github / github/roadmap

Fine-grained PATs can call Enterprise APIs [Public Preview]

Open
#1,119 0 comments 0 reactions 0 assignees View on GitHub
Copilot Enterprise Copilot for Business Enterprise Paused
Dominant language
No language data
Stars
8.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

### Value Prop

Today, only PATs (Personal Access Tokens) _Classic_ can interact with the Enterprise account - managing SCIM and users, creating organizations, setting policy, and provisioning self-hosted runners, as popular examples. By switching to fine-grained PATs for these APIs, enterprises get a better least-privilege security posture. With this release, you can use tokens with _just_ enough permission to accomplish the job instead of a PAT (Classic) that requires permission to do _anything_ to your enterprise.

### Expected Outcome

This release trails https://github.com/github/roadmap/issues/793, which establishes the fine-grained permissions model for the enterprise. Because each API must be updated individually to support new permissions, not every single API will be supported at the time of the public preview. We are prioritizing the most popular APIs to ensure that enterprises can replace the highest number of PATs (Classic), and will ship with at least those for the public preview.

These APIs are:
1. Self-hosted runner management
2. Organization creation
3. SCIM support, for platforms that cannot use a GitHub App for provisioning
4. Enterprise team creation and management
5. Budgeting and Licensing management

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.