ghtier
← All permissions
Organization permission·members:write

Members: Write

Tier 0 · Critical

Why Tier 0

Sets organization membership, including the owner role, invites people, manages teams and assigns organization roles. This is who controls the organization.

Target
Organization
Plane
ControlIdentity: Members, teams, SCIM provisioning and the credentials attached to an account.
Granted by
Fine-grained PAT, GitHub App
Available on
Every setup

What it unlocks

41 REST endpoints need this permission. A few of them:

  • POST /orgs/{org}/invitations
  • DELETE /orgs/{org}/invitations/{invitation_id}
  • DELETE /orgs/{org}/members/{username}
  • PUT /orgs/{org}/memberships/{username}

Roles that include it

  • T0OwnerThe organization and every repository in it
  • T1Security managerThe organization and every repository in it(in part: Creates a team. Giving it repository access needs a repository admin.)
  • T1App managerGitHub Apps owned by the organization(in part: Creates a team. Giving it repository access needs a repository admin.)
  • T1Team maintainerOne team and the repositories it has(in part: Only for their own team, but anyone they add gets every repository role the team holds. On a team with Admin on production repositories, that is a path to those repositories.)
  • T2MemberThe organization(in part: Creates a team. Giving it repository access needs a repository admin.)
  • T2ModeratorThe organization's public spaces(in part: Creates a team. Giving it repository access needs a repository admin.)

Classic scopes that reach it

Attack paths

Techniques it enables

Escalations it starts

Reached through

Other levels

GitHub Docs: Organization permissions for "Members"