ghtier
← All scopes
Classic scope

repo

Tier 0 · CriticalManagement

Why Tier 0

Tier 0 because it reaches Administration: Write (organization).

Reaches every repository the user can access, in every organization they belong to; admin endpoints only work where the user is an admin. For an organization owner it reaches much further: GitHub documents repo as enough for PATCH /orgs/{org} (organization settings, including the base repository permission), organization secrets and runner registration. That is why repo is Tier 0 even though most of what it covers is repository-level.

GitHub: Grants full access to public, internal, and private repositories including read and write access to code, commit statuses, repository invitations, collaborators, deployment statuses, and repository webhooks. Note: In addition to repository related resources, the `repo` scope also grants access to manage organization-owned resources including projects, invitations, team memberships and webhooks. This scope also grants the ability to manage projects owned by users.

Available on: Every setup. Source

Includes repo:status, repo_deployment, public_repo, repo:invite, security_events.

Permissions it reaches (64)

TierPermissionEvidence
T0sets tierAdministration: Writeorganization1 documented endpoint
  • PATCH /orgs/{org}
T1Actions: Writerepository15 documented endpoints
  • DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}
  • DELETE /repos/{owner}/{repo}/actions/caches
  • DELETE /repos/{owner}/{repo}/actions/caches/{cache_id}
T1Administration: Writerepository37 documented endpoints
  • DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}
  • DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels
  • DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels/{name}
T1Environments: Writerepository5 documented endpoints
  • DELETE /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}
  • DELETE /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
  • PATCH /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
T1Secrets: Writeorganization3 documented endpoints
  • DELETE /orgs/{org}/actions/secrets/{secret_name}
  • PUT /orgs/{org}/actions/secrets/{secret_name}
  • PUT /orgs/{org}/actions/secrets/{secret_name}/repositories/{repository_id}
T1Self-hosted runners: Writeorganization4 documented endpoints
  • DELETE /orgs/{org}/actions/runners/{runner_id}
  • POST /orgs/{org}/actions/runners/generate-jitconfig
  • POST /orgs/{org}/actions/runners/registration-token
T1Webhooks: Writerepository1 documented endpoint
  • PATCH /repos/{owner}/{repo}/hooks/{hook_id}/config
T1Secret scanning alerts: Readrepository5 documented endpoints
  • GET /orgs/{org}/secret-scanning/alerts
  • GET /repos/{owner}/{repo}/secret-scanning/alerts
  • GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
T1Secrets: Writerepository2 documented endpoints
  • DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name}
  • PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}
T1Workflows: Writerepository1 documented endpoint
  • PUT /repos/{owner}/{repo}/contents/{path}
T2Variables: Writerepository3 documented endpoints
  • DELETE /repos/{owner}/{repo}/actions/variables/{name}
  • PATCH /repos/{owner}/{repo}/actions/variables/{name}
  • POST /repos/{owner}/{repo}/actions/variables
T2Agent secrets: Writerepository2 documented endpoints
  • DELETE /repos/{owner}/{repo}/agents/secrets/{secret_name}
  • PUT /repos/{owner}/{repo}/agents/secrets/{secret_name}
T2Agent variables: Writerepository3 documented endpoints
  • DELETE /repos/{owner}/{repo}/agents/variables/{name}
  • PATCH /repos/{owner}/{repo}/agents/variables/{name}
  • POST /repos/{owner}/{repo}/agents/variables
T2Codespaces secrets: Writerepository5 documented endpoints
  • DELETE /repos/{owner}/{repo}/codespaces/secrets/{secret_name}
  • GET /repos/{owner}/{repo}/codespaces/secrets
  • GET /repos/{owner}/{repo}/codespaces/secrets/public-key
T2Contents: Writerepository7 documented endpoints
  • DELETE /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}
  • POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix/commits
  • POST /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses
T2Dependabot secrets: Writerepository2 documented endpoints
  • DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name}
  • PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name}
T2Deployments: Writerepository4 documented endpoints
  • DELETE /repos/{owner}/{repo}/deployments/{deployment_id}
  • POST /repos/{owner}/{repo}/actions/runs/{run_id}/deployment_protection_rule
  • POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments
T2Variables: Writeorganization3 documented endpoints
  • DELETE /orgs/{org}/actions/variables/{name}
  • POST /orgs/{org}/actions/variables
  • PUT /orgs/{org}/actions/variables/{name}/repositories/{repository_id}
T2Agent secrets: Writeorganization3 documented endpoints
  • DELETE /orgs/{org}/agents/secrets/{secret_name}
  • PUT /orgs/{org}/agents/secrets/{secret_name}
  • PUT /orgs/{org}/agents/secrets/{secret_name}/repositories/{repository_id}
T2Agent variables: Writeorganization3 documented endpoints
  • DELETE /orgs/{org}/agents/variables/{name}
  • POST /orgs/{org}/agents/variables
  • PUT /orgs/{org}/agents/variables/{name}/repositories/{repository_id}
T2Organization dismissal requests for code scanning: Writeorganization1 documented endpoint
  • PATCH /repos/{owner}/{repo}/dismissal-requests/code-scanning/{alert_number}
T2Organization dismissal requests for Dependabot: Writeorganization2 documented endpoints
  • DELETE /repos/{owner}/{repo}/dismissal-requests/dependabot/{alert_number}
  • PATCH /repos/{owner}/{repo}/dismissal-requests/dependabot/{alert_number}
T2Organization bypass requests for secret scanning: Writeorganization1 documented endpoint
  • PATCH /repos/{owner}/{repo}/bypass-requests/secret-scanning/{bypass_request_number}
T2Pages: Writerepository4 documented endpoints
  • DELETE /repos/{owner}/{repo}/pages
  • GET /repos/{owner}/{repo}/pages/health
  • POST /repos/{owner}/{repo}/pages
T2Secret scanning alert dismissal requests: Writerepository1 documented endpoint
  • PATCH /repos/{owner}/{repo}/dismissal-requests/secret-scanning/{alert_number}
T2Repository security advisories: Writerepository4 documented endpoints
  • GET /orgs/{org}/security-advisories
  • PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id}
  • POST /repos/{owner}/{repo}/security-advisories
T2Repository creation: Writerepository3 documented endpoints
  • POST /orgs/{org}/repos
  • POST /repos/{template_owner}/{template_repo}/generate
  • POST /user/repos
T2Secret scanning alerts: Writerepository1 documented endpoint
  • PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
T2Secret scanning push protection bypass requests: Writerepository1 documented endpoint
  • PATCH /repos/{owner}/{repo}/bypass-requests/secret-scanning/{bypass_request_number}
T2Secret scanning alert dismissal requests: Writeorganization1 documented endpoint
  • PATCH /repos/{owner}/{repo}/dismissal-requests/secret-scanning/{alert_number}
T2Code scanning alerts: Writerepository1 documented endpoint
  • DELETE /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}
  • PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
  • POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix
T2Commit statuses: WriterepositoryStated by GitHub: Grants read/write access to commit statuses.
T2Dependabot alerts: Writerepository1 documented endpoint
  • PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}
T3Variables: Readrepository3 documented endpoints
  • GET /repos/{owner}/{repo}/actions/organization-variables
  • GET /repos/{owner}/{repo}/actions/variables
  • GET /repos/{owner}/{repo}/actions/variables/{name}
T3Actions: Readrepository33 documented endpoints
  • GET /repos/{owner}/{repo}/actions/artifacts
  • GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}
  • GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}
T3Administration: Readrepository16 documented endpoints
  • GET /repos/{owner}/{repo}/actions/permissions
  • GET /repos/{owner}/{repo}/actions/permissions/access
  • GET /repos/{owner}/{repo}/actions/permissions/artifact-and-log-retention
T3Agent secrets: Readrepository4 documented endpoints
  • GET /repos/{owner}/{repo}/agents/organization-secrets
  • GET /repos/{owner}/{repo}/agents/secrets
  • GET /repos/{owner}/{repo}/agents/secrets/public-key
T3Agent variables: Readrepository3 documented endpoints
  • GET /repos/{owner}/{repo}/agents/organization-variables
  • GET /repos/{owner}/{repo}/agents/variables
  • GET /repos/{owner}/{repo}/agents/variables/{name}
T3Checks: Readrepository6 documented endpoints
  • GET /repos/{owner}/{repo}/check-runs/{check_run_id}
  • GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations
  • GET /repos/{owner}/{repo}/check-suites/{check_suite_id}
T3Code quality: Readrepository2 documented endpoints
  • GET /repos/{owner}/{repo}/code-quality/findings
  • GET /repos/{owner}/{repo}/code-quality/findings/{finding_number}
T3Contents: Readrepository3 documented endpoints
  • GET /repos/{owner}/{repo}/code-scanning/codeql/databases
  • GET /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}
  • POST /repos/{template_owner}/{template_repo}/generate
T3Copilot agent settings: Readrepository1 documented endpoint
  • GET /repos/{owner}/{repo}/copilot/cloud-agent/configuration
T3Dependabot secrets: Readrepository3 documented endpoints
  • GET /repos/{owner}/{repo}/dependabot/secrets
  • GET /repos/{owner}/{repo}/dependabot/secrets/public-key
  • GET /repos/{owner}/{repo}/dependabot/secrets/{secret_name}
T3Environments: Readrepository5 documented endpoints
  • GET /repos/{owner}/{repo}/environments/{environment_name}/secrets
  • GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key
  • GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}
T3Members: Readorganization1 documented endpoint
  • GET /orgs/{org}/teams/{team_slug}/repos
T3Metadata: Readrepository1 documented endpoint
  • GET /repos/{owner}/{repo}/issue-types
T3Variables: Readorganization1 documented endpoint
  • GET /orgs/{org}/actions/variables/{name}
T3Administration: Readorganization6 documented endpoints
  • GET /organizations/{organization_id}/custom_roles
  • GET /orgs/{org}/custom-repository-roles
  • GET /orgs/{org}/custom-repository-roles/{role_id}
T3Agent secrets: Readorganization1 documented endpoint
  • GET /orgs/{org}/agents/secrets/{secret_name}
T3Agent variables: Readorganization1 documented endpoint
  • GET /orgs/{org}/agents/variables/{name}
T3Campaigns: Readorganization2 documented endpoints
  • GET /orgs/{org}/campaigns
  • GET /orgs/{org}/campaigns/{campaign_number}
T3Campaigns: Writeorganization3 documented endpoints
  • DELETE /orgs/{org}/campaigns/{campaign_number}
  • PATCH /orgs/{org}/campaigns/{campaign_number}
  • POST /orgs/{org}/campaigns
T3Organization dismissal requests for code scanning: Readorganization3 documented endpoints
  • GET /orgs/{org}/dismissal-requests/code-scanning
  • GET /repos/{owner}/{repo}/dismissal-requests/code-scanning
  • GET /repos/{owner}/{repo}/dismissal-requests/code-scanning/{alert_number}
T3Custom repository roles: Readorganization6 documented endpoints
  • GET /organizations/{organization_id}/custom_roles
  • GET /orgs/{org}/custom-repository-roles
  • GET /orgs/{org}/custom-repository-roles/{role_id}
T3Organization dismissal requests for Dependabot: Readorganization1 documented endpoint
  • GET /orgs/{org}/dismissal-requests/dependabot
T3Organization bypass requests for secret scanning: Readorganization3 documented endpoints
  • GET /orgs/{org}/bypass-requests/secret-scanning
  • GET /repos/{owner}/{repo}/bypass-requests/secret-scanning
  • GET /repos/{owner}/{repo}/bypass-requests/secret-scanning/{bypass_request_number}
T3Secrets: Readorganization2 documented endpoints
  • GET /orgs/{org}/actions/secrets/public-key
  • GET /orgs/{org}/actions/secrets/{secret_name}
T3Pages: Readrepository4 documented endpoints
  • GET /repos/{owner}/{repo}/pages
  • GET /repos/{owner}/{repo}/pages/builds
  • GET /repos/{owner}/{repo}/pages/builds/latest
T3Repository security advisories: Readrepository2 documented endpoints
  • GET /repos/{owner}/{repo}/security-advisories
  • GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}
T3Webhooks: Readrepository1 documented endpoint
  • GET /repos/{owner}/{repo}/hooks/{hook_id}/config
T3Secret scanning push protection bypass requests: Readrepository1 documented endpoint
  • GET /repos/{owner}/{repo}/bypass-requests/secret-scanning
T3Secrets: Readrepository4 documented endpoints
  • GET /repos/{owner}/{repo}/actions/organization-secrets
  • GET /repos/{owner}/{repo}/actions/secrets
  • GET /repos/{owner}/{repo}/actions/secrets/public-key
T3Code scanning alerts: Readrepository11 documented endpoints
  • GET /repos/{owner}/{repo}/code-scanning/ai-scan
  • GET /repos/{owner}/{repo}/code-scanning/alerts
  • GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
T3Dependabot alerts: Readrepository8 documented endpoints
  • DELETE /repos/{owner}/{repo}/dismissal-requests/dependabot/{alert_number}
  • GET /orgs/{org}/dependabot/alerts
  • GET /repos/{owner}/{repo}/dependabot/alerts