GitHub Cloud API endpoints

Overview

Glean uses GitHub's standard REST API to crawl your GitHub Cloud organization, plus the git protocol to clone repository contents. Every permission Glean uses is read-only.

GitHub App permissions

Glean requests the following read-only permissions, grouped by the level they apply to. How the permissions are set depends on which setup path you use:

• GitHub Cloud: the permissions belong to the Glean GitHub App. They are set when the App is installed, and organization admins cannot scope them down or expand them.
• GitHub Enterprise Cloud: a GitHub enterprise owner creates a custom App and sets the same read-only permissions when creating it, including the Organization and Enterprise permissions described below. See Set up GitHub Cloud.

Repository

Permission	Access	What it covers
Administration	Read-only	Repository settings and metadata
Contents	Read-only	Code, files, commits, and READMEs
Commit statuses	Read-only	Commit status checks
Issues	Read-only	Issues and issue comments
Metadata	Read-only	Basic repository information (always required)
Pull requests	Read-only	Pull requests, reviews, comments, and diffs
Pages	Read-only	GitHub Pages content for legacy gh-pages sites

Organization

Permission	Access	What it covers
Members	Read-only	Organization members and teams, for permission resolution

User

Permission	Access	What it covers
Email addresses	Read-only	The user's GitHub email, granted through per-user OAuth so identity can be matched

Enterprise

Enterprise permissions apply only to the GitHub Enterprise Cloud setup path, where Glean crawls identity at the enterprise level rather than one organization at a time.

Permission	Access	What it covers
Enterprise people	Read-only	Enterprise members, so Glean can match them to Glean users
Enterprise teams	Read-only	Enterprise teams, for permission resolution

API endpoints

Endpoint	Permissions	URL
List installations for the authenticated app	Read	/app/installations
Create an installation access token for an app		/app/installations/%/access_token
List repositories accessible to the app installation	Read	/installation/repositories
Organization permissions for Members	Read	/org/%/members
List organization teams	Read	/org/%/teams
List team members	Read	/org/%/teams/%/members
List team repositories	Read	/org/%/teams/%/repos
Repository permissions for Metadata (repository)	Read	/repos/%
Repository permissions for Issues	Read	/repos/%/issues
Repository permissions for Issues (comments)	Read	/repos/%/issues/%/comments
Repository permissions for Pull requests	Read	/repos/%/pulls
Repository permissions for Pull requests (detail)	Read	/repos/%/pulls/%
Repository permissions for Pull requests (comments)	Read	/repos/%/pulls/%/comments
Repository permissions for Pull requests (reviews)	Read	/repos/%/pulls/%/reviews
Repository permissions for Metadata (collaborators)	Read	/repos/%/collaborators
Per-user OAuth: request a user's GitHub identity (scope user:email) to get a code	Read	/login/oauth/authorize
Per-user OAuth: exchange the code for an access token		/login/oauth/access_token
Per-user OAuth: get the authenticated user (scope user:email)		/user
User permissions for Email addresses	Read	/user/emails

Git protocol endpoints

In addition to the REST API, the connector uses the git protocol to read repository contents. These endpoints are prefixed by the configured git domain:

GET  /<repository-name>.git/info/refs?service=git-upload-pack
POST /<repository-name>.git/git-upload-pack