables | repository | T2* | data | PAT App | – | 3 | ↗▼ |
| write | Codespaces user secrets | user | T2 | data | PAT App | – | 5 | ↗▼ |
| write | Email addresses | user | T2 | control | PAT App | – | 3 | ↗▼ |
| write | GPG keys | user | T2 | data | PAT App | – | 2 | ↗▼ |
| write | SSH signing keys | user | T2 | data | PAT App | – | 2 | ↗▼ |
| read | Copilot usage records | enterprise | T3 | data | App | – | 1 | ↗▼ |
| read | Custom enterprise roles | enterprise | T3 | control | App | – | 4 | ↗▼ |
| read | Custom properties | enterprise | T3 | management | App | – | 2 | ↗▼ |
| read | Enterprise AI controls | enterprise | T3 | management | App | – | 3 | ↗▼ |
| read | Enterprise billing | enterprise | T3 | data | App | – | 12 | ↗▼ |
| read | Enterprise Copilot metrics | enterprise | T3 | data | App | – | 6 | ↗▼ |
| read | Enterprise credentials | enterprise | T3 | management | App | – | 4 | ↗▼ |
| read | Enterprise custom properties for organizations | enterprise | T3 | management | App | – | 3 | ↗▼ |
| write | Enterprise innersource vulnerabilities | enterprise | T3 | data | App | – | 2 | ↗▼ |
| read | Enterprise Licensing | enterprise | T3 | data | App | – | 1 | ↗▼ |
| read | Enterprise organization installation repositories | enterprise | T3 | management | App | – | 2 | ↗▼ |
| read | Enterprise organization installations | enterprise | T3 | management | App | – | 4 | ↗▼ |
| read | Enterprise SCIM | enterprise | T3 | control | App | – | 4 | ↗▼ |
| read | Enterprise teams | enterprise | T3 | control | App | – | 7 | ↗▼ |
| read | Administration | organization | T3 | management | PAT App | – | 48 | ↗▼ |
| read | Agent secrets | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Agent variables | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | API Insights | organization | T3 | data | PAT App | – | 9 | ↗▼ |
| write | Blocking users | organization | T3 | management | PAT App | – | 2 | ↗▼ |
| read | Blocking users | organization | T3 | management | PAT App | – | 2 | ↗▼ |
| write | Campaigns | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Campaigns | organization | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Copilot agent settings | organization | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Copilot content exclusion | organization | T3 | management | PAT App | – | 1 | ↗▼ |
| read | Copilot Spaces | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Custom organization roles | organization | T3 | control | PAT App | – | 3 | ↗▼ |
| read | Custom properties | organization | T3 | management | PAT App | – | 3 | ↗▼ |
| read | Custom properties for organizations | organization | T3 | management | PAT App | – | 1 | ↗▼ |
| read | Custom repository roles | organization | T3 | control | PAT App | – | 6 | ↗▼ |
| read | Events | organization | T3 | data | PAT App | – | 1 | ↗▼ |
| read | External custom properties for repositories | organization | T3 | management | PAT App | – | 1 | ↗▼ |
| write | GitHub Copilot Business | organization | T3 | data | PAT App | – | 7 | ↗▼ |
| read | GitHub Copilot Business | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Hosted runner custom images | organization | T3 | management | PAT App | – | 4 | ↗▼ |
| write | Issue Fields | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Issue Fields | organization | T3 | data | PAT App | – | 1 | ↗▼ |
| write | Issue Types | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Issue Types | organization | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Members | organization | T3 | control | PAT App | – | 34 | ↗▼ |
| read | Network configurations | organization | T3 | management | PAT App | – | 3 | ↗▼ |
| write | Organization announcement banners | organization | T3 | management | PAT App | – | 2 | ↗▼ |
| read | Organization announcement banners | organization | T3 | management | PAT App | – | 1 | ↗▼ |
| read | Organization bypass requests for secret scanning | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Organization codespaces | organization | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Organization codespaces secrets | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Organization Copilot metrics | organization | T3 | data | PAT App | – | 6 | ↗▼ |
| read | Organization dependabot secrets | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Organization dismissal requests for code scanning | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Organization dismissal requests for Dependabot | organization | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Organization private registries | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Personal access token requests | organization | T3 | management | App | – | 2 | ↗▼ |
| read | Personal access tokens | organization | T3 | management | App | – | 2 | ↗▼ |
| write | Projects | organization | T3 | data | PAT App | – | 6 | ↗▼ |
| read | Projects | organization | T3 | data | PAT App | – | 7 | ↗▼ |
| read | Secret scanning alert dismissal requests | organization | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Secrets | organization | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Self-hosted runners | organization | T3 | management | PAT App | – | 10 | ↗▼ |
| read | Variables | organization | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Webhooks | organization | T3 | management | PAT App | – | 5 | ↗▼ |
| read | Actions | repository | T3 | data | PAT App TOKEN | – | 34 | ↗▼ |
| read | Administration | repository | T3 | management | PAT App | – | 43 | ↗▼ |
| read | Agent secrets | repository | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Agent variables | repository | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Artifact metadata | repository | T3 | data | PAT App TOKEN | – | 3 | ↗▼ |
| read | Attestations | repository | T3 | data | PAT App TOKEN | – | 2 | ↗▼ |
| read | Checks | repository | T3 | data | App TOKEN | – | 6 | ↗▼ |
| read | Code quality | repository | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Code scanning alerts | repository | T3 | data | PAT App TOKEN | – | 12 | ↗▼ |
| read | Codespaces | repository | T3 | data | PAT App | – | 5 | ↗▼ |
| read | Codespaces lifecycle admin | repository | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Codespaces metadata | repository | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Commit statuses | repository | T3 | data | PAT App TOKEN | – | 2 | ↗▼ |
| read | Contents | repository | T3 | data | PAT App TOKEN | 2 paths | 49 | ↗▼ |
| read | Copilot agent settings | repository | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Dependabot alerts | repository | T3 | data | PAT App | – | 8 | ↗▼ |
| read | Dependabot secrets | repository | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Deployments | repository | T3 | data | PAT App TOKEN | – | 4 | ↗▼ |
| read | Discussions | repository | T3 | data | TOKEN | – | – | ↗▼ |
| read | Environments | repository | T3 | data | PAT App | – | 5 | ↗▼ |
| read | Issues | repository | T3 | data | PAT App TOKEN | – | 27 | ↗▼ |
| read | Metadata | repository | T3 | data | PAT App | – | 35 | ↗▼ |
| read | Packages | repository | T3 | data | TOKEN | – | – | ↗▼ |
| read | Pages | repository | T3 | data | PAT App TOKEN | – | 5 | ↗▼ |
| read | Pull requests | repository | T3 | data | PAT App TOKEN | – | 32 | ↗▼ |
| read | Repository security advisories | repository | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Secret scanning alert dismissal requests | repository | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Secret scanning push protection bypass requests | repository | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Secrets | repository | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Variables | repository | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Webhooks | repository | T3 | management | PAT App | – | 7 | ↗▼ |
| write | Block another user | user | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Block another user | user | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Codespaces user secrets | user | T3 | data | PAT App | – | 4 | ↗▼ |
| read | Email addresses | user | T3 | control | PAT App | – | 2 | ↗▼ |
| write | Followers | user | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Followers | user | T3 | data | PAT App | – | 3 | ↗▼ |
| write | Gists | user | T3 | data | PAT App | – | 9 | ↗▼ |
| read | Git SSH keys | user | T3 | control | PAT App | – | 3 | ↗▼ |
| read | GPG keys | user | T3 | data | PAT App | – | 2 | ↗▼ |
| write | Interaction limits | user | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Interaction limits | user | T3 | data | PAT App | – | 1 | ↗▼ |
| read | Private repository invitations | user | T3 | data | PAT App | – | 1 | ↗▼ |
| write | Profile | user | T3 | data | PAT App | – | 3 | ↗▼ |
| read | SSH signing keys | user | T3 | data | PAT App | – | 2 | ↗▼ |
| write | Starring | user | T3 | data | PAT App | – | 2 | ↗▼ |
| read | Starring | user | T3 | data | PAT App | – | 3 | ↗▼ |
| read | Watching | user | T3 | data | PAT App | – | 2 | ↗▼ |
Permission list generated from GitHub's docs data on 2026-10-11. Tiers and reasons are ghtier's own.