Access private projects via REST API and PAT (classic): can get repos, but not projects

[MichaelLangbein]

Select Topic Area

Question

Body

Hi everyone!

I'm having trouble accessing private projects through the github api.

1. I've create an organisation MyTestOrg987
2. I've created a private repo MyTestRepo and a private project MyTestProject in this organization
3. Under https://github.com/organizations/MyTestOrg987/settings/personal-access-tokens-onboarding, I've allowed unrestricted access via PAT (classic) to this org
4. Under https://github.com/settings/tokens, I've created a PAT with all permissions enabled
5. Using this PAT, I can list the private repo, but not the private project.

curl -v -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer ghp_<MY-TOKEN-HERE>" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/orgs/MyTestOrg987/projects

Returns:

*   Trying 140.82.121.6:443...
* Connected to api.github.com (140.82.121.6) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.github.com
*  start date: Mar  7 00:00:00 2024 GMT
*  expire date: Mar  7 23:59:59 2025 GMT
*  subjectAltName: host "api.github.com" matched cert's "*.github.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo ECC Domain Validation Secure Server CA
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://api.github.com/orgs/MyTestOrg987/projects
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: api.github.com]
* [HTTP/2] [1] [:path: /orgs/MyTestOrg987/projects]
* [HTTP/2] [1] [user-agent: curl/8.4.0]
* [HTTP/2] [1] [accept: application/vnd.github+json]
* [HTTP/2] [1] [authorization: Bearer ghp_<MY-TOKEN-HERE>]
* [HTTP/2] [1] [x-github-api-version: 2022-11-28]
> GET /orgs/MyTestOrg987/projects HTTP/2
> Host: api.github.com
> User-Agent: curl/8.4.0
> Accept: application/vnd.github+json
> Authorization: Bearer ghp_<MY-TOKEN-HERE>
> X-GitHub-Api-Version: 2022-11-28
> 
< HTTP/2 200 
< server: GitHub.com
< date: Mon, 13 May 2024 09:20:13 GMT
< content-type: application/json; charset=utf-8
< content-length: 5
< cache-control: private, max-age=60, s-maxage=60
< vary: Accept, Authorization, Cookie, X-GitHub-OTP
< etag: "5ff66d9a21a8c7875fc2fb493525785f4bf9bb9b7138a3bc0c0d48c8b7925953"
< x-oauth-scopes: admin:enterprise, admin:gpg_key, admin:org, admin:org_hook, admin:public_key, admin:repo_hook, admin:ssh_signing_key, audit_log, codespace, copilot, delete:packages, delete_repo, gist, notifications, project, repo, user, workflow, write:discussion, write:packages
< x-accepted-oauth-scopes: read:org, repo
< github-authentication-token-expiration: 2024-06-12 09:07:38 UTC
< x-github-media-type: github.v3; format=json
< x-github-api-version-selected: 2022-11-28
< x-ratelimit-limit: 5000
< x-ratelimit-remaining: 4984
< x-ratelimit-reset: 1715592987
< x-ratelimit-used: 16
< x-ratelimit-resource: core
< access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
< access-control-allow-origin: *
< strict-transport-security: max-age=31536000; includeSubdomains; preload
< x-frame-options: deny
< x-content-type-options: nosniff
< x-xss-protection: 0
< referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
< content-security-policy: default-src 'none'
< vary: Accept-Encoding, Accept, X-Requested-With
< x-github-request-id: C557:362D01:2C08CCA3:2C3EB139:6641DB4D
< 
[

]
* Connection #0 to host api.github.com left intact

[MichaelLangbein]

I couldn't find this explicitly mentioned in the documentation, but there is a community discussion from a year ago that suggests that the projects endpoint is not implemented in the REST-API.
The graph-gl endpoint might work, though, but I haven't yet verified that.
Can anybody confirm this, or has anyone found documentation about it?

[MichaelLangbein]

Hmm, so I've found that the graphql-api doesn't return private projects, either.

Here I've read that the projects endpoint only works with either app tokens or fine-grained personal access tokens, having the permission organization_projects:read - so I went ahead using a fine-grained PAT instead of the classic PAT I've used so far. However, when creating a fine-grained PAT, I cannot find such a field organization_projects:read- I'm only given a list of repository- and account-permissions, none of them seemingly pertaining to organizations or projects.

[MichaelLangbein]

Investigating further, I've created a new fine-grained PAT, owned by the organisation MyTestOrg987, and with read-only rights for all fields. Again, the endpoint https://api.github.com/orgs/MyTestOrg987/repos does return the private repo, and again, the endpoint https://api.github.com/orgs/MyTestOrg987/projects returns an empty array.

[MichaelLangbein]

Ok, so it seems there were a few key facts that I didn't know about - which I learned about from https://stackoverflow.com/questions/75075799/what-is-the-github-api-resource-type-of-non-classic-projects.

1. There is a difference between so called classical and non-classical projects. They are also queried differently: with the projects and projectsV2 key, respectively.
2. Also, this api is only available via GraphQL, not REST.
3. For authentication, either use a classic PAT, or a fine-grained PAT owned by the target-organisation, not your user.