← All permissions
Organization permission·organization_secrets:read
Secrets: Read
Tier 3 · Low
Why Tier 3
Lists organization Actions secret names and which repositories can use them. Values are never returned.
Data plane permissions start at Tier 2. This one is lowered for the reason above.
- Target
- Organization
- Plane
- DataSecrets: Actions, environment, Dependabot, Codespaces and agent secrets, private registries and OIDC.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Every setup
What it unlocks
4 REST endpoints need this permission. A few of them:
- GET /orgs/{org}/actions/secrets
- GET /orgs/{org}/actions/secrets/public-key
- GET /orgs/{org}/actions/secrets/{secret_name}
- GET /orgs/{org}/actions/secrets/{secret_name}/repositories
Roles that include it
No built-in role includes it. Only tokens, Apps or custom roles can grant it.
Classic scopes that reach it
Attack paths
No attack technique, escalation or incident on ghtier goes through this yet.