Permissions required for fine-grained personal access tokens

About permissions required for fine-grained personal access token

When you create a fine-grained personal access token, you grant it a set of permissions. Permissions define what resources the GitHub App can access via the API. For more information, see "Managing your personal access tokens."

To help you choose the correct permissions, you will receive the X-Accepted-GitHub-Permissions header in the REST API response. The header will tell you what permissions are required in order to access the endpoint. For more information, see "Troubleshooting the REST API."

These permissions are required to access private resources. Some endpoints can also be used to access public resources without these permissions. To see whether an endpoint can access public resources without a permission, see the documentation for that endpoint.

Some endpoints require more than one permission. Other endpoints work with any one permission from a set of permissions. In these cases, the "Additional permissions" column will include a checkmark. For full details about the permissions that are required to use the endpoint, see the documentation for that endpoint.

Endpoint	Access	Additional permissions
GET /orgs/{org}/insights/api/route-stats/{actor_type}/{actor_id}	read
GET /orgs/{org}/insights/api/subject-stats	read
GET /orgs/{org}/insights/api/summary-stats	read
GET /orgs/{org}/insights/api/summary-stats/users/{user_id}	read
GET /orgs/{org}/insights/api/summary-stats/{actor_type}/{actor_id}	read
GET /orgs/{org}/insights/api/time-stats	read
GET /orgs/{org}/insights/api/time-stats/users/{user_id}	read
GET /orgs/{org}/insights/api/time-stats/{actor_type}/{actor_id}	read
GET /orgs/{org}/insights/api/user-stats/{user_id}	read

Endpoint	Access	Additional permissions
PATCH /orgs/{org}	write
DELETE /orgs/{org}	write
PUT /orgs/{org}/actions/oidc/customization/sub	write
PUT /orgs/{org}/actions/permissions	write
PUT /orgs/{org}/actions/permissions/repositories	write
PUT /orgs/{org}/actions/permissions/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/actions/permissions/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /orgs/{org}/actions/permissions/selected-actions	write
PUT /orgs/{org}/actions/permissions/workflow	write
GET /orgs/{org}/code-security/configurations	write
POST /orgs/{org}/code-security/configurations	write
GET /orgs/{org}/code-security/configurations/defaults	write
DELETE /orgs/{org}/code-security/configurations/detach	write
GET /orgs/{org}/code-security/configurations/{configuration_id}	write
PATCH /orgs/{org}/code-security/configurations/{configuration_id}	write
DELETE /orgs/{org}/code-security/configurations/{configuration_id}	write
POST /orgs/{org}/code-security/configurations/{configuration_id}/attach	write
PUT /orgs/{org}/code-security/configurations/{configuration_id}/defaults	write
GET /orgs/{org}/code-security/configurations/{configuration_id}/repositories	write
POST /orgs/{org}/copilot/billing/selected_teams	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/copilot/billing/selected_teams	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /orgs/{org}/copilot/billing/selected_users	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/copilot/billing/selected_users	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /orgs/{org}/interaction-limits	write
DELETE /orgs/{org}/interaction-limits	write
GET /orgs/{org}/rulesets	write
POST /orgs/{org}/rulesets	write
GET /orgs/{org}/rulesets/rule-suites	write
GET /orgs/{org}/rulesets/rule-suites/{rule_suite_id}	write
GET /orgs/{org}/rulesets/{ruleset_id}	write
PUT /orgs/{org}/rulesets/{ruleset_id}	write
DELETE /orgs/{org}/rulesets/{ruleset_id}	write
PUT /orgs/{org}/security-managers/teams/{team_slug}	write
DELETE /orgs/{org}/security-managers/teams/{team_slug}	write
POST /orgs/{org}/{security_product}/{enablement}	write
GET /orgs/{org}/actions/cache/usage	read
GET /orgs/{org}/actions/cache/usage-by-repository	read
GET /orgs/{org}/actions/oidc/customization/sub	read
GET /orgs/{org}/actions/permissions	read
GET /orgs/{org}/actions/permissions/repositories	read
GET /orgs/{org}/actions/permissions/selected-actions	read
GET /orgs/{org}/actions/permissions/workflow	read
GET /orgs/{org}/copilot/billing	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/copilot/billing/seats	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/copilot/metrics	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/copilot/usage	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/installations	read
GET /orgs/{org}/interaction-limits	read
GET /orgs/{org}/members/{username}/copilot	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/security-managers	read
GET /orgs/{org}/settings/billing/actions	read
GET /orgs/{org}/settings/billing/packages	read
GET /orgs/{org}/settings/billing/shared-storage	read
GET /orgs/{org}/team/{team_slug}/copilot/metrics	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/team/{team_slug}/copilot/usage	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.

Endpoint	Access	Additional permissions
PUT /orgs/{org}/blocks/{username}	write
DELETE /orgs/{org}/blocks/{username}	write
GET /orgs/{org}/blocks	read
GET /orgs/{org}/blocks/{username}	read

Endpoint	Access	Additional permissions
GET /orgs/{org}/organization-roles	read
GET /orgs/{org}/organization-roles/{role_id}	read

Endpoint	Access	Additional permissions
PATCH /orgs/{org}/properties/schema	admin
PUT /orgs/{org}/properties/schema/{custom_property_name}	admin
DELETE /orgs/{org}/properties/schema/{custom_property_name}	admin
PATCH /orgs/{org}/properties/values	write
GET /orgs/{org}/properties/schema	read
GET /orgs/{org}/properties/schema/{custom_property_name}	read
GET /orgs/{org}/properties/values	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/invitations	write
DELETE /orgs/{org}/invitations/{invitation_id}	write
DELETE /orgs/{org}/members/{username}	write
PUT /orgs/{org}/memberships/{username}	write
DELETE /orgs/{org}/memberships/{username}	write
DELETE /orgs/{org}/organization-roles/teams/{team_slug}	write
PUT /orgs/{org}/organization-roles/teams/{team_slug}/{role_id}	write
DELETE /orgs/{org}/organization-roles/teams/{team_slug}/{role_id}	write
DELETE /orgs/{org}/organization-roles/users/{username}	write
PUT /orgs/{org}/organization-roles/users/{username}/{role_id}	write
DELETE /orgs/{org}/organization-roles/users/{username}/{role_id}	write
PUT /orgs/{org}/outside_collaborators/{username}	write
DELETE /orgs/{org}/outside_collaborators/{username}	write
PUT /orgs/{org}/public_members/{username}	write
DELETE /orgs/{org}/public_members/{username}	write
POST /orgs/{org}/teams	write
PUT /teams/{team_id}/members/{username}	write
DELETE /teams/{team_id}/members/{username}	write
PATCH /user/memberships/orgs/{org}	write
GET /orgs/{org}/failed_invitations	read
GET /orgs/{org}/invitations	read
GET /orgs/{org}/invitations/{invitation_id}/teams	read
GET /orgs/{org}/members	read
GET /orgs/{org}/members/{username}	read
GET /orgs/{org}/memberships/{username}	read
GET /orgs/{org}/organization-roles/{role_id}/teams	read
GET /orgs/{org}/organization-roles/{role_id}/users	read
GET /orgs/{org}/outside_collaborators	read
GET /orgs/{org}/public_members	read
GET /orgs/{org}/public_members/{username}	read
GET /orgs/{org}/teams	read
GET /teams/{team_id}/members/{username}	read
GET /user/memberships/orgs/{org}	read

Endpoint	Access	Additional permissions
PUT /orgs/{org}/codespaces/secrets/{secret_name}	write
DELETE /orgs/{org}/codespaces/secrets/{secret_name}	write
PUT /orgs/{org}/codespaces/secrets/{secret_name}/repositories	write
PUT /orgs/{org}/codespaces/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/codespaces/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/codespaces/secrets	read
GET /orgs/{org}/codespaces/secrets/public-key	read
GET /orgs/{org}/codespaces/secrets/{secret_name}	read
GET /orgs/{org}/codespaces/secrets/{secret_name}/repositories	read

Endpoint	Access	Additional permissions
PUT /orgs/{org}/codespaces/access	write
POST /orgs/{org}/codespaces/access/selected_users	write
DELETE /orgs/{org}/codespaces/access/selected_users	write

Endpoint	Access	Additional permissions
DELETE /orgs/{org}/members/{username}/codespaces/{codespace_name}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /orgs/{org}/members/{username}/codespaces/{codespace_name}/stop	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/codespaces	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/members/{username}/codespaces	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.

Endpoint	Access	Additional permissions
PUT /orgs/{org}/dependabot/secrets/{secret_name}	write
DELETE /orgs/{org}/dependabot/secrets/{secret_name}	write
PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories	write
PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/dependabot/secrets	read
GET /orgs/{org}/dependabot/secrets/public-key	read
GET /orgs/{org}/dependabot/secrets/{secret_name}	read
GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/personal-access-token-requests	write
POST /orgs/{org}/personal-access-token-requests/{pat_request_id}	write
GET /orgs/{org}/personal-access-token-requests	read
GET /orgs/{org}/personal-access-token-requests/{pat_request_id}/repositories	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/personal-access-tokens	write
POST /orgs/{org}/personal-access-tokens/{pat_id}	write
GET /orgs/{org}/personal-access-tokens	read
GET /orgs/{org}/personal-access-tokens/{pat_id}/repositories	read

Endpoint	Access	Additional permissions
GET /projects/{project_id}/collaborators	admin	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /projects/{project_id}/collaborators/{username}	admin	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /projects/{project_id}/collaborators/{username}	admin	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /projects/{project_id}/collaborators/{username}/permission	admin	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /orgs/{org}/projects	write
PATCH /projects/columns/cards/{card_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /projects/columns/cards/{card_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /projects/columns/cards/{card_id}/moves	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PATCH /projects/columns/{column_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /projects/columns/{column_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /projects/columns/{column_id}/cards	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /projects/columns/{column_id}/moves	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PATCH /projects/{project_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /projects/{project_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /projects/{project_id}/columns	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/projects	read
GET /projects/columns/cards/{card_id}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /projects/columns/{column_id}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /projects/columns/{column_id}/cards	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /projects/{project_id}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /projects/{project_id}/columns	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.

Endpoint	Access	Additional permissions
PUT /orgs/{org}/actions/secrets/{secret_name}	write
DELETE /orgs/{org}/actions/secrets/{secret_name}	write
PUT /orgs/{org}/actions/secrets/{secret_name}/repositories	write
PUT /orgs/{org}/actions/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/actions/secrets/{secret_name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/actions/secrets	read
GET /orgs/{org}/actions/secrets/public-key	read
GET /orgs/{org}/actions/secrets/{secret_name}	read
GET /orgs/{org}/actions/secrets/{secret_name}/repositories	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/actions/runner-groups	write
PATCH /orgs/{org}/actions/runner-groups/{runner_group_id}	write
DELETE /orgs/{org}/actions/runner-groups/{runner_group_id}	write
PUT /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories	write
PUT /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /orgs/{org}/actions/runner-groups/{runner_group_id}/runners	write
PUT /orgs/{org}/actions/runner-groups/{runner_group_id}/runners/{runner_id}	write
DELETE /orgs/{org}/actions/runner-groups/{runner_group_id}/runners/{runner_id}	write
POST /orgs/{org}/actions/runners/generate-jitconfig	write
POST /orgs/{org}/actions/runners/registration-token	write
POST /orgs/{org}/actions/runners/remove-token	write
DELETE /orgs/{org}/actions/runners/{runner_id}	write
POST /orgs/{org}/actions/runners/{runner_id}/labels	write
PUT /orgs/{org}/actions/runners/{runner_id}/labels	write
DELETE /orgs/{org}/actions/runners/{runner_id}/labels	write
DELETE /orgs/{org}/actions/runners/{runner_id}/labels/{name}	write
GET /orgs/{org}/actions/runner-groups	read
GET /orgs/{org}/actions/runner-groups/{runner_group_id}	read
GET /orgs/{org}/actions/runner-groups/{runner_group_id}/repositories	read
GET /orgs/{org}/actions/runner-groups/{runner_group_id}/runners	read
GET /orgs/{org}/actions/runners	read
GET /orgs/{org}/actions/runners/downloads	read
GET /orgs/{org}/actions/runners/{runner_id}	read
GET /orgs/{org}/actions/runners/{runner_id}/labels	read

Endpoint	Access	Additional permissions
DELETE /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/comments/{comment_number}/reactions/{reaction_id}	write
DELETE /orgs/{org}/teams/{team_slug}/discussions/{discussion_number}/reactions/{reaction_id}	write

Endpoint	Access	Additional permissions
POST /orgs/{org}/actions/variables	write
PATCH /orgs/{org}/actions/variables/{name}	write
DELETE /orgs/{org}/actions/variables/{name}	write
PUT /orgs/{org}/actions/variables/{name}/repositories	write
PUT /orgs/{org}/actions/variables/{name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /orgs/{org}/actions/variables/{name}/repositories/{repository_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /orgs/{org}/actions/variables	read
GET /orgs/{org}/actions/variables/{name}	read
GET /orgs/{org}/actions/variables/{name}/repositories	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/hooks	write
PATCH /orgs/{org}/hooks/{hook_id}	write
DELETE /orgs/{org}/hooks/{hook_id}	write
PATCH /orgs/{org}/hooks/{hook_id}/config	write
POST /orgs/{org}/hooks/{hook_id}/deliveries/{delivery_id}/attempts	write
POST /orgs/{org}/hooks/{hook_id}/pings	write
GET /orgs/{org}/hooks	read
GET /orgs/{org}/hooks/{hook_id}	read
GET /orgs/{org}/hooks/{hook_id}/config	read
GET /orgs/{org}/hooks/{hook_id}/deliveries	read
GET /orgs/{org}/hooks/{hook_id}/deliveries/{delivery_id}	read

Endpoint	Access	Additional permissions
DELETE /repos/{owner}/{repo}/actions/artifacts/{artifact_id}	write
DELETE /repos/{owner}/{repo}/actions/caches	write
DELETE /repos/{owner}/{repo}/actions/caches/{cache_id}	write
POST /repos/{owner}/{repo}/actions/jobs/{job_id}/rerun	write
PUT /repos/{owner}/{repo}/actions/oidc/customization/sub	write
DELETE /repos/{owner}/{repo}/actions/runs/{run_id}	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/approve	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/cancel	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/force-cancel	write
DELETE /repos/{owner}/{repo}/actions/runs/{run_id}/logs	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/rerun	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/rerun-failed-jobs	write
PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/disable	write
POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches	write
PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable	write
GET /repos/{owner}/{repo}/actions/artifacts	read
GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}	read
GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}	read
GET /repos/{owner}/{repo}/actions/cache/usage	read
GET /repos/{owner}/{repo}/actions/caches	read
GET /repos/{owner}/{repo}/actions/jobs/{job_id}	read
GET /repos/{owner}/{repo}/actions/jobs/{job_id}/logs	read
GET /repos/{owner}/{repo}/actions/oidc/customization/sub	read
GET /repos/{owner}/{repo}/actions/runs	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/approvals	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/jobs	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt_number}/logs	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/logs	read
GET /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments	read
POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/actions/runs/{run_id}/timing	read
GET /repos/{owner}/{repo}/actions/workflows	read
GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}	read
GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs	read
GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/timing	read
GET /repos/{owner}/{repo}/environments	read
GET /repos/{owner}/{repo}/environments/{environment_name}	read
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies	read
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}	read
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules	read
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules/{protection_rule_id}	read

Endpoint	Access	Additional permissions
POST /orgs/{org}/repos	write
PATCH /repos/{owner}/{repo}	write
DELETE /repos/{owner}/{repo}	write
PUT /repos/{owner}/{repo}/actions/permissions	write
PUT /repos/{owner}/{repo}/actions/permissions/access	write
PUT /repos/{owner}/{repo}/actions/permissions/selected-actions	write
PUT /repos/{owner}/{repo}/actions/permissions/workflow	write
POST /repos/{owner}/{repo}/actions/runners/generate-jitconfig	write
POST /repos/{owner}/{repo}/actions/runners/registration-token	write
POST /repos/{owner}/{repo}/actions/runners/remove-token	write
DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}	write
POST /repos/{owner}/{repo}/actions/runners/{runner_id}/labels	write
PUT /repos/{owner}/{repo}/actions/runners/{runner_id}/labels	write
DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels	write
DELETE /repos/{owner}/{repo}/actions/runners/{runner_id}/labels/{name}	write
POST /repos/{owner}/{repo}/autolinks	write
DELETE /repos/{owner}/{repo}/autolinks/{autolink_id}	write
PUT /repos/{owner}/{repo}/automated-security-fixes	write
DELETE /repos/{owner}/{repo}/automated-security-fixes	write
PUT /repos/{owner}/{repo}/branches/{branch}/protection	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/enforce_admins	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/enforce_admins	write
PATCH /repos/{owner}/{repo}/branches/{branch}/protection/required_pull_request_reviews	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/required_pull_request_reviews	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/required_signatures	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/required_signatures	write
PATCH /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks/contexts	write
PUT /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks/contexts	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks/contexts	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/restrictions	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/apps	write
PUT /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/apps	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/apps	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/teams	write
PUT /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/teams	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/teams	write
POST /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/users	write
PUT /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/users	write
DELETE /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/users	write
PATCH /repos/{owner}/{repo}/code-scanning/default-setup	write
PUT /repos/{owner}/{repo}/collaborators/{username}	write
DELETE /repos/{owner}/{repo}/collaborators/{username}	write
PUT /repos/{owner}/{repo}/environments/{environment_name}	write
DELETE /repos/{owner}/{repo}/environments/{environment_name}	write
POST /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies	write
PUT /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}	write
DELETE /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}	write
POST /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules	write
DELETE /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules/{protection_rule_id}	write
POST /repos/{owner}/{repo}/forks	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /repos/{owner}/{repo}/interaction-limits	write
DELETE /repos/{owner}/{repo}/interaction-limits	write
PATCH /repos/{owner}/{repo}/invitations/{invitation_id}	write
DELETE /repos/{owner}/{repo}/invitations/{invitation_id}	write
POST /repos/{owner}/{repo}/keys	write
DELETE /repos/{owner}/{repo}/keys/{key_id}	write
POST /repos/{owner}/{repo}/pages	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /repos/{owner}/{repo}/pages	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/pages	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/pages/health	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /repos/{owner}/{repo}/private-vulnerability-reporting	write
DELETE /repos/{owner}/{repo}/private-vulnerability-reporting	write
POST /repos/{owner}/{repo}/rulesets	write
GET /repos/{owner}/{repo}/rulesets/rule-suites	write
GET /repos/{owner}/{repo}/rulesets/rule-suites/{rule_suite_id}	write
PUT /repos/{owner}/{repo}/rulesets/{ruleset_id}	write
DELETE /repos/{owner}/{repo}/rulesets/{ruleset_id}	write
POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/forks	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/tags/protection	write
DELETE /repos/{owner}/{repo}/tags/protection/{tag_protection_id}	write
PUT /repos/{owner}/{repo}/topics	write
POST /repos/{owner}/{repo}/transfer	write
PUT /repos/{owner}/{repo}/vulnerability-alerts	write
DELETE /repos/{owner}/{repo}/vulnerability-alerts	write
POST /repos/{template_owner}/{template_repo}/generate	write
POST /user/repos	write
PATCH /user/repository_invitations/{invitation_id}	write
DELETE /user/repository_invitations/{invitation_id}	write
GET /repos/{owner}/{repo}/actions/permissions	read
GET /repos/{owner}/{repo}/actions/permissions/access	read
GET /repos/{owner}/{repo}/actions/permissions/selected-actions	read
GET /repos/{owner}/{repo}/actions/permissions/workflow	read
GET /repos/{owner}/{repo}/actions/runners	read
GET /repos/{owner}/{repo}/actions/runners/downloads	read
GET /repos/{owner}/{repo}/actions/runners/{runner_id}	read
GET /repos/{owner}/{repo}/actions/runners/{runner_id}/labels	read
GET /repos/{owner}/{repo}/autolinks	read
GET /repos/{owner}/{repo}/autolinks/{autolink_id}	read
GET /repos/{owner}/{repo}/automated-security-fixes	read
GET /repos/{owner}/{repo}/branches/{branch}/protection	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/enforce_admins	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/required_pull_request_reviews	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/required_signatures	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/required_status_checks/contexts	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/restrictions	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/apps	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/teams	read
GET /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/users	read
GET /repos/{owner}/{repo}/code-scanning/default-setup	read
GET /repos/{owner}/{repo}/code-security-configuration	read
GET /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules/apps	read
GET /repos/{owner}/{repo}/interaction-limits	read
GET /repos/{owner}/{repo}/invitations	read
GET /repos/{owner}/{repo}/keys	read
GET /repos/{owner}/{repo}/keys/{key_id}	read
GET /repos/{owner}/{repo}/tags/protection	read
GET /repos/{owner}/{repo}/teams	read
GET /repos/{owner}/{repo}/traffic/clones	read
GET /repos/{owner}/{repo}/traffic/popular/paths	read
GET /repos/{owner}/{repo}/traffic/popular/referrers	read
GET /repos/{owner}/{repo}/traffic/views	read
GET /repos/{owner}/{repo}/vulnerability-alerts	read
GET /user/repository_invitations	read

Permissions required for fine-grained personal access tokens

In this article

Endpoint	Access	Additional permissions
POST /repos/{owner}/{repo}/attestations	write
GET /repos/{owner}/{repo}/attestations/{subject_digest}	read

Endpoint	Access	Additional permissions
POST /repos/{owner}/{repo}/check-runs	write
PATCH /repos/{owner}/{repo}/check-runs/{check_run_id}	write
POST /repos/{owner}/{repo}/check-runs/{check_run_id}/rerequest	write
POST /repos/{owner}/{repo}/check-suites	write
PATCH /repos/{owner}/{repo}/check-suites/preferences	write
POST /repos/{owner}/{repo}/check-suites/{check_suite_id}/rerequest	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/check-runs/{check_run_id}	read
GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations	read
GET /repos/{owner}/{repo}/check-suites/{check_suite_id}	read
GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs	read
GET /repos/{owner}/{repo}/commits/{ref}/check-runs	read
GET /repos/{owner}/{repo}/commits/{ref}/check-suites	read

Endpoint	Access	Additional permissions
PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}	write
DELETE /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}	write
POST /repos/{owner}/{repo}/code-scanning/sarifs	write
GET /orgs/{org}/code-scanning/alerts	read
GET /repos/{owner}/{repo}/code-scanning/alerts	read
GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}	read
GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances	read
GET /repos/{owner}/{repo}/code-scanning/analyses	read
GET /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}	read
GET /repos/{owner}/{repo}/code-scanning/sarifs/{sarif_id}	read

Endpoint	Access	Additional permissions
GET /repos/{owner}/{repo}/codespaces/devcontainers	read
GET /repos/{owner}/{repo}/codespaces/machines	read
GET /user/codespaces/{codespace_name}/machines	read

Endpoint	Access	Additional permissions
GET /repos/{owner}/{repo}/codespaces/secrets	write
GET /repos/{owner}/{repo}/codespaces/secrets/public-key	write
GET /repos/{owner}/{repo}/codespaces/secrets/{secret_name}	write
PUT /repos/{owner}/{repo}/codespaces/secrets/{secret_name}	write
DELETE /repos/{owner}/{repo}/codespaces/secrets/{secret_name}	write

Endpoint	Access	Additional permissions
POST /repos/{owner}/{repo}/statuses/{sha}	write
GET /repos/{owner}/{repo}/commits/{ref}/status	read
GET /repos/{owner}/{repo}/commits/{ref}/statuses	read

Endpoint	Access	Additional permissions
PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}	write
GET /orgs/{org}/dependabot/alerts	read
GET /repos/{owner}/{repo}/dependabot/alerts	read
GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}	read

Endpoint	Access	Additional permissions
PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name}	write
DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name}	write
GET /repos/{owner}/{repo}/dependabot/secrets	read
GET /repos/{owner}/{repo}/dependabot/secrets/public-key	read
GET /repos/{owner}/{repo}/dependabot/secrets/{secret_name}	read

Endpoint	Access	Additional permissions
POST /repos/{owner}/{repo}/deployments	write
DELETE /repos/{owner}/{repo}/deployments/{deployment_id}	write
POST /repos/{owner}/{repo}/deployments/{deployment_id}/statuses	write
POST /repos/{owner}/{repo}/actions/runs/{run_id}/pending_deployments	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/deployments	read
GET /repos/{owner}/{repo}/deployments/{deployment_id}	read
GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses	read
GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses/{status_id}	read

Endpoint	Access	Additional permissions
POST /repos/{owner}/{repo}/issues	write
PATCH /repos/{owner}/{repo}/issues/comments/{comment_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/issues/comments/{comment_id}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions	write
DELETE /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions/{reaction_id}	write
PATCH /repos/{owner}/{repo}/issues/{issue_number}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/issues/{issue_number}/assignees	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/issues/{issue_number}/assignees	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/issues/{issue_number}/comments	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/issues/{issue_number}/labels	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /repos/{owner}/{repo}/issues/{issue_number}/labels	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{name}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PUT /repos/{owner}/{repo}/issues/{issue_number}/lock	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/issues/{issue_number}/lock	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/issues/{issue_number}/reactions	write
DELETE /repos/{owner}/{repo}/issues/{issue_number}/reactions/{reaction_id}	write
POST /repos/{owner}/{repo}/labels	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PATCH /repos/{owner}/{repo}/labels/{name}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/labels/{name}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
POST /repos/{owner}/{repo}/milestones	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
PATCH /repos/{owner}/{repo}/milestones/{milestone_number}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
DELETE /repos/{owner}/{repo}/milestones/{milestone_number}	write	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/assignees	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/assignees/{assignee}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues	read
GET /repos/{owner}/{repo}/issues/comments	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/comments/{comment_id}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions	read
GET /repos/{owner}/{repo}/issues/events	read
GET /repos/{owner}/{repo}/issues/events/{event_id}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/{issue_number}	read
GET /repos/{owner}/{repo}/issues/{issue_number}/assignees/{assignee}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/{issue_number}/comments	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/{issue_number}/events	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/{issue_number}/labels	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/issues/{issue_number}/reactions	read
GET /repos/{owner}/{repo}/issues/{issue_number}/timeline	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/labels	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/labels/{name}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/milestones	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/milestones/{milestone_number}	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.
GET /repos/{owner}/{repo}/milestones/{milestone_number}/labels	read	Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.