Which GitHub API endpoints are incompatible with fine‑grained PATs?

Background

GitHub’s fine‑grained Personal Access Tokens (PATs) were introduced to narrow access to specific repositories and organization scopes, thereby enforcing the principle of least privilege. Classic PATs, in contrast, provide broad account‑wide permissions that are often over‑provisioned.

Unresolved Issue

During the migration from classic to fine‑grained PATs, some legacy API endpoints have been reported to reject requests authenticated with a fine‑grained token, even when the token’s scopes appear to match the required permissions. The documentation does not list which endpoints are affected, nor does it provide a method for detecting such incompatibility programmatically.

Key Questions

• Which legacy REST or GraphQL endpoints do not accept fine‑grained PATs, and what is the underlying reason for the rejection?
• Is there an automated way to detect when a fine‑grained PAT will fail against a specific endpoint, perhaps via a preflight check or a permissions audit API?
• What fallback authentication strategy is recommended for workflows that must interact with those legacy endpoints while still maintaining least‑privilege principles?