--- title: "Create a scoped access token" method: POST path: "/applications/{client_id}/token/scoped" tags: ["apps"] --- # Create a scoped access token `POST /applications/{client_id}/token/scoped` Use a non-scoped user access token to create a repository-scoped and/or permission-scoped user access token. You can specify which repositories the token can access and which permissions are granted to the token. Invalid tokens will return `404 NOT FOUND`. ## Path parameters - `client_id` string, required ## Request body - object - `access_token` string, required — The access token used to authenticate to the GitHub API. - `target` string — The name of the user or organization to scope the user access token to. **Required** unless `target_id` is specified. - `target_id` integer — The ID of the user or organization to scope the user access token to. **Required** unless `target` is specified. - `repositories` string[] — The list of repository names to scope the user access token to. `repositories` may not be specified if `repository_ids` is specified. - `repository_ids` integer[] — The list of repository IDs to scope the user access token to. `repository_ids` may not be specified if `repositories` is specified. - `permissions` AppPermissions — The permissions granted to the fine-grained access token. - `actions` 'read' | 'write' — The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts. - `administration` 'read' | 'write' — The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation. - `artifact_metadata` 'read' | 'write' — The level of permission to grant the access token to create and retrieve build artifact metadata records. - `attestations` 'read' | 'write' — The level of permission to create and retrieve the access token for repository attestations. - `checks` 'read' | 'write' — The level of permission to grant the access token for checks on code. - `code_quality` 'read' | 'write' — The level of permission to grant the access token to view and manage code quality data. - `codespaces` 'read' | 'write' — The level of permission to grant the access token to create, edit, delete, and list Codespaces. - `contents` 'read' | 'write' — The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. - `dependabot_secrets` 'read' | 'write' — The level of permission to grant the access token to manage Dependabot secrets. - `deployments` 'read' | 'write' — The level of permission to grant the access token for deployments and deployment statuses. - `discussions` 'read' | 'write' — The level of permission to grant the access token for discussions and related comments and labels. - `environments` 'read' | 'write' — The level of permission to grant the access token for managing repository environments. - `issues` 'read' | 'write' — The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones. - `merge_queues` 'read' | 'write' — The level of permission to grant the access token to manage the merge queues for a repository. - `metadata` 'read' | 'write' — The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata. - `packages` 'read' | 'write' — The level of permission to grant the access token for packages published to GitHub Packages. - `pages` 'read' | 'write' — The level of permission to grant the access token to retrieve Pages statuses, configuration, and builds, as well as create new builds. - `pull_requests` 'read' | 'write' — The level of permission to grant the access token for pull requests and related comments, assignees, labels, milestones, and merges. - `repository_custom_properties` 'read' | 'write' — The level of permission to grant the access token to view and edit custom properties for a repository, when allowed by the property. - `repository_hooks` 'read' | 'write' — The level of permission to grant the access token to manage the post-receive hooks for a repository. - `repository_projects` 'read' | 'write' | 'admin' — The level of permission to grant the access token to manage repository projects, columns, and cards. - `secret_scanning_alerts` 'read' | 'write' — The level of permission to grant the access token to view and manage secret scanning alerts. - `secrets` 'read' | 'write' — The level of permission to grant the access token to manage repository secrets. - `security_events` 'read' | 'write' — The level of permission to grant the access token to view and manage security events like code scanning alerts. - `single_file` 'read' | 'write' — The level of permission to grant the access token to manage just a single file. - `statuses` 'read' | 'write' — The level of permission to grant the access token for commit statuses. - `vulnerability_alerts` 'read' | 'write' — The level of permission to grant the access token to manage Dependabot alerts. - `workflows` 'write' — The level of permission to grant the access token to update GitHub Actions workflow files. - `custom_properties_for_organizations` 'read' | 'write' — The level of permission to grant the access token to view and edit custom properties for an organization, when allowed by the property. - `members` 'read' | 'write' — The level of permission to grant the access token for organization teams and members. - `organization_administration` 'read' | 'write' — The level of permission to grant the access token to manage access to an organization. - `organization_custom_roles` 'read' | 'write' — The level of permission to grant the access token for custom repository roles management. - `organization_custom_org_roles` 'read' | 'write' — The level of permission to grant the access token for custom organization roles management. - `organization_custom_properties` 'read' | 'write' | 'admin' — The level of permission to grant the access token for repository custom properties management at the organization level. - `organization_copilot_seat_management` 'read' | 'write' — The level of permission to grant the access token for managing access to GitHub Copilot for members of an organization with a Copilot Business subscription. This property is in public preview and is subject to change. - `organization_copilot_agent_settings` 'read' | 'write' — The level of permission to grant the access token to view and manage Copilot cloud agent settings for an organization. - `organization_announcement_banners` 'read' | 'write' — The level of permission to grant the access token to view and manage announcement banners for an organization. - `organization_events` 'read' — The level of permission to grant the access token to view events triggered by an activity in an organization. - `organization_hooks` 'read' | 'write' — The level of permission to grant the access token to manage the post-receive hooks for an organization. - `organization_personal_access_tokens` 'read' | 'write' — The level of permission to grant the access token for viewing and managing fine-grained personal access token requests to an organization. - `organization_personal_access_token_requests` 'read' | 'write' — The level of permission to grant the access token for viewing and managing fine-grained personal access tokens that have been approved by an organization. - `organization_plan` 'read' — The level of permission to grant the access token for viewing an organization's plan. - `organization_projects` 'read' | 'write' | 'admin' — The level of permission to grant the access token to manage organization projects and projects public preview (where available). - `organization_packages` 'read' | 'write' — The level of permission to grant the access token for organization packages published to GitHub Packages. - `organization_secrets` 'read' | 'write' — The level of permission to grant the access token to manage organization secrets. - `organization_self_hosted_runners` 'read' | 'write' — The level of permission to grant the access token to view and manage GitHub Actions self-hosted runners available to an organization. - `organization_user_blocking` 'read' | 'write' — The level of permission to grant the access token to view and manage users blocked by the organization. - `email_addresses` 'read' | 'write' — The level of permission to grant the access token to manage the email addresses belonging to a user. - `followers` 'read' | 'write' — The level of permission to grant the access token to manage the followers belonging to a user. - `git_ssh_keys` 'read' | 'write' — The level of permission to grant the access token to manage git SSH keys. - `gpg_keys` 'read' | 'write' — The level of permission to grant the access token to view and manage GPG keys belonging to a user. - `interaction_limits` 'read' | 'write' — The level of permission to grant the access token to view and manage interaction limits on a repository. - `profile` 'write' — The level of permission to grant the access token to manage the profile settings belonging to a user. - `starring` 'read' | 'write' — The level of permission to grant the access token to list and manage repositories a user is starring. - `enterprise_custom_properties_for_organizations` 'read' | 'write' | 'admin' — The level of permission to grant the access token for organization custom properties management at the enterprise level. ## Response `200` Response - Authorization — The authorization for an OAuth app, GitHub App, or a Personal Access Token. - `id` integer, required - `url` string, uri, required - `scopes` string[], nullable, required — A list of scopes that this authorization is in. - `token` string, required - `token_last_eight` string, nullable, required - `hashed_token` string, nullable, required - `app` object, required - `client_id` string, required - `name` string, required - `url` string, uri, required - `note` string, nullable, required - `note_url` string, uri, nullable, required - `updated_at` string, date-time, required - `created_at` string, date-time, required - `fingerprint` string, nullable, required - `user` NullableSimpleUser, nullable — A GitHub user. - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - `installation` NullableScopedInstallation, nullable - `permissions` AppPermissions, required — The permissions granted to the fine-grained access token. - `actions` 'read' | 'write' — The level of permission to grant the access token for GitHub Actions workflows, workflow runs, and artifacts. - `administration` 'read' | 'write' — The level of permission to grant the access token for repository creation, deletion, settings, teams, and collaborators creation. - `artifact_metadata` 'read' | 'write' — The level of permission to grant the access token to create and retrieve build artifact metadata records. - `attestations` 'read' | 'write' — The level of permission to create and retrieve the access token for repository attestations. - `checks` 'read' | 'write' — The level of permission to grant the access token for checks on code. - `code_quality` 'read' | 'write' — The level of permission to grant the access token to view and manage code quality data. - `codespaces` 'read' | 'write' — The level of permission to grant the access token to create, edit, delete, and list Codespaces. - `contents` 'read' | 'write' — The level of permission to grant the access token for repository contents, commits, branches, downloads, releases, and merges. - `dependabot_secrets` 'read' | 'write' — The level of permission to grant the access token to manage Dependabot secrets. - `deployments` 'read' | 'write' — The level of permission to grant the access token for deployments and deployment statuses. - `discussions` 'read' | 'write' — The level of permission to grant the access token for discussions and related comments and labels. - `environments` 'read' | 'write' — The level of permission to grant the access token for managing repository environments. - `issues` 'read' | 'write' — The level of permission to grant the access token for issues and related comments, assignees, labels, and milestones. - `merge_queues` 'read' | 'write' — The level of permission to grant the access token to manage the merge queues for a repository. - `metadata` 'read' | 'write' — The level of permission to grant the access token to search repositories, list collaborators, and access repository metadata. - `packages` 'read' | 'write' — The level of permission to grant the access token for packages published to GitHub Packages. - `pages` 'read' | 'write' — The level of permission to grant the access token to retrieve Pages statuses, configuration, and builds, as well as create new builds. - `pull_requests` 'read' | 'write' — The level of permission to grant the access token for pull requests and related comments, assignees, labels, milestones, and merges. - `repository_custom_properties` 'read' | 'write' — The level of permission to grant the access token to view and edit custom properties for a repository, when allowed by the property. - `repository_hooks` 'read' | 'write' — The level of permission to grant the access token to manage the post-receive hooks for a repository. - `repository_projects` 'read' | 'write' | 'admin' — The level of permission to grant the access token to manage repository projects, columns, and cards. - `secret_scanning_alerts` 'read' | 'write' — The level of permission to grant the access token to view and manage secret scanning alerts. - `secrets` 'read' | 'write' — The level of permission to grant the access token to manage repository secrets. - `security_events` 'read' | 'write' — The level of permission to grant the access token to view and manage security events like code scanning alerts. - `single_file` 'read' | 'write' — The level of permission to grant the access token to manage just a single file. - `statuses` 'read' | 'write' — The level of permission to grant the access token for commit statuses. - `vulnerability_alerts` 'read' | 'write' — The level of permission to grant the access token to manage Dependabot alerts. - `workflows` 'write' — The level of permission to grant the access token to update GitHub Actions workflow files. - `custom_properties_for_organizations` 'read' | 'write' — The level of permission to grant the access token to view and edit custom properties for an organization, when allowed by the property. - `members` 'read' | 'write' — The level of permission to grant the access token for organization teams and members. - `organization_administration` 'read' | 'write' — The level of permission to grant the access token to manage access to an organization. - `organization_custom_roles` 'read' | 'write' — The level of permission to grant the access token for custom repository roles management. - `organization_custom_org_roles` 'read' | 'write' — The level of permission to grant the access token for custom organization roles management. - `organization_custom_properties` 'read' | 'write' | 'admin' — The level of permission to grant the access token for repository custom properties management at the organization level. - `organization_copilot_seat_management` 'read' | 'write' — The level of permission to grant the access token for managing access to GitHub Copilot for members of an organization with a Copilot Business subscription. This property is in public preview and is subject to change. - `organization_copilot_agent_settings` 'read' | 'write' — The level of permission to grant the access token to view and manage Copilot cloud agent settings for an organization. - `organization_announcement_banners` 'read' | 'write' — The level of permission to grant the access token to view and manage announcement banners for an organization. - `organization_events` 'read' — The level of permission to grant the access token to view events triggered by an activity in an organization. - `organization_hooks` 'read' | 'write' — The level of permission to grant the access token to manage the post-receive hooks for an organization. - `organization_personal_access_tokens` 'read' | 'write' — The level of permission to grant the access token for viewing and managing fine-grained personal access token requests to an organization. - `organization_personal_access_token_requests` 'read' | 'write' — The level of permission to grant the access token for viewing and managing fine-grained personal access tokens that have been approved by an organization. - `organization_plan` 'read' — The level of permission to grant the access token for viewing an organization's plan. - `organization_projects` 'read' | 'write' | 'admin' — The level of permission to grant the access token to manage organization projects and projects public preview (where available). - `organization_packages` 'read' | 'write' — The level of permission to grant the access token for organization packages published to GitHub Packages. - `organization_secrets` 'read' | 'write' — The level of permission to grant the access token to manage organization secrets. - `organization_self_hosted_runners` 'read' | 'write' — The level of permission to grant the access token to view and manage GitHub Actions self-hosted runners available to an organization. - `organization_user_blocking` 'read' | 'write' — The level of permission to grant the access token to view and manage users blocked by the organization. - `email_addresses` 'read' | 'write' — The level of permission to grant the access token to manage the email addresses belonging to a user. - `followers` 'read' | 'write' — The level of permission to grant the access token to manage the followers belonging to a user. - `git_ssh_keys` 'read' | 'write' — The level of permission to grant the access token to manage git SSH keys. - `gpg_keys` 'read' | 'write' — The level of permission to grant the access token to view and manage GPG keys belonging to a user. - `interaction_limits` 'read' | 'write' — The level of permission to grant the access token to view and manage interaction limits on a repository. - `profile` 'write' — The level of permission to grant the access token to manage the profile settings belonging to a user. - `starring` 'read' | 'write' — The level of permission to grant the access token to list and manage repositories a user is starring. - `enterprise_custom_properties_for_organizations` 'read' | 'write' | 'admin' — The level of permission to grant the access token for organization custom properties management at the enterprise level. - `repository_selection` 'all' | 'selected', required — Describe whether all repositories have been selected or there's a selection involved - `single_file_name` string, nullable, required - `has_multiple_single_files` boolean - `single_file_paths` string[] - `repositories_url` string, uri, required - `account` SimpleUser, required — A GitHub user. - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - `expires_at` string, date-time, nullable, required ## Other responses - `401` — Requires authentication - `403` — Forbidden - `404` — Resource not found - `422` — Validation failed, or the endpoint has been spammed. --- [API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)