Fine-grained PATs can now call the GitHub GraphQL API. This was a limitation at the start of the public beta, and is now supported.
Like with the REST API, the resource owner
set for the token must match the owner of the resource being accessed. For example, when you want to look up a specific repository in GraphQL:
query {
repository(owner:"octocat", name:"Hello-World") {
...
The resource owner
would need to be octocat
to succesfully run the query.
In addition, GitHub Apps now have read
access to public resources via GraphQL by default when using user-to-server tokens. This is true even if they are not installed on the organization or user that owns the resource.
This change brings consistency to the access control between REST APIs and GraphQL APIs for GitHub Apps. We made similar changes previously for REST APIs which you can read more about here.
To learn more about GraphQL, see "About the GraphQL API". For more details about fine-grained PATs, see "Creating a fine-grained personal access token". And finally, to learn more about GitHub apps, see "Setting permissions for GitHub apps".