GitHub Scoped API

openapi: 3.0.3
info:
  version: 1.1.4
  title: GitHub Application About Scoped API
  description: 'Use the REST API to retrieve information about GitHub Apps and GitHub App

    installations.'
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  x-github-plan: ghes
  x-github-release: 3.9
servers:
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:
- name: Scoped
paths:
  /applications/{client_id}/token/scoped:
    post:
      summary: GitHub Createscoped Access Token
      description: 'Use a non-scoped user access token to create a repository-scoped and/or permission-scoped user access token. You can specify

        which repositories the token can access and which permissions are granted to the

        token.


        Invalid tokens will return `404 NOT FOUND`.


        You must use [Basic Authentication](https://docs.github.com/enterprise-server@3.9/rest/overview/other-authentication-methods#basic-authentication)

        when accessing this endpoint, using the `client_id` and `client_secret` of the GitHub App

        as the username and password.'
      tags:
      - Scoped
      operationId: createscopedAccessToken
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/apps/apps#create-a-scoped-access-token
      parameters:
      - $ref: '#/components/parameters/client-id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                access_token:
                  type: string
                  description: The access token used to authenticate to the GitHub API.
                  example: e72e16c7e42f292c6912e7710c838347ae178b4a
                target:
                  description: The name of the user or organization to scope the user access token to. **Required** unless `target_id` is specified.
                  type: string
                  example: octocat
                target_id:
                  description: The ID of the user or organization to scope the user access token to. **Required** unless `target` is specified.
                  example: 1
                  type: integer
                repositories:
                  description: The list of repository names to scope the user access token to. `repositories` may not be specified if `repository_ids` is specified.
                  type: array
                  items:
                    type: string
                    example: rails
                repository_ids:
                  description: The list of repository IDs to scope the user access token to. `repository_ids` may not be specified if `repositories` is specified.
                  example:
                  - 1
                  type: array
                  items:
                    type: integer
                permissions:
                  $ref: '#/components/schemas/app-permissions'
              required:
              - access_token
            examples:
              default:
                value:
                  access_token: e72e16c7e42f292c6912e7710c838347ae178b4a
                  target: octocat
                  permissions:
                    metadata: read
                    issues: write
                    contents: read
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authorization'
              examples:
                default:
                  $ref: '#/components/examples/scope-token'
        '401':
          $ref: '#/components/responses/requires_authentication'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
        '422':
          $ref: '#/components/responses/validation_failed'
      x-github:
        githubCloudOnly: false
        enabledForGitHubApps: false
        category: apps
        subcategory: apps
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    nullable-simple-user:
      title: Simple User
      description: A GitHub user.
      type: object
      properties:
        name:
          nullable: true
          type: string
          example: octocat
        email:
          nullable: true
          type: string
          example: octocat@github.com
        login:
          type: string
          example: octocat
        id:
          type: integer
          example: 1
        node_id:
          type: string
          example: MDQ6VXNlcjE=
        avatar_url:
          type: string
          format: uri
          example: https://github.com/images/error/octocat_happy.gif
        gravatar_id:
          type: string
          example: 41d064eb2195891e12d0413f63227ea7
          nullable: true
        url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat
        html_url:
          type: string
          format: uri
          example: https://github.com/octocat
        followers_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/followers
        following_url:
          type: string
          example: https://api.github.com/users/octocat/following{/other_user}
        gists_url:
          type: string
          example: https://api.github.com/users/octocat/gists{/gist_id}
        starred_url:
          type: string
          example: https://api.github.com/users/octocat/starred{/owner}{/repo}
        subscriptions_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/subscriptions
        organizations_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/orgs
        repos_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/repos
        events_url:
          type: string
          example: https://api.github.com/users/octocat/events{/privacy}
        received_events_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/received_events
        type:
          type: string
          example: User
        site_admin:
          type: boolean
          example: true
        starred_at:
          type: string
          example: '"2020-07-09T00:17:55Z"'
      required:
      - avatar_url
      - events_url
      - followers_url
      - following_url
      - gists_url
      - gravatar_id
      - html_url
      - id
      - node_id
      - login
      - organizations_url
      - received_events_url
      - repos_url
      - site_admin
      - starred_url
      - subscriptions_url
      - type
      - url
      nullable: true
    basic-error:
      title: Basic Error
      description: Basic Error
      type: object
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        status:
          type: string
          example: open
    authorization:
      title: Authorization
      description: The authorization for an OAuth app, GitHub App, or a Personal Access Token.
      type: object
      properties:
        id:
          type: integer
          example: 42
        url:
          type: string
          format: uri
          example: https://api.github.com/repos/octocat/Hello-World
        scopes:
          description: A list of scopes that this authorization is in.
          type: array
          items:
            type: string
          nullable: true
        token:
          type: string
          example: example_value
        token_last_eight:
          type: string
          nullable: true
          example: example_value
        hashed_token:
          type: string
          nullable: true
          example: example_value
        app:
          type: object
          properties:
            client_id:
              type: string
            name:
              type: string
            url:
              type: string
              format: uri
          required:
          - client_id
          - name
          - url
        note:
          type: string
          nullable: true
          example: example_value
        note_url:
          type: string
          format: uri
          nullable: true
          example: https://api.github.com/repos/octocat/Hello-World
        updated_at:
          type: string
          format: date-time
          example: '2026-04-17T12:00:00Z'
        created_at:
          type: string
          format: date-time
          example: '2026-04-17T12:00:00Z'
        fingerprint:
          type: string
          nullable: true
          example: example_value
        user:
          $ref: '#/components/schemas/nullable-simple-user'
        installation:
          $ref: '#/components/schemas/nullable-scoped-installation'
        expires_at:
          type: string
          format: date-time
          nullable: true
          example: '2026-04-17T12:00:00Z'
      required:
      - app
      - id
      - note
      - note_url
      - scopes
      - token
      - hashed_token
      - token_last_eight
      - fingerprint
      - url
      - created_at
      - updated_at
      - expires_at
    simple-user:
      title: Simple User
      description: A GitHub user.
      type: object
      properties:
        name:
          nullable: true
          type: string
          example: octocat
        email:
          nullable: true
          type: string
          example: octocat@github.com
        login:
          type: string
          example: octocat
        id:
          type: integer
          example: 1
        node_id:
          type: string
          example: MDQ6VXNlcjE=
        avatar_url:
          type: string
          format: uri
          example: https://github.com/images/error/octocat_happy.gif
        gravatar_id:
          type: string
          example: 41d064eb2195891e12d0413f63227ea7
          nullable: true
        url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat
        html_url:
          type: string
          format: uri
          example: https://github.com/octocat
        followers_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/followers
        following_url:
          type: string
          example: https://api.github.com/users/octocat/following{/other_user}
        gists_url:
          type: string
          example: https://api.github.com/users/octocat/gists{/gist_id}
        starred_url:
          type: string
          example: https://api.github.com/users/octocat/starred{/owner}{/repo}
        subscriptions_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/subscriptions
        organizations_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/orgs
        repos_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/repos
        events_url:
          type: string
          example: https://api.github.com/users/octocat/events{/privacy}
        received_events_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/received_events
        type:
          type: string
          example: User
        site_admin:
          type: boolean
          example: true
        starred_at:
          type: string
          example: '"2020-07-09T00:17:55Z"'
      required:
      - avatar_url
      - events_url
      - followers_url
      - following_url
      - gists_url
      - gravatar_id
      - html_url
      - id
      - node_id
      - login
      - organizations_url
      - received_events_url
      - repos_url
      - site_admin
      - starred_url
      - subscriptions_url
      - type
      - url
    validation-error:
      title: Validation Error
      description: Validation Error
      type: object
      required:
      - message
      - documentation_url
      properties:
        message:
          type: string
          example: Example body text
        documentation_url:
          type: string
          example: https://api.github.com/repos/octocat/Hello-World
        errors:
          type: array
          items:
            type: object
            required:
            - code
            properties:
              resource:
                type: string
              field:
                type: string
              message:
                type: string
              code:
                type: string
              index:
                type: integer
              value:
                oneOf:
                - type: string
                  nullable: true
                - type: integer
                  nullable: true
                - type: array
                  nullable: true
                  items:
                    type: string
    nullable-scoped-installation:
      title: Scoped Installation
      type: object
      properties:
        permissions:
          $ref: '#/components/schemas/app-permissions'
        repository_selection:
          description: Describe whether all repositories have been selected or there's a selection involved
          type: string
          enum:
          - all
          - selected
          example: all
        single_file_name:
          type: string
          example: config.yaml
          nullable: true
        has_multiple_single_files:
          type: boolean
          example: true
        single_file_paths:
          type: array
          items:
            type: string
          example:
          - config.yml
          - .github/issue_TEMPLATE.md
        repositories_url:
          type: string
          format: uri
          example: https://api.github.com/users/octocat/repos
        account:
          $ref: '#/components/schemas/simple-user'
      required:
      - permissions
      - repository_selection
      - single_file_name
      - repositories_url
      - account
      nullable: true
    app-permissions:
      title: App Permissions
      type: object
      description: The permissions granted to the user access token.
      properties:
        actions:
          type: string
          description: The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts.
          enum:
          - read
          - write
          example: read
        administration:
          type: string
          description: The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation.
          enum:
          - read
          - write
          example: read
        checks:
          type: string
          description: The level of permission to grant the access token for checks on code.
          enum:
          - read
          - write
          example: read
        codespaces:
          type: string
          description: The level of permission to grant the access token to create, edit, delete, and list Codespaces.
          enum:
          - read
          - write
          example: read
        contents:
          type: string
          description: The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges.
          enum:
          - read
          - write
          example: read
        dependabot_secrets:
          type: string
          description: The leve of permission to grant the access token to manage Dependabot secrets.
          enum:
          - read
          - write
          example: read
        deployments:
          type: string
          description: The level of permission to grant the access token for deployments and deployment statuses.
          enum:
          - read
          - write
          example: read
        environments:
          type: string
          description: The level of permission to grant the access token for managing repository environments.
          enum:
          - read
          - write
          example: read
        issues:
          type: string
          description: The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones.
          enum:
          - read
          - write
          example: read
        metadata:
          type: string
          description: The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata.
          enum:
          - read
          - write
          example: read
        packages:
          type: string
          description: The level of permission to grant the access token for packages published to GitHub Packages.
          enum:
          - read
          - write
          example: read
        pages:
          type: string
          description: The level of permission to grant the access token to retrieve Pages statuses, configuration, and builds, as well as create new builds.
          enum:
          - read
          - write
          example: read
        pull_requests:
          type: string
          description: The level of permission to grant the access token for pull requests and related comments, assignees, labels, milestones, and merges.
          enum:
          - read
          - write
          example: read
        repository_hooks:
          type: string
          description: The level of permission to grant the access token to manage the post-receive hooks for a repository.
          enum:
          - read
          - write
          example: read
        repository_projects:
          type: string
          description: The level of permission to grant the access token to manage repository projects, columns, and cards.
          enum:
          - read
          - write
          - admin
          example: read
        secret_scanning_alerts:
          type: string
          description: The level of permission to grant the access token to view and manage secret scanning alerts.
          enum:
          - read
          - write
          example: read
        secrets:
          type: string
          description: The level of permission to grant the access token to manage repository secrets.
          enum:
          - read
          - write
          example: read
        security_events:
          type: string
          description: The level of permission to grant the access token to view and manage security events like code scanning alerts.
          enum:
          - read
          - write
          example: read
        single_file:
          type: string
          description: The level of permission to grant the access token to manage just a single file.
          enum:
          - read
          - write
          example: read
        statuses:
          type: string
          description: The level of permission to grant the access token for commit statuses.
          enum:
          - read
          - write
          example: read
        vulnerability_alerts:
          type: string
          description: The level of permission to grant the access token to manage Dependabot alerts.
          enum:
          - read
          - write
        workflows:
          type: string
          description: The level of permission to grant the access token to update GitHub Actions workflow files.
          enum:
          - write
        members:
          type: string
          description: The level of permission to grant the access token for organization teams and members.
          enum:
          - read
          - write
        organization_administration:
          type: string
          description: The level of permission to grant the access token to manage access to an organization.
          enum:
          - read
          - write
        organization_custom_roles:
          type: string
          description: The level of permission to grant the access token for custom repository roles management.
          enum:
          - read
          - write
        organization_copilot_seat_management:
          type: string
          description: The level of permission to grant the access token for managing access to GitHub Copilot for members of an organization with a Copilot Business subscription. This property is in beta and is subject to change.
          enum:
          - write
        organization_announcement_banners:
          type: string
          description: The level of permission to grant the access token to view and manage announcement banners for an organization.
          enum:
          - read
          - write
        organization_events:
          type: string
          description: The level of permission to grant the access token to view events triggered by an activity in an organization.
          enum:
          - read
        organization_hooks:
          type: string
          description: The level of permission to grant the access token to manage the post-receive hooks for an organization.
          enum:
          - read
          - write
        organization_personal_access_tokens:
          type: string
          description: The level of permission to grant the access token for viewing and managing fine-grained personal access token requests to an organization.
          enum:
          - read
          - write
        organization_personal_access_token_requests:
          type: string
          description: The level of permission to grant the access token for viewing and managing fine-grained personal access tokens that have been approved by an organization.
          enum:
          - read
          - write
        organization_plan:
          type: string
          description: The level of permission to grant the access token for viewing an organization's plan.
          enum:
          - read
        organization_projects:
          type: string
          description: The level of permission to grant the access token to manage organization projects and projects beta (where available).
          enum:
          - read
          - write
          - admin
        organization_packages:
          type: string
          description: The level of permission to grant the access token for organization packages published to GitHub Packages.
          enum:
          - read
          - write
        organization_secrets:
          type: string
          description: The level of permission to grant the access token to manage organization secrets.
          enum:
          - read
          - write
        organization_self_hosted_runners:
          type: string
          description: The level of permission to grant the access token to view and manage GitHub Actions self-hosted runners available to an organization.
          enum:
          - read
          - write
        organization_user_blocking:
          type: string
          description: The level of permission to grant the access token to view and manage users blocked by the organization.
          enum:
          - read
          - write
        team_discussions:
          type: string
          description: The level of permission to grant the access token to manage team discussions and related comments.
          enum:
          - read
          - write
        email_addresses:
          type: string
          description: The level of permission to grant the access token to manage the email addresses belonging to a user.
          enum:
          - read
          - write
        followers:
          type: string
          description: The level of permission to grant the access token to manage the followers belonging to a user.
          enum:
          - read
          - write
        git_ssh_keys:
          type: string
          description: The level of permission to grant the access token to manage git SSH keys.
          enum:
          - read
          - write
        gpg_keys:
          type: string
          description: The level of permission to grant the access token to view and manage GPG keys belonging to a user.
          enum:
          - read
          - write
        interaction_limits:
          type: string
          description: The level of permission to grant the access token to view and manage interaction limits on a repository.
          enum:
          - read
          - write
        profile:
          type: string
          description: The level of permission to grant the access token to manage the profile settings belonging to a user.
          enum:
          - write
        starring:
          type: string
          description: The level of permission to grant the access token to list and manage repositories a user is starring.
          enum:
          - read
          - write
      example:
        contents: read
        issues: read
        deployments: write
        single_file: read
  responses:
    not_found:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    requires_authentication:
      description: Requires authentication
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/basic-error'
    validation_failed:
      description: Validation failed, or the endpoint has been spammed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/validation-error'
  examples:
    scope-token:
      value:
        id: 1
        url: https://api.github.com/authorizations/1
        scopes: []
        token: ghu_16C7e42F292c6912E7710c838347Ae178B4a
        token_last_eight: Ae178B4a
        hashed_token: 25f94a2a5c7fbaf499c665bc73d67c1c87e496da8985131633ee0a95819db2e8
        app:
          url: http://my-github-app.com
          name: my github app
          client_id: Iv1.8a61f9b3a7aba766
        note: optional note
        note_url: http://optional/note/url
        updated_at: '2011-09-06T20:39:23Z'
        created_at: '2011-09-06T17:26:27Z'
        fingerprint: jklmnop12345678
        expires_at: '2011-09-08T17:26:27Z'
        user:
          login: octocat
          id: 1
          node_id: MDQ6VXNlcjE=
          avatar_url: https://github.com/images/error/octocat_happy.gif
          gravatar_id: ''
          url: https://api.github.com/users/octocat
          html_url: https://github.com/octocat
          followers_url: https://api.github.com/users/octocat/followers
          following_url: https://api.github.com/users/octocat/following{/other_user}
          gists_url: https://api.github.com/users/octocat/gists{/gist_id}
          starred_url: https://api.github.com/users/octocat/starred{/owner}{/repo}
          subscriptions_url: https://api.github.com/users/octocat/subscriptions
          organizations_url: https://api.github.com/users/octocat/orgs
          repos_url: https://api.github.com/users/octocat/repos
          events_url: https://api.github.com/users/octocat/events{/privacy}
          received_events_url: https://api.github.com/users/octocat/received_events
          type: User
          site_admin: false
        installation:
          permissions:
            metadata: read
            issues: write
            contents: read
          repository_selection: selected
          single_file_name: .github/workflow.yml
          repositories_url: https://api.github.com/user/repos
          account:
            login: octocat
            id: 1
            node_id: MDQ6VXNlcjE=
            avatar_url: https://github.com/images/error/octocat_happy.gif
            gravatar_id: ''
            url: https://api.github.com/users/octocat
            html_url: https://github.com/octocat
            followers_url: https://api.github.com/users/octocat/followers
            following_url: https://api.github.com/users/octocat/following{/other_user}
            gists_url: https://api.github.com/users/octocat/gists{/gist_id}
            starred_url: https://api.github.com/users/octocat/starred{/owner}{/repo}
            subscriptions_url: https://api.github.com/users/octocat/subscriptions
            organizations_url: https://api.github.com/users/octocat/orgs
            repos_url: https://api.github.com/users/octocat/repos
            events_url: https://api.github.com/users/octocat/events{/privacy}
            received_events_url: https://api.github.com/users/octocat/received_events
            type: User
            site_admin: false
          has_multiple_single_files: false
          single_file_paths: []
  parameters:
    client-id:
      name: client_id
      in: path
      required: true
      description: The client ID of the GitHub app.
      schema:
        type: string
      examples:
        default:
          value: Iv1.8a61f9b3a7aba766
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/
x-webhooks:
  branch-protection-rule-created:
    post:
      summary: 'This event occurs when there is activity relating to branch protection rules. For more information, see "[About protected branches](https://docs.github.com/enterprise-server@3.9/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches)." For information about the APIs to manage branch protection rules, see [the GraphQL documentation](https://docs.github.com/enterprise-server@3.9/graphql/reference/objects#branchprotectionrule) or "[Branch protection](https://docs.github.com/enterprise-server@3.9/rest/branches/branch-protection)" in the REST API documentation.


        To subscribe to this event, a GitHub App must have at least read-level access for the "Administration" repository permission.'
      description: A branch protection rule was created.
      operationId: branch-protection-rule/created
      externalDocs:
        url: https://docs.github.com/enterprise-server@3.9/webhooks/webhook-events-and-payloads#branch_protection_rule
      parameters:
      - name: User-Agent
        in: header
        example: GitHub-Hookshot/123abc
        schema:
          type: string
      - name: X-Github-Hook-Id
        in: header
        example: 12312312
        schema:
          type: string
      - name: X-Github-Event
        in: header
        example: issues
        schema:
          type: string
      - name: X-Github-Hook-Installation-Target-Id
        in: header
        example: 123123
        schema:
          type: string
      - name: X-Github-Hook-Installation-Target-Type
        in: header
        example: repository
        schema:
          type: string
      - name: X-GitHub-Delivery
        in: header
        example: 0b989ba4-242f-11e5-81e1-c7b6966d2516
        schema:
          type: string
      - name: X-Hub-Signature-256
        in: header
        example: sha256=6dcb09b5b57875f334f61aebed695e2e4193db5e
        schema:
          type: string
      - name: X-GitHub-Enterprise-Version
        in: header
        example: 3.1.9
        schema:
          type: string
      - name: X-GitHub-Enterprise-Host
        in: header
        example: ghes.github.com
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/webhook-branch-protection-rule-created'
      responses:
        '200':
          description: Return a 200 status to indicate that the data 

# --- truncated at 32 KB (631 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/github/refs/heads/main/openapi/github-scoped-api-openapi.yml