Installing GitHub Apps on your enterprise is now generally available. You can replace classic PATs with GitHub Apps in more of your enterprise and organization automation with the expanded API support detailed below. These new and expanded permissions are focused on governance, security, and administrative settings for your enterprise, with two gaps at the organization level also closed.

What’s new for GitHub Apps

  • Governance: Manage enterprise-level repository policies and rulesets as well as read delegated bypass requests.
  • Security: Configure two-factor authentication requirements, verify domains, manage IP allowlists, and control enterprise access restrictions.
  • Administration: Update enterprise profiles and manage both member privileges and repository access settings across the enterprise.

New permissions and API coverage

Choose the permissions your workflow needs in your GitHub App settings.

Permission Access Newly supported APIs and GraphQL data
Enterprise organization and repository policies Read/write Read policy fields on EnterpriseOwnerInfo. Update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects.
Enterprise bypass requests Read Read push-rule and repository-policy bypass requests.
Enterprise settings Read/write Read enterprise data through EnterpriseOwnerInfo, including server installations and organization invitations. Update the enterprise profile. Read is required for access to the enterprise organization and repository policies.
Enterprise two-factor authentication Read/write Read two-factor fields on EnterpriseOwnerInfo. Update two-factor requirements and disallowed authentication methods.
Enterprise verifiable domains; organization verifiable domains Write Access VerifiableDomains for enterprises or organizations.
Enterprise IP allowlist; organization IP allowlist Read/write Access IpAllowListEntry and associated mutations to create, update, and delete entries on an enterprise or organization IP allowlist. Also toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users.
Enterprise access restrictions Write Enable or disable enterprise access restrictions.
Enterprise repository rulesets Write Manage rulesets through the enterprise rules REST APIs and RepositoryRuleset in GraphQL.

More coverage with existing permissions

Some APIs and objects had gaps in their support for GitHub Apps. These fixes should unblock more automation scenarios with those permissions.

Permission Access Newly supported APIs and GraphQL data
Enterprise people Read/write Read EnterpriseRepositoryInfo, including repository details through EnterpriseOwnerInfo.outsideCollaborators. Add yourself to an organization with the owner or member role.
Enterprise billing Write Update the member purchasing setting for the Marketplace.

To get started, choose permissions for your GitHub App for the workflows you want to migrate.

These updates will be available in GHES 3.24. For details on using GraphQL with a GitHub App, see Managing an enterprise account with GraphQL. To learn more about enterprise app installations, see Installing a GitHub App on your enterprise.