> For the complete documentation index, see [llms.txt](https://helpcenter.xopero.com/xopero-one-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.xopero.com/xopero-one-en/backup-and-recovery/devops/github/integration/required-permissions.md).

# Required permissions

Required permissions for integrating GitHub with Xopero ONE and protecting its resources.

**Connecting GitHub with Xopero ONE requires appropriate permissions to access and protect repositories and their associated metadata. The required permissions depend on the authorization method used, such as a GitHub App or personal access token (PAT), and on the type of data that needs to be protected.**

***

## Account permissions

Integrating **GitHub** with **Xopero ONE** to back up and restore repositories, projects, and associated metadata requires an account with **full administrative privileges**.

Exact roles and permission levels may vary depending on individual repository settings, project configurations, or organization-level security policies. Below are examples of different roles, along with the corresponding permissions and the capabilities they provide in **Xopero ONE**.

<details>

<summary>GITHUB ROLES AND PERMISSIONS</summary>

<table data-header-hidden="false" data-header-sticky data-search="false"><thead><tr><th>Organization role</th><th>Repository role</th><th>Capabilities</th></tr></thead><tbody><tr><td>Owner</td><td>Default</td><td>Full backup and restore.</td></tr><tr><td></td><td>Admin</td><td>Full backup and restore.</td></tr><tr><td></td><td>Write</td><td>Full backup and restore.</td></tr><tr><td></td><td>Read</td><td>Full backup. Restore only to the user's own account.</td></tr><tr><td>Member</td><td>Admin</td><td>Full backup. Restore only to the user's own account.</td></tr><tr><td></td><td>Maintain</td><td>Full backup. Restore only to the user's own account.</td></tr><tr><td></td><td>Write</td><td>Full backup. Restore only to the user's own account.</td></tr><tr><td></td><td>Triage</td><td>Backup excluding collaborators. Restore only to the user's own account.</td></tr><tr><td>Collaborator</td><td>Read</td><td>Backup excluding collaborators. Restore only to the user's own account.</td></tr><tr><td>Outside collaborator</td><td>Default</td><td>Backup excluding collaborators. Restore only to the user's own account.</td></tr></tbody></table>

</details>

***

## Permissions for the OAuth app

To ensure seamless integration and correct operation, the **Xopero ONE** OAuth applicatio&#x6E;**\*** requires the following permissions:

* [x] Full control of projects.
* [x] Read team discussions.
* [x] Read org and team membership, read org projects.
* [x] Read all user profile data.
* [x] Full control of private repositories.
* [x] Access user email addresses (read-only).
* [x] Update **GitHub Actions** workflows.

<sub>**\***</sub><sub>The</sub> <sub></sub><sub>**Xopero ONE**</sub> <sub></sub><sub>OAuth application for</sub> <sub></sub><sub>**GitHub**</sub> <sub></sub><sub>is called</sub> <sub></sub><sub>**GitProtect**</sub><sub>.</sub>

***

## Permissions for the GitHub App

**Xopero ONE GitHub App\*** installation requires the following permissions:

* [x] Read access to actions, deployments, metadata, and repository projects.
* [x] Read and write access to administration, code, issues, pull requests, repository hooks, and workflows.

<sub>**\***</sub><sub>The</sub> <sub></sub><sub>**Xopero ONE GitHub App**</sub> <sub></sub><sub>is called</sub> <sub></sub><sub>**GitProtect**</sub><sub>.</sub>

***

## Permissions for personal access tokens (PAT)&#x20;

Personal access tokens are generated in **GitHub** account settings under **Settings** > **Developer settings** > **Personal access tokens** and can be assigned different permissions.

Registering the **Xopero ONE** application and executing full repository backup and restore tasks requires a token configured with at least **repo** and **workflow** permissions.

{% hint style="danger" %}
**With minimal privileges, certain metadata may not be included in the backup.** Select the permissions based on the specific data you need to protect.
{% endhint %}

<figure><img src="https://319733277-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0CBTl43C3OO6ySL1DJ6k%2Fuploads%2FU8TmB1OhjbRnlMbMWr1M%2Frequired_permissions_GitHub_1.png?alt=media&amp;token=2dc42ff7-2ca0-49a8-8ee8-bfa6c68f824e" alt=""><figcaption></figcaption></figure>

The following list outlines the permissions required to back up repository metadata within an organization:

* [x] **repo** (access repositories)
* [x] **project** (read the projects associated with the repository)
* [x] **admin:org** (read the organization's projects)
* [x] **read:discussion** (read team discussions)
* [x] **read:public\_key** (access keys)
* [x] **read:repo\_hook** (access webhooks)

{% hint style="warning" %}
If you grant the token only **read** permissions, you can perform backups, but restoring data requires generating a new token with **write** permissions.
{% endhint %}

***

## Useful links and items

{% embed url="<https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens>" %}