← All permissions
Organization permission·organization_custom_roles:write
Custom repository roles: Write
Tier 1 · High
Why Tier 1
Creates and edits custom repository roles. Editing an assigned role widens access for everyone who has it.
Control plane permissions start at Tier 0. This one is lowered for the reason above.
- Target
- Organization
- Plane
- ControlRoles: Custom organization, repository and enterprise roles.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Enterprise Cloud, EMU, Server
What it unlocks
6 REST endpoints need this permission. A few of them:
- POST /orgs/{org}/custom-repository-roles
- PATCH /orgs/{org}/custom-repository-roles/{role_id}
- DELETE /orgs/{org}/custom-repository-roles/{role_id}
- POST /orgs/{org}/custom_roles
Roles that include it
- T0OwnerThe organization and every repository in it
Classic scopes that reach it
- T0admin:orgdocumented
Attack paths
No attack technique, escalation or incident on ghtier goes through this yet.
Other levels
GitHub Docs: Organization permissions for "Custom repository roles"