Repository navigation
Repository security advisories REST docs list repository_advisories:read / repository_advisories:write OAuth scopes that GitHub rejects as invalid #46013
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
https://docs.github.com/en/rest/security-advisories/repository-advisories
What part(s) of the article would you like to see updated?
Six endpoints on this page say that OAuth app tokens and personal access tokens (classic) can use either repo or a repository_advisories:* scope:
| Endpoint | Scope named in the docs |
|---|---|
| List repository security advisories for an organization | repository_advisories:write |
| List repository security advisories | repository_advisories:read |
| Create a repository security advisory | repository_advisories:write |
| Get a repository security advisory | repository_advisories:read |
| Update a repository security advisory | repository_advisories:write |
| Request a CVE for a repository security advisory | repository_advisories:write |
For example, "Get a repository security advisory" says:
OAuth app tokens and personal access tokens (classic) need the
repoorrepository_advisories:readscope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.
GitHub's OAuth authorization server does not accept either scope. Requesting a device code with only that scope returns invalid_scope, the same response as a made-up scope name. Valid scopes return a device code:
curl -s -X POST -H "Accept: application/json" \
-d "client_id=<any OAuth app client ID>&scope=repository_advisories:read" \
https://github.com/login/device/code
| Requested scope | Response |
|---|---|
repo |
device code issued |
notifications |
device code issued |
security_events |
device code issued |
read:org, read:packages, write:discussion, admin:repo_hook, read:user |
device code issued |
repo repository_advisories:read |
invalid_scope, naming only repository_advisories:read |
repository_advisories:read |
{"error":"invalid_scope","error_description":"The scopes requested are invalid: repository_advisories:read."} |
repository_advisories:write |
{"error":"invalid_scope","error_description":"The scopes requested are invalid: repository_advisories:write."} |
nonexistent_scope_xyz, nonexistent:read |
invalid_scope |
The other colon-separated scopes are accepted, so the colon is not the cause.
The scopes are also missing from Scopes for OAuth apps, so the two pages contradict each other. The "New personal access token (classic)" page at https://github.com/settings/tokens/new does not offer them either.
Could the docs either drop the repository_advisories:* alternative and name repo as the only scope, or, if these scopes are meant to exist, add them to the scopes page and note when they became available?
The mistake costs readers real effort. repo grants read and write access to every private repository the user can reach. Someone who only wants to track their own private vulnerability reports sees the narrower scope in the docs, designs around it, and learns it doesn't exist only when the token request fails.
Additional information
- The spec file carries the same wording:
descriptions/api.github.com/api.github.com.jsoningithub/rest-api-description(checked 2026-09-22 UTC). - Tested against github.com on 2026-09-22 UTC. No token was issued with the rejected scopes, so I have not observed how the API endpoints themselves behave with them.
Activity
subatoi commentedon Sep 22, 2026
Hello—please reopen this issue against https://github.com/github/rest-api-description as that's where API content is managed from. Thank you