/user/orgs returns an empty object

[Southpaw1496]

Select Topic Area

Question

Body

I'm writing GitHub login functionality for an app, and I want to check if the user is in a given organisation (and therefore authorised to log in). I tried the /user/orgs endpoint, both with a PAT and a GitHub app, but it just returns an empty object.

I think I've authenticated correctly and have the required scopes, as the response is 200, not 401 or 403. Am I somehow using the API incorrectly? Here's what I sent:

curl "https://api.github.com/user/orgs" \
     -H 'Accept: application/vnd.github+json' \
     -H 'Authorization: Bearer <TOKEN>

And I received:

HTTP/1.1 200 OK
Server: GitHub.com
Date: Sat, 04 Nov 2023 23:04:18 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 2
Cache-Control: private, max-age=60, s-maxage=60
Vary: Accept, Authorization, Cookie, X-GitHub-OTP
ETag: "86e3dea5a31ccba3aac2b4ad39c91e8111fe5ca20c9a935381ffa5b77d95f8ce"
github-authentication-token-expiration: 2024-02-02 17:38:45 +0000
X-GitHub-Media-Type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
X-RateLimit-Limit: 5000
X-RateLimit-Remaining: 4988
X-RateLimit-Reset: 1699139716
X-RateLimit-Used: 12
X-RateLimit-Resource: core
Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'
Vary: Accept-Encoding, Accept, X-Requested-With
X-GitHub-Request-Id: D45F:C346:4EFCF6C:501696E:6546CDF2
connection: close

[]

I found this StackOverflow question but there seems to be disagreement about how the endpoint actually works, so it didn't really help.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[NaftaliHolland]

Hey, did you get an answer for this, I have the same problem

[Southpaw1496]

It's been a while since I worked on this, but I seem to remember that viewing a user's private organisations using OAuth requires the user scope. The read:org scope is for listing users in an organisation. The solution that I remember arriving at was requiring an organisation to authorise the app, then checking the user against the users in an organisation, rather than checking the organisation against the organisations a user is in.

The PR I was making when working on this was outline/outline#6258 , there's a slightly more detailed explanation there.

[NaftaliHolland]

Thanks