Repository security advisories REST docs list `repository_advisories:read` / `repository_advisories:write` OAuth scopes that GitHub rejects as invalid

[4n86rakam1]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/rest/security-advisories/repository-advisories

What part(s) of the article would you like to see updated?

Six endpoints on this page say that OAuth app tokens and personal access tokens (classic) can use either repo or a repository_advisories:* scope:

Endpoint	Scope named in the docs
List repository security advisories for an organization	repository_advisories:write
List repository security advisories	repository_advisories:read
Create a repository security advisory	repository_advisories:write
Get a repository security advisory	repository_advisories:read
Update a repository security advisory	repository_advisories:write
Request a CVE for a repository security advisory	repository_advisories:write

For example, "Get a repository security advisory" says:

OAuth app tokens and personal access tokens (classic) need the repo or repository_advisories:read scope to to get a published security advisory in a private repository, or any unpublished security advisory that the authenticated user has access to.

GitHub's OAuth authorization server does not accept either scope. Requesting a device code with only that scope returns invalid_scope, the same response as a made-up scope name. Valid scopes return a device code:

curl -s -X POST -H "Accept: application/json" \
  -d "client_id=<any OAuth app client ID>&scope=repository_advisories:read" \
  https://github.com/login/device/code

Requested scope	Response
repo	device code issued
notifications	device code issued
security_events	device code issued
read:org, read:packages, write:discussion, admin:repo_hook, read:user	device code issued
repo repository_advisories:read	invalid_scope, naming only repository_advisories:read
repository_advisories:read	{"error":"invalid_scope","error_description":"The scopes requested are invalid: repository_advisories:read."}
repository_advisories:write	{"error":"invalid_scope","error_description":"The scopes requested are invalid: repository_advisories:write."}
nonexistent_scope_xyz, nonexistent:read	invalid_scope

The other colon-separated scopes are accepted, so the colon is not the cause.

The scopes are also missing from Scopes for OAuth apps, so the two pages contradict each other. The "New personal access token (classic)" page at https://github.com/settings/tokens/new does not offer them either.

Could the docs either drop the repository_advisories:* alternative and name repo as the only scope, or, if these scopes are meant to exist, add them to the scopes page and note when they became available?

The mistake costs readers real effort. repo grants read and write access to every private repository the user can reach. Someone who only wants to track their own private vulnerability reports sees the narrower scope in the docs, designs around it, and learns it doesn't exist only when the token request fails.

Additional information

• The spec file carries the same wording: descriptions/api.github.com/api.github.com.json in github/rest-api-description (checked 2026-09-22 UTC).
• Tested against github.com on 2026-09-22 UTC. No token was issued with the rejected scopes, so I have not observed how the API endpoints themselves behave with them.

[subatoi]

Hello—please reopen this issue against https://github.com/github/rest-api-description as that's where API content is managed from. Thank you