| name | example | route | scope | type |
|---|---|---|---|---|
Create a scoped access token |
octokit.apps.scopeToken({ client_id }) |
POST /applications/{client_id}/token/scoped |
apps |
API method |
Exchanges a non-repository scoped user-to-server OAuth access token for a repository scoped user-to-server OAuth access token. You can specify which repositories the token can access and which permissions are granted to the token. You must use Basic Authentication when accessing this endpoint, using the OAuth application's client_id and client_secret as the username and password. Invalid tokens will return 404 NOT FOUND.
octokit.apps.scopeToken({
client_id,
});| name | required | description |
|---|---|---|
| client_id | yes |
The client ID of your GitHub app. |
| access_token | no |
Required. The OAuth access token used to authenticate to the GitHub API. |
| target | no |
The name of the user or organization to scope the user-to-server access token to. Required unless |
| target_id | no |
The ID of the user or organization to scope the user-to-server access token to. Required unless |
| repositories | no |
The list of repository IDs to scope the user-to-server access token to. |
| repository_ids | no |
The list of repository names to scope the user-to-server access token to. |
| permissions | no |
The permissions granted to the user-to-server access token. |
| permissions.actions | no |
The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts. Can be one of: |
| permissions.administration | no |
The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation. Can be one of: |
| permissions.checks | no |
The level of permission to grant the access token for checks on code. Can be one of: |
| permissions.content_references | no |
The level of permission to grant the access token for notification of content references and creation content attachments. Can be one of: |
| permissions.contents | no |
The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. Can be one of: |
| permissions.deployments | no |
The level of permission to grant the access token for deployments and deployment statuses. Can be one of: |
| permissions.environments | no |
The level of permission to grant the access token for managing repository environments. Can be one of: |
| permissions.issues | no |
The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones. Can be one of: |
| permissions.metadata | no |
The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata. Can be one of: |
| permissions.packages | no |
The level of permission to grant the access token for packages published to GitHub Packages. Can be one of: |
| permissions.pages | no |
The level of permission to grant the access token to retrieve Pages statuses, configuration, and builds, as well as create new builds. Can be one of: |
| permissions.pull_requests | no |
The level of permission to grant the access token for pull requests and related comments, assignees, labels, milestones, and merges. Can be one of: |
| permissions.repository_hooks | no |
The level of permission to grant the access token to manage the post-receive hooks for a repository. Can be one of: |
| permissions.repository_projects | no |
The level of permission to grant the access token to manage repository projects, columns, and cards. Can be one of: |
| permissions.secret_scanning_alerts | no |
The level of permission to grant the access token to view and manage secret scanning alerts. Can be one of: |
| permissions.secrets | no |
The level of permission to grant the access token to manage repository secrets. Can be one of: |
| permissions.security_events | no |
The level of permission to grant the access token to view and manage security events like code scanning alerts. Can be one of: |
| permissions.single_file | no |
The level of permission to grant the access token to manage just a single file. Can be one of: |
| permissions.statuses | no |
The level of permission to grant the access token for commit statuses. Can be one of: |
| permissions.vulnerability_alerts | no |
The level of permission to grant the access token to retrieve Dependabot alerts. Can be one of: |
| permissions.workflows | no |
The level of permission to grant the access token to update GitHub Actions workflow files. Can be one of: |
| permissions.members | no |
The level of permission to grant the access token for organization teams and members. Can be one of: |
| permissions.organization_administration | no |
The level of permission to grant the access token to manage access to an organization. Can be one of: |
| permissions.organization_hooks | no |
The level of permission to grant the access token to manage the post-receive hooks for an organization. Can be one of: |
| permissions.organization_plan | no |
The level of permission to grant the access token for viewing an organization's plan. Can be one of: |
| permissions.organization_projects | no |
The level of permission to grant the access token to manage organization projects, columns, and cards. Can be one of: |
| permissions.organization_secrets | no |
The level of permission to grant the access token to manage organization secrets. Can be one of: |
| permissions.organization_self_hosted_runners | no |
The level of permission to grant the access token to view and manage GitHub Actions self-hosted runners available to an organization. Can be one of: |
| permissions.organization_user_blocking | no |
The level of permission to grant the access token to view and manage users blocked by the organization. Can be one of: |
| permissions.team_discussions | no |
The level of permission to grant the access token to manage team discussions and related comments. Can be one of: |
See also: GitHub Developer Guide documentation.