CLI reports `delete_repo` scope needed on 403 for /dependabot/alerts endpoint

Open Beginner friendly
  • Is something wrong?
#14,962 1 comment 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github, go
Domain
backend-api-design, cli

Research direction

Start by tracing how the CLI interprets the X-Accepted-Oauth-Scopes response header and formats the missing-scope hint for API errors; the issue provides a reproducible gh api command and response. Check the related tests and add coverage for a 403 response where the reported scope is misleading. Done when the CLI no longer tells users to request delete_repo for this Dependabot alerts error.

Written by the indexing model from the issue text.

Description

needs-triage
Describe the bug

When using the gh CLI, when hitting the /repos/$ORG/$REPO/dependabot/alerts endpoint, a 403 error is accompanied by the message "gh: This API operation needs the "delete_repo" scope."

Affected version
gh version 2.103.3 (2026-10-26)
https://github.com/cli/cli/releases/tag/v2.103.3
Steps to reproduce the behavior
  1. Create a repo
  2. Do not enable dependabot alerts for it and/or have a token that doesn't no have permissions to read the alerts
  3. List them via the CLI
Expected vs actual behavior

Expected: The error message says what scopes are actually needed.

Actual: The error messages tells me I need to be able to delete my repo in order to read security alerts.

Logs
GH_DEBUG=api gh api -H 'Accept: application/vnd.github+json' -H 'X-GitHub-Api-Version: 2026-03-10' --paginate --jq '.[]' '/repos/$ORG/$REPO/dependabot/alerts?state=open&per_page=100'
* Request to https://api.github.com/repos/$ORG/$REPO/dependabot/alerts?state=open&per_page=100
> GET /repos/$ORG/$REPO/dependabot/alerts?state=open&per_page=100 HTTP/1.1
> Host: api.github.com
> Accept: application/vnd.github+json
> Content-Type: application/json; charset=utf-8
> User-Agent: GitHub CLI 2.103.3
> X-Github-Api-Version: 2026-03-10

< HTTP/2.0 403 Forbidden
< Content-Type: application/json; charset=utf-8
< Server: github.com
< X-Accepted-Oauth-Scopes: admin:repo_hook, delete_repo, read:repo_hook, repo, repo:invite, repo:status, repo_deployment, security_events, write:repo_hook
< X-Github-Api-Version-Selected: 2026-03-10
< X-Github-Media-Type: github.v3; format=json
< X-Oauth-Scopes: admin:public_key, admin:repo_hook, gist, read:org, repo

{
  "message": "Dependabot alerts are disabled for this repository.",
  "documentation_url": "https://docs.github.com/rest/dependabot/alerts#list-dependabot-alerts-for-a-repository",
  "status": "403"
}

* Request took 523.382517ms
{
  "message": "Dependabot alerts are disabled for this repository.",
  "documentation_url": "https://docs.github.com/rest/dependabot/alerts#list-dependabot-alerts-for-a-repository",
  "status": "403"
}
gh: Dependabot alerts are disabled for this repository. (HTTP 403)
gh: This API operation needs the "delete_repo" scope. To request it, run:  gh auth refresh -h github.com -s delete_repo
Dominant language
Go
Stars
46.9k
Forks
9.2k
Avg merge
1d 4h
Merged PRs (30d)
60

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cli/cli

All issues in cli/cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.