GitHub Cloud API endpoints

Overview

Glean uses GitHub's standard REST API to crawl your GitHub Cloud organization, plus the git protocol to clone repository contents. All GitHub App permissions are fixed and read-only: organization admins cannot change them.

GitHub App permissions

The Glean GitHub App requests the following read-only permissions. They are set when the App is installed and cannot be scoped down or expanded per organization. Permissions are grouped by the level they apply to.

Repository

Permission	Access	What it covers
Administration	Read-only	Repository settings and metadata
Contents	Read-only	Code, files, commits, and READMEs
Commit statuses	Read-only	Commit status checks
Issues	Read-only	Issues and issue comments
Metadata	Read-only	Basic repository information (always required)
Pull requests	Read-only	Pull requests, reviews, comments, and diffs
Pages	Read-only	GitHub Pages content for legacy gh-pages sites

Organization

Permission	Access	What it covers
Members	Read-only	Organization members and teams, for permission resolution

User

Permission	Access	What it covers
Email addresses	Read-only	The user's GitHub email, granted through per-user OAuth so identity can be matched

API endpoints

Endpoint	Permissions	URL
List installations for the authenticated app	Read	/app/installations
Create an installation access token for an app		/app/installations/%/access_token
Repository permissions for Metadata (repositories)	Read	/org/%/repos
Organization permissions for Members	Read	/org/%/members
List organization teams	Read	/org/%/teams
List team members	Read	/org/%/teams/%/members
List team repositories	Read	/org/%/teams/%/repos
Repository permissions for Metadata (repository)	Read	/repos/%
Repository permissions for Issues	Read	/repos/%/issues
Repository permissions for Issues (comments)	Read	/repos/%/issues/%/comments
Repository permissions for Pull requests	Read	/repos/%/pulls
Repository permissions for Pull requests (detail)	Read	/repos/%/pulls/%
Repository permissions for Pull requests (comments)	Read	/repos/%/pulls/%/comments
Repository permissions for Pull requests (reviews)	Read	/repos/%/pulls/%/reviews
Repository permissions for Metadata (collaborators)	Read	/repos/%/collaborators
Per-user OAuth: request a user's GitHub identity (scope user:email) to get a code	Read	/login/oauth/authorize
Per-user OAuth: exchange the code for an access token		/login/oauth/access_token
Per-user OAuth: get the authenticated user (scope user:email)		/user
User permissions for Email addresses	Read	/user/emails

Git protocol endpoints

In addition to the REST API, the connector uses the git protocol to read repository contents. These endpoints are prefixed by the configured git domain:

GET  /<repository-name>.git/info/refs?service=git-upload-pack
POST /<repository-name>.git/git-upload-pack