Bug: GitHub connector rejects organization Projects V2 API endpoints

Environment

• ChatGPT GitHub connector
• GitHub organization: ""
• Private repository: ""
• Private organization-owned GitHub Project: ""

Expected behavior

The GitHub connector should allow access to GitHub Projects V2 organization endpoints when the connected GitHub account has the required Projects permission.

GitHub's current REST API documents:

"GET https://api.github.com/orgs//projectsV2/<project_number>"

"GET https://api.github.com/orgs//projectsV2/<project_number>/items"

Actual behavior

The connector rejects both endpoints before the request reaches GitHub.

Error:

"HTTP 400: GitHub Fetch URL is not an allowed public GitHub repository or search endpoint."

This is a connector-side HTTP 400, not a GitHub 401/403 authorization response.

Verification

The same ChatGPT GitHub connection successfully accesses the authorized private repository through repository-level GitHub connector operations.

The same GitHub Project V2 is accessible from the user's authorized "gh" CLI environment.

The tested "projectsV2" URLs are the current GitHub REST API endpoints, not legacy Projects API URLs.

Impact

The GitHub connector can access the private repository but cannot access the organization's Projects V2 data. This prevents Project-level inspection, auditing, and automation through the connector.

Requested fix

Support GitHub Projects V2 organization endpoints through the GitHub connector, respecting the permissions of the connected GitHub account/App installation.

In particular, support:

• Organization Project V2 metadata
• Project V2 items
• Project V2 fields

Reproduction

1. Connect GitHub to ChatGPT/Codex.

2. Ensure the connector has access to a private repository in "".

3. Request the organization Projects V2 endpoint:

   "GET https://api.github.com/orgs//projectsV2/<project_number>"

4. Observe the connector-side HTTP 400 rejection.

5. Repeat with:

   "GET https://api.github.com/orgs//projectsV2/<project_number>/items"

6. Observe the same rejection.

Start by reproducing the connector-side HTTP 400 with the documented organization Projects V2 metadata and items URLs. Trace the GitHub connector's URL validation or allowlist entry point and compare it with the existing private repository access path. Done means authorized organization Projects V2 metadata, items, and fields requests are accepted while unauthorized requests remain protected.