Create Repo returning 403?

[FlorianEagox]

I’ve also asked this question on StackOverflow here:

stackoverflow.com

GitHub API Create Repo returning 403?

github, request, github-api, github-api-v3

asked by Seth Painter on 09:15PM - 27 Oct 20 UTC

I’m making a GitHub app, and I’m trying to create a repo according to this documentation

docs.github.com

Repositories - GitHub Docs

When I make a GET request to that URL, it works and I get the user’s repos, but making a post request like this:

curl --request POST \
  --url https://api.github.com/user/repos \
  --header 'authorization: token  [user_access_token]' \
  --data '{"name": "test"}'

Returns this

{
  "message": "Resource not accessible by integration",
  "documentation_url": "https://docs.github.com/rest/reference/repos#create-a-repository-for-the-authenticated-user"
}

My app has these permissions

image1087×563 47.9 KB

[nethgato]

Hey there @TheFoxarmy 👋

Thanks so much for joining our Community and for submitting your post. I appreciate the details you’ve provided, though I think there may be a confusion about where that scope needs to be defined.

You’ve shown us the permissions that the repository itself has in relation to the installation of your app, but the repo scope needs to be defined for the application’s token and not within the repository’s permissions.

Relevant documentation for this lives here:

docs.github.com

Scopes for OAuth Apps - GitHub Docs

This should be what you need!

If you can verify that the token that your app leverages has the appropriate scope defined and you are still experiencing this problem, please let us know. 🙇

[FlorianEagox]

Hi, so your post and further reading about this subject has actually lead me to conclude that creating repos is a feature of OAuth Apps, not GitHub Apps?
I believe this is the case, and after switching to using an OAuth app instead of a GitHub app, I am no longer experiencing this problem and haven’t found any loss in functionality with my app.
If this is the case, I would hope that going forward, the documentation becomes more clear about what can and should be done with each authentication strategy for each API function.