Permissions required for GitHub Apps
For each permission granted to a GitHub App, these are the REST API endpoints that the app can use.
In this article
- About GitHub App permissions
- Organization permissions for "API Insights"
- Organization permissions for "Administration"
- Organization permissions for "Blocking users"
- Organization permissions for "Campaigns"
- Organization permissions for "Custom organization roles"
- Organization permissions for "Custom properties for organizations"
- Organization permissions for "Custom properties"
- Organization permissions for "Events"
- Organization permissions for "GitHub Copilot Business"
- Organization permissions for "Hosted runner custom images"
- Organization permissions for "Issue Types"
- Organization permissions for "Members"
- Organization permissions for "Network configurations"
- Organization permissions for "Organization codespaces secrets"
- Organization permissions for "Organization codespaces settings"
- Organization permissions for "Organization codespaces"
- Organization permissions for "Organization dependabot secrets"
- Organization permissions for "Organization private registries"
- Organization permissions for "Personal access token requests"
- Organization permissions for "Personal access tokens"
- Organization permissions for "Projects"
- Organization permissions for "Secrets"
- Organization permissions for "Self-hosted runners"
- Organization permissions for "Team discussions"
- Organization permissions for "Variables"
- Organization permissions for "Webhooks"
- Repository permissions for "Actions"
- Repository permissions for "Administration"
- Repository permissions for "Artifact metadata"
- Repository permissions for "Attestations"
- Repository permissions for "Checks"
- Repository permissions for "Code scanning alerts"
- Repository permissions for "Codespaces lifecycle admin"
- Repository permissions for "Codespaces metadata"
- Repository permissions for "Codespaces secrets"
- Repository permissions for "Codespaces"
- Repository permissions for "Commit statuses"
- Repository permissions for "Contents"
- Repository permissions for "Custom properties"
- Repository permissions for "Dependabot alerts"
- Repository permissions for "Dependabot secrets"
- Repository permissions for "Deployments"
- Repository permissions for "Environments"
- Repository permissions for "Issues"
- Repository permissions for "Metadata"
- Repository permissions for "Pages"
- Repository permissions for "Pull requests"
- Repository permissions for "Repository security advisories"
- Repository permissions for "Secret scanning alerts"
- Repository permissions for "Secrets"
- Repository permissions for "Variables"
- Repository permissions for "Webhooks"
- Repository permissions for "Workflows"
- User permissions for "Block another user"
- User permissions for "Codespaces user secrets"
- User permissions for "Email addresses"
- User permissions for "Followers"
- User permissions for "GPG keys"
- User permissions for "Gists"
- User permissions for "Git SSH keys"
- User permissions for "Interaction limits"
- User permissions for "Plan"
- User permissions for "Private repository invitations"
- User permissions for "Profile"
- User permissions for "SSH signing keys"
- User permissions for "Starring"
- User permissions for "Watching"
About GitHub App permissions
GitHub Apps are created with a set of permissions. Permissions define what resources the GitHub App can access via the API. For more information, seeChoosing permissions for a GitHub App.
To help you choose the correct permissions, you will receive theX-Accepted-GitHub-Permissions header in the REST API response. The header will tell you what permissions are required in order to access the endpoint. For more information, seeTroubleshooting the REST API.
These permissions are required to access private resources. Some endpoints can also be used to access public resources without these permissions. To see whether an endpoint can access public resources without a permission, see the documentation for that endpoint.
Some endpoints require more than one permission. Other endpoints work with any one permission from a set of permissions. In these cases, the "Additional permissions" column will include a checkmark. For full details about the permissions that are required to use the endpoint, see the documentation for that endpoint.
Organization permissions for "API Insights"
Organization permissions for "Administration"
Organization permissions for "Blocking users"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PUT /orgs/{org}/blocks/{username} | write | UAT IAT | |
| DELETE /orgs/{org}/blocks/{username} | write | UAT IAT | |
| GET /orgs/{org}/blocks | read | UAT IAT | |
| GET /orgs/{org}/blocks/{username} | read | UAT IAT |
Organization permissions for "Campaigns"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /orgs/{org}/campaigns | write | UAT IAT | |
| PATCH /orgs/{org}/campaigns/{campaign_number} | write | UAT IAT | |
| DELETE /orgs/{org}/campaigns/{campaign_number} | write | UAT IAT | |
| GET /orgs/{org}/campaigns | read | UAT IAT | |
| GET /orgs/{org}/campaigns/{campaign_number} | read | UAT IAT |
Organization permissions for "Custom organization roles"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /orgs/{org}/organization-roles | read | UAT IAT | |
| GET /orgs/{org}/organization-roles/{role_id} | read | UAT IAT |
Organization permissions for "Custom properties for organizations"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PATCH /organizations/{org}/org-properties/values | write | UAT IAT | |
| GET /organizations/{org}/org-properties/values | read | UAT IAT |
Organization permissions for "Custom properties"
Organization permissions for "Events"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /users/{username}/events/orgs/{org} | read | UAT |
Organization permissions for "GitHub Copilot Business"
Organization permissions for "Hosted runner custom images"
Organization permissions for "Issue Types"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /orgs/{org}/issue-types | write | UAT IAT | |
| PUT /orgs/{org}/issue-types/{issue_type_id} | write | UAT IAT | |
| DELETE /orgs/{org}/issue-types/{issue_type_id} | write | UAT IAT | |
| GET /orgs/{org}/issue-types | read | UAT IAT |
Organization permissions for "Members"
Organization permissions for "Network configurations"
Organization permissions for "Organization codespaces secrets"
Organization permissions for "Organization codespaces settings"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PUT /orgs/{org}/codespaces/access | write | UAT IAT | |
| POST /orgs/{org}/codespaces/access/selected_users | write | UAT IAT | |
| DELETE /orgs/{org}/codespaces/access/selected_users | write | UAT IAT |
Organization permissions for "Organization codespaces"
Organization permissions for "Organization dependabot secrets"
Organization permissions for "Organization private registries"
Organization permissions for "Personal access token requests"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /orgs/{org}/personal-access-token-requests | write | UAT IAT | |
| POST /orgs/{org}/personal-access-token-requests/{pat_request_id} | write | UAT IAT | |
| GET /orgs/{org}/personal-access-token-requests | read | UAT IAT | |
| GET /orgs/{org}/personal-access-token-requests/{pat_request_id}/repositories | read | UAT IAT |
Organization permissions for "Personal access tokens"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /orgs/{org}/personal-access-tokens | write | UAT IAT | |
| POST /orgs/{org}/personal-access-tokens/{pat_id} | write | UAT IAT | |
| GET /orgs/{org}/personal-access-tokens | read | UAT IAT | |
| GET /orgs/{org}/personal-access-tokens/{pat_id}/repositories | read | UAT IAT |
Organization permissions for "Projects"
Organization permissions for "Secrets"
Organization permissions for "Self-hosted runners"
Organization permissions for "Team discussions"
Organization permissions for "Variables"
Organization permissions for "Webhooks"
Repository permissions for "Actions"
Repository permissions for "Administration"
Repository permissions for "Artifact metadata"
Repository permissions for "Attestations"
Repository permissions for "Checks"
Repository permissions for "Code scanning alerts"
Repository permissions for "Codespaces lifecycle admin"
Repository permissions for "Codespaces metadata"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /repos/{owner}/{repo}/codespaces/devcontainers | read | UAT IAT | |
| GET /repos/{owner}/{repo}/codespaces/machines | read | UAT IAT | |
| GET /user/codespaces/{codespace_name}/machines | read | UAT |
Repository permissions for "Codespaces secrets"
Repository permissions for "Codespaces"
Repository permissions for "Commit statuses"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /repos/{owner}/{repo}/statuses/{sha} | write | UAT IAT | |
| GET /repos/{owner}/{repo}/commits/{ref}/status | read | UAT IAT | |
| GET /repos/{owner}/{repo}/commits/{ref}/statuses | read | UAT IAT |
Repository permissions for "Contents"
Repository permissions for "Custom properties"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PATCH /repos/{owner}/{repo}/properties/values | write | UAT IAT |
Repository permissions for "Dependabot alerts"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number} | write | UAT IAT | |
| GET /orgs/{org}/dependabot/alerts | read | UAT IAT | |
| GET /repos/{owner}/{repo}/dependabot/alerts | read | UAT IAT | |
| GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number} | read | UAT IAT |
Repository permissions for "Dependabot secrets"
Repository permissions for "Deployments"
Repository permissions for "Environments"
Repository permissions for "Issues"
Repository permissions for "Metadata"
Repository permissions for "Pages"
Repository permissions for "Pull requests"
Repository permissions for "Repository security advisories"
Repository permissions for "Secret scanning alerts"
Repository permissions for "Secrets"
Repository permissions for "Variables"
Repository permissions for "Webhooks"
Repository permissions for "Workflows"
User permissions for "Block another user"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PUT /user/blocks/{username} | write | UAT | |
| DELETE /user/blocks/{username} | write | UAT | |
| GET /user/blocks | read | UAT | |
| GET /user/blocks/{username} | read | UAT |
User permissions for "Codespaces user secrets"
User permissions for "Email addresses"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PATCH /user/email/visibility | write | UAT | |
| POST /user/emails | write | UAT | |
| DELETE /user/emails | write | UAT | |
| GET /user/emails | read | UAT | |
| GET /user/public_emails | read | UAT |
User permissions for "Followers"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PUT /user/following/{username} | write | UAT | |
| DELETE /user/following/{username} | write | UAT | |
| GET /user/followers | read | UAT | |
| GET /user/following | read | UAT | |
| GET /user/following/{username} | read | UAT |
User permissions for "GPG keys"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /user/gpg_keys | write | UAT | |
| DELETE /user/gpg_keys/{gpg_key_id} | write | UAT | |
| GET /user/gpg_keys | read | UAT | |
| GET /user/gpg_keys/{gpg_key_id} | read | UAT |
User permissions for "Gists"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /gists | write | UAT | |
| PATCH /gists/{gist_id} | write | UAT | |
| DELETE /gists/{gist_id} | write | UAT | |
| POST /gists/{gist_id}/comments | write | UAT | |
| PATCH /gists/{gist_id}/comments/{comment_id} | write | UAT | |
| DELETE /gists/{gist_id}/comments/{comment_id} | write | UAT | |
| POST /gists/{gist_id}/forks | write | UAT | |
| PUT /gists/{gist_id}/star | write | UAT | |
| DELETE /gists/{gist_id}/star | write | UAT |
User permissions for "Git SSH keys"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /user/keys | write | UAT | |
| DELETE /user/keys/{key_id} | write | UAT | |
| GET /user/keys | read | UAT | |
| GET /user/keys/{key_id} | read | UAT | |
| GET /users/{username}/keys | read | UAT IAT |
User permissions for "Interaction limits"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PUT /user/interaction-limits | write | UAT | |
| DELETE /user/interaction-limits | write | UAT | |
| GET /user/interaction-limits | read | UAT |
User permissions for "Plan"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /users/{username}/settings/billing/premium_request/usage | read | UAT | |
| GET /users/{username}/settings/billing/usage | read | UAT | |
| GET /users/{username}/settings/billing/usage/summary | read | UAT |
User permissions for "Private repository invitations"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /repos/{owner}/{repo}/invitations | read | UAT IAT | Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint. |
User permissions for "Profile"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| PATCH /user | write | UAT | |
| POST /user/social_accounts | write | UAT | |
| DELETE /user/social_accounts | write | UAT |
User permissions for "SSH signing keys"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| POST /user/ssh_signing_keys | write | UAT | |
| DELETE /user/ssh_signing_keys/{ssh_signing_key_id} | write | UAT | |
| GET /user/ssh_signing_keys | read | UAT | |
| GET /user/ssh_signing_keys/{ssh_signing_key_id} | read | UAT |
User permissions for "Starring"
User permissions for "Watching"
| Endpoint | Access | Token types | Additional permissions |
|---|---|---|---|
| GET /user/subscriptions | read | UAT | |
| GET /users/{username}/subscriptions | read | UAT IAT |