Custom properties API - admin rights needed?

[leherv]

Select Topic Area

Question

Body

I want to use custom properties on my repositories to be able to automatically (via github api) and manually (workflow trigger) set the tag to deploy in. Once for STAG and once for PROD (2 custom properties). This allows me to use the webhook feature to trigger deployments to x different targets decoupled from the pipeline code.
This would already work except for a permission problem.
I created a fine grained access token on my machine user and set the organization as the owner. The token has all the necessary permissions (i even tried with ALL permissions) and the machine user has write access to alle repositories in the organization.
If i try to update a custom property via the github API (does not matter if postman or curl inside the pipeline) i get the following response:

{
    "message": "Resource not accessible by personal access token",
    "documentation_url": "https://docs.github.com/rest/repos/custom-properties#create-or-update-custom-property-values-for-a-repository",
    "status": "403"
}

It only works if i grant admin access to the machine user on the repository i want to set the custom property. Does anyone experience the same? Is there a solution? I do not want to give admin rights to my machine user.

[Vusoni]

Hey, can you accept this answer?

[Abishek0070]

This is a common point of confusion when working with Github Custom Repository Properties and FineGrained Access Tokens PATs
The issue you're experiencing is not a bug, but a design choice by GitHub regarding the required permissions for managing repository settings, which includes custom properties

Since you want to avoid granting blanket admin access to your machine user, the most secure and scalable solution is to switch from a Machine User PAT to a Github App.
gitHub Apps are designed for automation and offer granular, repository-scoped permissions without requiring a full user account or admin access.
Create a GitHub App in your organization.
Grant the App the following Repo Permission:
Administration: Set to Read and write.
Install the App on the specific repositories (or the entire organization).
Use the App's Installation Access Token to call the API.

Hope this helps :)

[realmixcko]

I ran into the same issue and confirmed that this is expected behavior — updating repository custom properties via the GitHub REST API currently requires admin-level permissions on the repository.
Even with a fine-grained PAT that has all possible permissions and org-wide access, you’ll still get:
json

{
  "message": "Resource not accessible by personal access token",
  "status": "403"
}

This happens because the endpoint POST /repos/{owner}/{repo}/properties/values is limited to repository administrators only (see the GITHUB API DOCS)

Workarounds
Use a GitHub App with administration: write permission:
GitHub Apps can perform this action even without the installing user being a repo admin, as long as the app is granted the right permission scope.
Use a dedicated “controller” repo or workflow:
Let that workflow run under the app token and set custom properties across targets.
Or, as a fallback, temporarily grant admin to your automation account, perform the update, and then revoke it — although this isn’t ideal.
So in short: this behavior is by design for now. The cleanest fix is to move this automation to a GitHub App rather than a fine-grained PAT.