GitHub REST API access_token query parameter support across GitHub.com and GHES

Goal: Confirm whether REST API clients can authenticate with an access_token in the query string on a target GitHub Enterprise Server instance, or whether the Authorization header is required.

GitHub.com has deprecated or rejected query-parameter and basic password authentication for the REST API, expecting tokens in the Authorization header instead. Older GitHub Enterprise Server releases may still accept legacy patterns, but support varies by installed version and is not guaranteed by GitHub.com documentation. Fine-grained personal access tokens may also be unavailable on older GHES releases, leaving classic tokens as the only option.

Because no specific GHES release is identified here, the exact enforcement status remains unverified. Teams migrating scripts between GitHub.com and self-hosted Enterprise Server need to know which authentication methods are accepted before changing token storage or request construction.

Which GitHub Enterprise Server releases still accept access_token as a query parameter? Is the Authorization header mandatory on all currently supported GHES versions? Does the answer differ between classic and fine-grained personal access tokens?