← All permissions
Enterprise permission·enterprise_custom_enterprise_roles:write
Custom enterprise roles: Write
Tier 0 · Critical
Why Tier 0
Creates enterprise roles and assigns them to teams, so it can hand out enterprise-level admin powers.
- Target
- Enterprise
- Plane
- ControlRoles: Custom organization, repository and enterprise roles.
- Granted by
- GitHub App
- Available on
- Enterprise Cloud, EMU
What it unlocks
6 REST endpoints need this permission. A few of them:
- DELETE /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}
- PUT /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}/{role_id}
- DELETE /enterprises/{enterprise}/enterprise-roles/teams/{team_slug}/{role_id}
- DELETE /enterprises/{enterprise}/enterprise-roles/users/{username}
Roles that include it
- T0Enterprise ownerEvery organization in the enterprise
Classic scopes that reach it
- T0admin:enterprisedocumented
Attack paths
No attack technique, escalation or incident on ghtier goes through this yet.
Other levels
GitHub Docs: Enterprise permissions for "Custom enterprise roles"