Permissions required for GitHub Apps

For each permission granted to a GitHub App, these are the REST API endpoints that the app can use.

In this article

About GitHub App permissions

GitHub Apps are created with a set of permissions. Permissions define what resources the GitHub App can access via the API. For more information, see Choosing permissions for a GitHub App.

To help you choose the correct permissions, you will receive the X-Accepted-GitHub-Permissions header in the REST API response. The header will tell you what permissions are required in order to access the endpoint. For more information, see Troubleshooting the REST API.

These permissions are required to access private resources. Some endpoints can also be used to access public resources without these permissions. To see whether an endpoint can access public resources without a permission, see the documentation for that endpoint.

Some endpoints require more than one permission. Other endpoints work with any one permission from a set of permissions. In these cases, the "Additional permissions" column will include a checkmark. For full details about the permissions that are required to use the endpoint, see the documentation for that endpoint.

Enterprise permissions for "Enterprise Copilot metrics"

EndpointAccessToken typesAdditional permissions
GET /enterprises/{enterprise}/copilot/metrics/reports/enterprise-1-dayreadUAT
IAT
GET /enterprises/{enterprise}/copilot/metrics/reports/enterprise-28-day/latestreadUAT
IAT
GET /enterprises/{enterprise}/copilot/metrics/reports/repos-1-dayreadUAT
IAT
GET /enterprises/{enterprise}/copilot/metrics/reports/user-teams-1-dayreadUAT
IAT
GET /enterprises/{enterprise}/copilot/metrics/reports/users-1-dayreadUAT
IAT
GET /enterprises/{enterprise}/copilot/metrics/reports/users-28-day/latestreadUAT
IAT

Enterprise permissions for "Enterprise teams"

EndpointAccessToken typesAdditional permissions
POST /enterprises/{enterprise}/teamswriteUAT
IAT
POST /enterprises/{enterprise}/teams/{enterprise-team}/memberships/addwriteUAT
IAT
POST /enterprises/{enterprise}/teams/{enterprise-team}/memberships/removewriteUAT
IAT
PUT /enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}writeUAT
IAT
DELETE /enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}writeUAT
IAT
POST /enterprises/{enterprise}/teams/{enterprise-team}/organizations/addwriteUAT
IAT
POST /enterprises/{enterprise}/teams/{enterprise-team}/organizations/removewriteUAT
IAT
PUT /enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}writeUAT
IAT
DELETE /enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}writeUAT
IAT
PATCH /enterprises/{enterprise}/teams/{team_slug}writeUAT
IAT
DELETE /enterprises/{enterprise}/teams/{team_slug}writeUAT
IAT
GET /enterprises/{enterprise}/members/{username}/teamsreadUAT
IAT
GET /enterprises/{enterprise}/teamsreadUAT
IAT
GET /enterprises/{enterprise}/teams/{enterprise-team}/membershipsreadUAT
IAT
GET /enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}readUAT
IAT
GET /enterprises/{enterprise}/teams/{enterprise-team}/organizationsreadUAT
IAT
GET /enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}readUAT
IAT
GET /enterprises/{enterprise}/teams/{team_slug}readUAT
IAT

Organization permissions for "API Insights"

EndpointAccessToken typesAdditional permissions
GET /orgs/{org}/insights/api/route-stats/{actor_type}/{actor_id}readUAT
IAT
GET /orgs/{org}/insights/api/subject-statsreadUAT
IAT
GET /orgs/{org}/insights/api/summary-statsreadUAT
IAT
GET /orgs/{org}/insights/api/summary-stats/users/{user_id}readUAT
IAT
GET /orgs/{org}/insights/api/summary-stats/{actor_type}/{actor_id}readUAT
IAT
GET /orgs/{org}/insights/api/time-statsreadUAT
IAT
GET /orgs/{org}/insights/api/time-stats/users/{user_id}readUAT
IAT
GET /orgs/{org}/insights/api/time-stats/{actor_type}/{actor_id}readUAT
IAT
GET /orgs/{org}/insights/api/user-stats/{user_id}readUAT
IAT

Organization permissions for "Administration"

EndpointAccessToken typesAdditional permissions
PUT /organizations/{org}/actions/cache/retention-limitwriteUAT
IAT
PUT /organizations/{org}/actions/cache/storage-limitwriteUAT
IAT
POST /organizations/{org}/settings/billing/budgetswriteUAT
IAT
PATCH /organizations/{org}/settings/billing/budgets/{budget_id}writeUAT
IAT
DELETE /organizations/{org}/settings/billing/budgets/{budget_id}writeUAT
IAT
PATCH /orgs/{org}writeUAT
IAT
DELETE /orgs/{org}writeUAT
IAT
POST /orgs/{org}/actions/hosted-runnerswriteUAT
IAT
PATCH /orgs/{org}/actions/hosted-runners/{hosted_runner_id}writeUAT
IAT
DELETE /orgs/{org}/actions/hosted-runners/{hosted_runner_id}writeUAT
IAT
POST /orgs/{org}/actions/oidc/customization/properties/repowriteUAT
IAT
DELETE /orgs/{org}/actions/oidc/customization/properties/repo/{custom_property_name}writeUAT
IAT
PUT /orgs/{org}/actions/oidc/customization/subwriteUAT
IAT
PUT /orgs/{org}/actions/permissionswriteUAT
IAT
PUT /orgs/{org}/actions/permissions/artifact-and-log-retentionwriteUAT
IAT
PUT /orgs/{org}/actions/permissions/fork-pr-contributor-approvalwriteUAT
IAT
PUT /orgs/{org}/actions/permissions/fork-pr-workflows-private-reposwriteUAT
IAT
PUT /orgs/{org}/actions/permissions/repositorieswriteUAT
IAT
PUT /orgs/{org}/actions/permissions/repositories/{repository_id}writeUAT
IAT
DELETE /orgs/{org}/actions/permissions/repositories/{repository_id}writeUAT
IAT
PUT /orgs/{org}/actions/permissions/selected-actionswriteUAT
IAT
PUT /orgs/{org}/actions/permissions/self-hosted-runnerswriteUAT
IAT
PUT /orgs/{org}/actions/permissions/self-hosted-runners/repositorieswriteUAT
IAT
PUT /orgs/{org}/actions/permissions/self-hosted-runners/repositories/{repository_id}writeUAT
IAT
DELETE /orgs/{org}/actions/permissions/self-hosted-runners/repositories/{repository_id}writeUAT
IAT
PUT /orgs/{org}/actions/permissions/workflowwriteUAT
IAT
PATCH /orgs/{org}/code-scanning/ai-scanwriteUAT
IAT
POST /orgs/{org}/code-security/configurationswriteUAT
IAT
DELETE /orgs/{org}/code-security/configurations/detachwriteUAT
IAT
PATCH /orgs/{org}/code-security/configurations/{configuration_id}writeUAT
IAT
DELETE /orgs/{org}/code-security/configurations/{configuration_id}writeUAT
IAT
POST /orgs/{org}/code-security/configurations/{configuration_id}/attachwriteUAT
IAT
PUT /orgs/{org}/code-security/configurations/{configuration_id}/defaultswriteUAT
IAT
POST /orgs/{org}/copilot/billing/selected_teamswriteUAT
IAT
DELETE /orgs/{org}/copilot/billing/selected_teamswriteUAT
IAT
POST /orgs/{org}/copilot/billing/selected_userswriteUAT
IAT
DELETE /orgs/{org}/copilot/billing/selected_userswriteUAT
IAT
PATCH /orgs/{org}/dependabot/repository-accesswriteUAT
IAT
PUT /orgs/{org}/dependabot/repository-access/default-levelwriteUAT
IAT
PUT /orgs/{org}/interaction-limitswriteUAT
IAT
DELETE /orgs/{org}/interaction-limitswriteUAT
IAT
GET /orgs/{org}/interaction-limits/pulls/creation-capwriteUAT
IAT
PATCH /orgs/{org}/interaction-limits/pulls/creation-capwriteUAT
IAT
GET /orgs/{org}/rulesetswriteUAT
IAT
POST /orgs/{org}/rulesetswriteUAT
IAT
GET /orgs/{org}/rulesets/rule-suiteswriteUAT
IAT
GET /orgs/{org}/rulesets/rule-suites/{rule_suite_id}writeUAT
IAT
GET /orgs/{org}/rulesets/{ruleset_id}writeUAT
IAT
PUT /orgs/{org}/rulesets/{ruleset_id}writeUAT
IAT
DELETE /orgs/{org}/rulesets/{ruleset_id}writeUAT
IAT
GET /orgs/{org}/rulesets/{ruleset_id}/historywriteUAT
IAT
GET /orgs/{org}/rulesets/{ruleset_id}/history/{version_id}writeUAT
IAT
POST /orgs/{org}/secret-scanning/custom-patternswriteUAT
IAT
DELETE /orgs/{org}/secret-scanning/custom-patternswriteUAT
IAT
PATCH /orgs/{org}/secret-scanning/custom-patterns/{pattern_id}writeUAT
IAT
PATCH /orgs/{org}/secret-scanning/pattern-configurationswriteUAT
IAT
PUT /orgs/{org}/security-managers/teams/{team_slug}writeUAT
IAT