Required permissions

Required permissions for integrating GitHub with Xopero ONE and protecting its resources.

Connecting GitHub with Xopero ONE requires appropriate permissions to access and protect repositories and their associated metadata. The required permissions depend on the authorization method used, such as a GitHub App or personal access token (PAT), and on the type of data that needs to be protected.

---

Account permissions

Integrating GitHub with Xopero ONE to back up and restore repositories, projects, and associated metadata requires an account with full administrative privileges.

Exact roles and permission levels may vary depending on individual repository settings, project configurations, or organization-level security policies. Below are examples of different roles, along with the corresponding permissions and the capabilities they provide in Xopero ONE.

GITHUB ROLES AND PERMISSIONS

Organization role	Repository role	Capabilities
Owner	Default	Full backup and restore.
	Admin	Full backup and restore.
	Write	Full backup and restore.
	Read	Full backup. Restore only to the user's own account.
Member	Admin	Full backup. Restore only to the user's own account.
	Maintain	Full backup. Restore only to the user's own account.
	Write	Full backup. Restore only to the user's own account.
	Triage	Backup excluding collaborators. Restore only to the user's own account.
Collaborator	Read	Backup excluding collaborators. Restore only to the user's own account.
Outside collaborator	Default	Backup excluding collaborators. Restore only to the user's own account.

---

Permissions for the OAuth app

To ensure seamless integration and correct operation, the Xopero ONE OAuth application* requires the following permissions:

• Full control of projects.

• Read team discussions.

• Read org and team membership, read org projects.

• Read all user profile data.

• Full control of private repositories.

• Access user email addresses (read-only).

• Update GitHub Actions workflows.

_{*The Xopero ONE OAuth application for GitHub is called GitProtect.}

---

Permissions for the GitHub App

Xopero ONE GitHub App* installation requires the following permissions:

• Read access to actions, deployments, metadata, and repository projects.

• Read and write access to administration, code, issues, pull requests, repository hooks, and workflows.

_{*The Xopero ONE GitHub App is called GitProtect.}

---

Permissions for personal access tokens (PAT)

Personal access tokens are generated in GitHub account settings under Settings > Developer settings > Personal access tokens and can be assigned different permissions.

Registering the Xopero ONE application and executing full repository backup and restore tasks requires a token configured with at least repo and workflow permissions.

With minimal privileges, certain metadata may not be included in the backup. Select the permissions based on the specific data you need to protect.

The following list outlines the permissions required to back up repository metadata within an organization:

• repo (access repositories)

• project (read the projects associated with the repository)

• admin:org (read the organization's projects)

• read:discussion (read team discussions)

• read:public_key (access keys)

• read:repo_hook (access webhooks)

If you grant the token only read permissions, you can perform backups, but restoring data requires generating a new token with write permissions.

---

Useful links and items

Managing your personal access tokens - GitHub DocsGitHub Docs