Grants and scopes
Scopes
Section titled “Scopes”| Value | Meaning |
|---|---|
ALL_REPO | All current and future repositories you own |
SELECTED_REPO | Only repository_ids listed at create/update |
Grants
Section titled “Grants”ALL matches every check. GIT_HTTP_WRITE implies GIT_HTTP_READ.
| Operation | Grant |
|---|---|
GET /v1/account/usage | any token |
GET /v1/repositories | any token (filtered by scope) |
GET /v1/repos/{user}/{name} | any token that includes that repo |
| Create / delete repo | API_REPOS_WRITE |
git clone / fetch | GIT_HTTP_READ |
git push | GIT_HTTP_WRITE |
| Branches / commits API | API_COMMITS_READ |
| Webhooks | API_WEBHOOKS |
| BYO storage | API_STORAGE |
| OIDC trust rules | API_OIDC_TRUST (and ALL_REPO) |
| Access token admin | ALL and ALL_REPO |
OIDC-exchanged tokens carry the grants on the matching trust rule.