Which GitHub API endpoints are incompatible with fine‑grained PATs?

Question

Background
GitHub’s fine‑grained Personal Access Tokens (PATs) were introduced to narrow access to specific repositories and organization scopes, thereby enforcing the principle of least privilege. Classic PATs, in contrast, provide broad account‑wide permissions that are often over‑provisioned.
Unresolved Issue
During the migration from classic to fine‑grained PATs, some legacy API endpoints have been reported to reject requests authenticated with a fine‑grained token, even when the token’s scopes appear to match the required permissions. The documentation does not list which endpoints are affected, nor does it provide a method for detecting such incompatibility programmatically.
Key Questions

Which legacy REST or GraphQL endpoints do not accept fine‑grained PATs, and what is the underlying reason for the rejection?
Is there an automated way to detect when a fine‑grained PAT will fail against a specific endpoint, perhaps via a preflight check or a permissions audit API?
What fallback authentication strategy is recommended for workflows that must interact with those legacy endpoints while still maintaining least‑privilege principles?

Tasadduq Burney · Answer

Direct answer
GitHub does not publish a complete list of REST or GraphQL endpoints that reject fine-grained personal access tokens (PATs). Incompatibility is not tracked by endpoint name; it depends on whether the token's granted repository and organization permissions cover the action, and whether the endpoint relies on classic-only OAuth scopes such as gist, admin:org, billing, or enterprise-wide administration. Endpoints outside those boundaries may return 401, 403, or 404.
Confirmed facts versus likely explanation

CategoryDetails

ConfirmedFine-grained PATs are bound to specific repositories and organizations on GitHub.com. Classic PATs use broad account-wide OAuth scopes.
ConfirmedGitHub publishes no preflight or permissions-audit API that reliably predicts failure for a specific endpoint before the call.
Likely explanationLegacy endpoints requiring classic-only scopes, or user-level resources outside the token's selected repositories and organizations, are rejected because the fine-grained permission model cannot map to those legacy scopes.

Verification steps

Review the fine-grained token's granted repository and organization permissions in GitHub token settings.
Call the target endpoint with the fine-grained PAT and record the status code.
If the response is 401, 403, or 404, retry with a classic PAT limited to the narrowest classic scopes believed necessary for that endpoint.
Compare the responses. Success with the classic PAT and failure with the fine-grained PAT indicates a permission-model mismatch.

curl -i -H 'Authorization: Bearer FINE_GRAINED_TOKEN' https://api.github.com/REPLACE_WITH_ENDPOINT
Recommended fallback
For workflows that must interact with legacy endpoints, use a classic PAT scoped to the minimum scopes required for that endpoint, or a GitHub App installation token where applicable. Do not broaden a fine-grained PAT beyond least privilege to work around the limitation.
Assumption: This guidance targets GitHub.com. Behavior on GitHub Enterprise Server can differ by version, and fine-grained PAT support is unavailable on some older GHES releases.
Missing diagnostic detail that changes the recommendation: Are you targeting GitHub.com or GitHub Enterprise Server, and which GHES version if applicable?

Which GitHub API endpoints are incompatible with fine‑grained PATs?

Background

Unresolved Issue

Key Questions

1 answer

Direct answer

Confirmed facts versus likely explanation

Verification steps

Recommended fallback

Your perspective belongs here.

0 question comments

Category	Details
Confirmed	Fine-grained PATs are bound to specific repositories and organizations on GitHub.com. Classic PATs use broad account-wide OAuth scopes.
Confirmed	GitHub publishes no preflight or permissions-audit API that reliably predicts failure for a specific endpoint before the call.
Likely explanation	Legacy endpoints requiring classic-only scopes, or user-level resources outside the token's selected repositories and organizations, are rejected because the fine-grained permission model cannot map to those legacy scopes.