docs inconsistency for environment creation and unreasonable permissions required
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 58/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- github, openapi
- Domain
- api, authentication, documentation
Research direction
Compare the permissions summary page with the endpoint-specific documentation for PUT /repos/{owner}/{repo}/environments/{environment_name}, then verify the reported GitHub Enterprise Cloud behavior. Done means the documented required permission matches actual behavior, with the rationale recorded if administration: write remains necessary.
Written by the indexing model from the issue text.
Description
Platform: GitHub Enterprise Cloud (*.ghe.com), reproduced 2026-07-11
Documentation inconsistency
The permissions required for GitHub Apps summary page lists PUT /repos/{owner}/{repo}/environments/{environment_name} under the environments permission (write). The endpoint-specific documentation appears to contradicts this, stating administration: write is required.
What I expected
A GitHub App with environments: write should be able to create deployment environments via PUT /repos/{owner}/{repo}/environments/{environment_name}. The environments permission exists specifically to manage deployment environments — granting it at write level implies CRUD access.
Behaviour
PUT /repos/{owner}/{repo}/environments/{environment_name} returns 403 Resource not accessible by integration with an App token that has:
{
"environments": "write",
"secrets": "write",
"actions_variables": "write",
"metadata": "read"
}
Adding administration: write resolves the 403. Confirmed via direct API test with a minted installation access token.
Why this matters
Least privilege
Requested change
Either
- Make
environments: writesufficient to create/update environments, or - If
administration: writeis genuinely required by design, document why and update the permissions summary page to reflect this accurately
I prefer number 1 😄
Related
integrations/terraform-provider-github#3121— related but separate; coversactions: readrequirement for the GET endpoint
- Dominant language
- No language data
- Stars
- 1.6k
- Forks
- 342
- Avg merge
- 2h 23m
- Merged PRs (30d)
- 57
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/rest-api-description
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
github/rest-api-description#7220 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
github/rest-api-description#7201 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/rest-api-description#7163 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/rest-api-description#7162 ·
-
feature
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/rest-api-description#7135 ·
All issues in github/rest-api-description
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
punkpeye/mcp-remote#369 ·
-
Client customer-reported needs-team-attention question Service Attention WebPubSub
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Azure/azure-sdk-for-net#63292 · 3 comments · 1 reaction ·
-
bug p:3-mid pydanty:bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
pydantic/pydantic-ai#8643 · 1 comment ·