AccessExplanation

Shape

• effectiveEffectiveAccess

  • The EffectiveAccess schema
  • basisAccessBasisViewgrantsorganization_ownernoneWhere an explained principal's access comes from.
  • permissionsarray of stringEvery permission they hold here, by key.
  • rankAccessLevelguestreporterdevelopermaintainerowneror nulloptional
• grantsarray of ExplainedGrantEvery grant that bears on them here, and what became of it.

  • The ExplainedGrant schema
  • atAccessScope

    • The AccessScope schema
    • full_pathstring
    • idstring
    • typeScopeTypegrouprepository
  • outcomeGrantOutcomeViewreachesstopped_by_boundaryexpiredWhat became of one grant in an explanation.
  • roleRoleView

    • The RoleView schema
    • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
    • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
    • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
    • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
  • viaGrantRoute
  • expires_atstring · date-time or nulloptional
• limitsarray of ExplainedLimitEvery limit that capped them here.

  • The ExplainedLimit schema
  • atAccessScope

    • The AccessScope schema
    • full_pathstring
    • idstring
    • typeScopeTypegrouprepository
  • removedarray of stringPermissions the grants gave that this limit took away, by key.
  • subjectLimitSubjectView
  • ceilingRoleView or nulloptionalThe most the limit lets its subject hold. Absent when it allows nothing at all.

    • The RoleView schema
    • namestringThe role's display name: a built-in name such as Developer, or the custom role's name.
    • rankAccessLevelguestreporterdevelopermaintainerownerThe built-in rank the role counts as wherever a rank is compared, such as a protected branch's minimum.
    • builtinAccessLevelguestreporterdevelopermaintainerowneror nulloptionalSet when the role is built in.
    • customRoleId (string · uuid) or nulloptionalSet when the role is one the organization defined.
• organization_ownerboolean
• principalPrincipalSummary

  • The PrincipalSummary schema
  • idPrincipalId (string · uuid)
  • kindPrincipalKinduserservice_accountagentA person, a service account or an AI organization's agent.
  • usernamestring
  • avatar_urlstring or nulloptional
• scopeAccessPageScope

  • The AccessPageScope schema
  • full_pathstring
  • idstring
  • inherits_accessbooleanWhether access granted on the groups above reaches it. When it is false, only access granted here — and the organization's owners — reach it.
  • typeScopeTypegrouprepository
• boundaryAccessScope or nulloptionalThe nearest group or repository that stops access granted above it, if one does.

  • The AccessScope schema
  • full_pathstring
  • idstring
  • typeScopeTypegrouprepository
• verdictPermissionVerdict or nulloptionalPresent when the request named one permission.

  • The PermissionVerdict schema
  • by_visibilitybooleanWhether the group's or repository's visibility alone lets them do it, without any grant.
  • grantedboolean
  • permissionstring

Graph

Used by