{"meta":{"title":"REST API endpoints for collaborators","intro":"Use the REST API to manage collaborators for a repository.","product":"REST API","breadcrumbs":[{"href":"/en/rest","title":"REST API"},{"href":"/en/rest/collaborators","title":"Collaborators"},{"href":"/en/rest/collaborators/collaborators","title":"Collaborators"}],"documentType":"article"},"body":"# REST API endpoints for collaborators\n\nUse the REST API to manage collaborators for a repository.\n\n> [!NOTE]\n> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.\n\n## List repository collaborators\n\n```\nGET /repos/{owner}/{repo}/collaborators\n```\n\nFor organization-owned repositories, the list of collaborators includes outside collaborators, organization members that are direct collaborators, organization members with access through team memberships, organization members with access through default organization permissions, and organization owners.\nThe permissions hash returned in the response contains the base role permissions of the collaborator. The role_name is the highest role assigned to the collaborator after considering all sources of grants, including: repo, teams, organization, and enterprise.\nThere is presently not a way to differentiate between an organization level grant and a repository level grant from this endpoint response.\nTeam members will include the members of child teams.\nThe authenticated user must have write, maintain, or admin privileges on the repository to use this endpoint. For organization-owned repositories, the authenticated user needs to be a member of the organization.\nOAuth app tokens and personal access tokens (classic) need the read:org and repo scopes to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`affiliation`** (string)\n  Filter collaborators returned by their affiliation. outside means all outside collaborators of an organization-owned repository. direct means all collaborators with permissions to an organization-owned repository, regardless of organization membership status. all means all collaborators the authenticated user can see.\n  Default: `all`\n  Can be one of: `outside`, `direct`, `all`\n\n- **`permission`** (string)\n  Filter collaborators by the permissions they have on the repository. If not specified, all collaborators will be returned.\n  Can be one of: `pull`, `triage`, `push`, `maintain`, `admin`\n\n- **`per_page`** (integer)\n  The number of results per page (max 100). For more information, see \"Using pagination in the REST API.\"\n  Default: `30`\n\n- **`page`** (integer)\n  The page number of the results to fetch. For more information, see \"Using pagination in the REST API.\"\n  Default: `1`\n\n### HTTP response status codes\n\n- **200** - OK\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/collaborators\n```\n\n**Response schema (Status: 200):**\n\nArray of `Collaborator`:\n  * `login`: required, string\n  * `id`: required, integer, format: int64\n  * `email`: string or null\n  * `name`: string or null\n  * `node_id`: required, string\n  * `avatar_url`: required, string, format: uri\n  * `gravatar_id`: required, string or null\n  * `url`: required, string, format: uri\n  * `html_url`: required, string, format: uri\n  * `followers_url`: required, string, format: uri\n  * `following_url`: required, string\n  * `gists_url`: required, string\n  * `starred_url`: required, string\n  * `subscriptions_url`: required, string, format: uri\n  * `organizations_url`: required, string, format: uri\n  * `repos_url`: required, string, format: uri\n  * `events_url`: required, string\n  * `received_events_url`: required, string, format: uri\n  * `type`: required, string\n  * `site_admin`: required, boolean\n  * `permissions`: object:\n    * `pull`: required, boolean\n    * `triage`: boolean\n    * `push`: required, boolean\n    * `maintain`: boolean\n    * `admin`: required, boolean\n  * `role_name`: required, string\n  * `user_view_type`: string\n\n## Check if a user is a repository collaborator\n\n```\nGET /repos/{owner}/{repo}/collaborators/{username}\n```\n\nFor organization-owned repositories, the list of collaborators includes outside collaborators, organization members that are direct collaborators, organization members with access through team memberships, organization members with access through default organization permissions, and organization owners.\nTeam members will include the members of child teams.\nThe authenticated user must have push access to the repository to use this endpoint.\nOAuth app tokens and personal access tokens (classic) need the read:org and repo scopes to use this endpoint.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n### HTTP response status codes\n\n- **204** - Response if user is a collaborator\n\n- **404** - Not Found if user is not a collaborator\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/collaborators/USERNAME\n```\n\n**Response schema (Status: 204):**\n\n## Add a repository collaborator\n\n```\nPUT /repos/{owner}/{repo}/collaborators/{username}\n```\n\nAdd a user to a repository with a specified level of access. If the repository is owned by an organization, this API does not add the user to the organization - a user that has repository access without being an organization member is called an \"outside collaborator\" (if they are not an Enterprise Managed User) or a \"repository collaborator\" if they are an Enterprise Managed User. These users are exempt from some organization policies - see \"Adding outside collaborators to repositories\" to learn more about these collaborator types.\nThis endpoint triggers notifications.\nAdding an outside collaborator may be restricted by enterprise and organization administrators. For more information, see \"Enforcing repository management policies in your enterprise\" and \"Setting permissions for adding outside collaborators\" for organization settings.\nFor more information on permission levels, see \"Repository permission levels for an organization\". There are restrictions on which permissions can be granted to organization members when an organization base role is in place. In this case, the role being given must be equal to or higher than the org base permission. Otherwise, the request will fail with:\nCannot assign {member} permission of {role name}\n\nNote that, if you choose not to pass any parameters, you'll need to set Content-Length to zero when calling out to this endpoint. For more information, see \"HTTP method.\"\nThe invitee will receive a notification that they have been invited to the repository, which they must accept or decline. They may do this via the notifications page, the email they receive, or by using the API.\nFor Enterprise Managed Users, this endpoint does not send invitations - these users are automatically added to organizations and repositories. Enterprise Managed Users can only be added to organizations and repositories within their enterprise.\nUpdating an existing collaborator's permission level\nThe endpoint can also be used to change the permissions of an existing collaborator without first removing and re-adding the collaborator. To change the permissions, use the same endpoint and pass a different permission parameter. The response will be a 204, with no other indication that the permission level changed.\nRate limits\nYou are limited to sending 50 invitations to a repository per 24 hour period. Note there is no limit if you are inviting organization members to an organization repository.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n#### Body parameters\n\n- **`permission`** (string)\n  The permission to grant the collaborator. Only valid on organization-owned repositories. We accept the following permissions to be set: pull, triage, push, maintain, admin and you can also specify a custom repository role name, if the owning organization has defined any.\n  Default: `push`\n\n### HTTP response status codes\n\n- **201** - Response when a new invitation is created\n\n- **204** - Response when:\n\nan existing collaborator is added as a collaborator\nan organization member is added as an individual collaborator\nan existing team member (whose team is also a repository collaborator) is added as an individual collaborator\n\n- **403** - Forbidden\n\n- **422** - Response when:\n\nvalidation failed, or the endpoint has been spammed\nan Enterprise Managed User (EMU) account was invited to a repository in an enterprise with personal user accounts\n\n### Code examples\n\n#### Add a collaborator with triage permissions\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X PUT \\\n  https://api.github.com/repos/OWNER/REPO/collaborators/USERNAME \\\n  -d '{\n  \"permission\": \"triage\"\n}'\n```\n\n**Response schema (Status: 201):**\n\n* `id`: required, integer, format: int64\n* `repository`: required, `Minimal Repository`:\n  * `id`: required, integer, format: int64\n  * `node_id`: required, string\n  * `name`: required, string\n  * `full_name`: required, string\n  * `owner`: required, `Simple User`:\n    * `name`: string or null\n    * `email`: string or null\n    * `login`: required, string\n    * `id`: required, integer, format: int64\n    * `node_id`: required, string\n    * `avatar_url`: required, string, format: uri\n    * `gravatar_id`: required, string or null\n    * `url`: required, string, format: uri\n    * `html_url`: required, string, format: uri\n    * `followers_url`: required, string, format: uri\n    * `following_url`: required, string\n    * `gists_url`: required, string\n    * `starred_url`: required, string\n    * `subscriptions_url`: required, string, format: uri\n    * `organizations_url`: required, string, format: uri\n    * `repos_url`: required, string, format: uri\n    * `events_url`: required, string\n    * `received_events_url`: required, string, format: uri\n    * `type`: required, string\n    * `site_admin`: required, boolean\n    * `starred_at`: string\n    * `user_view_type`: string\n  * `private`: required, boolean\n  * `html_url`: required, string, format: uri\n  * `description`: required, string or null\n  * `fork`: required, boolean\n  * `url`: required, string, format: uri\n  * `archive_url`: required, string\n  * `assignees_url`: required, string\n  * `blobs_url`: required, string\n  * `branches_url`: required, string\n  * `collaborators_url`: required, string\n  * `comments_url`: required, string\n  * `commits_url`: required, string\n  * `compare_url`: required, string\n  * `contents_url`: required, string\n  * `contributors_url`: required, string, format: uri\n  * `deployments_url`: required, string, format: uri\n  * `downloads_url`: required, string, format: uri\n  * `events_url`: required, string, format: uri\n  * `forks_url`: required, string, format: uri\n  * `git_commits_url`: required, string\n  * `git_refs_url`: required, string\n  * `git_tags_url`: required, string\n  * `git_url`: string\n  * `issue_comment_url`: required, string\n  * `issue_events_url`: required, string\n  * `issues_url`: required, string\n  * `keys_url`: required, string\n  * `labels_url`: required, string\n  * `languages_url`: required, string, format: uri\n  * `merges_url`: required, string, format: uri\n  * `milestones_url`: required, string\n  * `notifications_url`: required, string\n  * `pulls_url`: required, string\n  * `releases_url`: required, string\n  * `ssh_url`: string\n  * `stargazers_url`: required, string, format: uri\n  * `statuses_url`: required, string\n  * `subscribers_url`: required, string, format: uri\n  * `subscription_url`: required, string, format: uri\n  * `tags_url`: required, string, format: uri\n  * `teams_url`: required, string, format: uri\n  * `trees_url`: required, string\n  * `clone_url`: string\n  * `mirror_url`: string or null\n  * `hooks_url`: required, string, format: uri\n  * `svn_url`: string\n  * `homepage`: string or null\n  * `language`: string or null\n  * `forks_count`: integer\n  * `stargazers_count`: integer\n  * `watchers_count`: integer\n  * `size`: integer\n  * `default_branch`: string\n  * `open_issues_count`: integer\n  * `is_template`: boolean\n  * `topics`: array of string\n  * `has_issues`: boolean\n  * `has_projects`: boolean\n  * `has_wiki`: boolean\n  * `has_pages`: boolean\n  * `has_discussions`: boolean\n  * `has_pull_requests`: boolean\n  * `pull_request_creation_policy`: string, enum: `all`, `collaborators_only`\n  * `archived`: boolean\n  * `disabled`: boolean\n  * `visibility`: string\n  * `pushed_at`: string or null, format: date-time\n  * `created_at`: string or null, format: date-time\n  * `updated_at`: string or null, format: date-time\n  * `permissions`: object:\n    * `admin`: boolean\n    * `maintain`: boolean\n    * `push`: boolean\n    * `triage`: boolean\n    * `pull`: boolean\n  * `role_name`: string\n  * `temp_clone_token`: string\n  * `delete_branch_on_merge`: boolean\n  * `subscribers_count`: integer\n  * `network_count`: integer\n  * `code_of_conduct`: `Code Of Conduct`:\n    * `key`: required, string\n    * `name`: required, string\n    * `url`: required, string, format: uri\n    * `body`: string\n    * `html_url`: required, string or null, format: uri\n  * `license`: object or null:\n    * `key`: string\n    * `name`: string\n    * `spdx_id`: string\n    * `url`: string or null\n    * `node_id`: string\n  * `forks`: integer\n  * `open_issues`: integer\n  * `watchers`: integer\n  * `allow_forking`: boolean\n  * `web_commit_signoff_required`: boolean\n  * `security_and_analysis`: object or null:\n    * `advanced_security`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `code_security`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `dependabot_security_updates`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_push_protection`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_non_provider_patterns`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_ai_detection`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_delegated_alert_dismissal`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_delegated_bypass`: object:\n      * `status`: string, enum: `enabled`, `disabled`\n    * `secret_scanning_delegated_bypass_options`: object:\n      * `reviewers`: array of objects:\n        * `reviewer_id`: required, integer\n        * `reviewer_type`: required, string, enum: `TEAM`, `ROLE`\n        * `mode`: string, enum: `ALWAYS`, `EXEMPT`, default: `\"ALWAYS\"`\n  * `custom_properties`: object, additional properties allowed\n* `invitee`: required, any of:\n  * **null**\n  * **Simple User** (see above)\n* `inviter`: required, any of:\n  * **null**\n  * **Simple User** (see above)\n* `permissions`: required, string, enum: `read`, `write`, `admin`, `triage`, `maintain`\n* `created_at`: required, string, format: date-time\n* `expired`: boolean\n* `url`: required, string\n* `html_url`: required, string\n* `node_id`: required, string\n\n## Remove a repository collaborator\n\n```\nDELETE /repos/{owner}/{repo}/collaborators/{username}\n```\n\nRemoves a collaborator from a repository.\nTo use this endpoint, the authenticated user must either be an administrator of the repository or target themselves for removal.\nThis endpoint also:\n\nCancels any outstanding invitations sent by the collaborator\nUnassigns the user from any issues\nRemoves access to organization projects if the user is not an organization member and is not a collaborator on any other organization repositories.\nUnstars the repository\nUpdates access permissions to packages\n\nRemoving a user as a collaborator has the following effects on forks:\n\nIf the user had access to a fork through their membership to this repository, the user will also be removed from the fork.\nIf the user had their own fork of the repository, the fork will be deleted.\nIf the user still has read access to the repository, open pull requests by this user from a fork will be denied.\n\nNote\n\nA user can still have access to the repository through organization permissions like base repository permissions.\n\nAlthough the API responds immediately, the additional permission updates might take some extra time to complete in the background.\nFor more information on fork permissions, see \"About permissions and visibility of forks\".\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n### HTTP response status codes\n\n- **204** - No Content when collaborator was removed from the repository.\n\n- **403** - Forbidden\n\n- **422** - Validation failed, or the endpoint has been spammed.\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X DELETE \\\n  https://api.github.com/repos/OWNER/REPO/collaborators/USERNAME\n```\n\n**Response schema (Status: 204):**\n\n## Get repository permissions for a user\n\n```\nGET /repos/{owner}/{repo}/collaborators/{username}/permission\n```\n\nChecks the repository permission and role of a collaborator.\nThe permission attribute provides the legacy base roles of admin, write, read, and none, where the\nmaintain role is mapped to write and the triage role is mapped to read.\nThe role_name attribute provides the name of the assigned role, including custom roles. The\npermission can also be used to determine which base level of access the collaborator has to the repository.\nThe calculated permissions are the highest role assigned to the collaborator after considering all sources of grants, including: repo, teams, organization, and enterprise.\nThere is presently not a way to differentiate between an organization level grant and a repository level grant from this endpoint response.\n\n### Parameters\n\n#### Headers\n\n- **`accept`** (string)\n  Setting to `application/vnd.github+json` is recommended.\n\n#### Path and query parameters\n\n- **`owner`** (string) (required)\n  The account owner of the repository. The name is not case sensitive.\n\n- **`repo`** (string) (required)\n  The name of the repository without the .git extension. The name is not case sensitive.\n\n- **`username`** (string) (required)\n  The handle for the GitHub user account.\n\n### HTTP response status codes\n\n- **200** - if user has admin permissions\n\n- **404** - Resource not found\n\n### Code examples\n\n#### Example\n\n**Request:**\n\n```curl\ncurl -L \\\n  -X GET \\\n  https://api.github.com/repos/OWNER/REPO/collaborators/USERNAME/permission\n```\n\n**Response schema (Status: 200):**\n\n* `permission`: required, string\n* `role_name`: required, string\n* `user`: required, any of:\n  * **null**\n  * **Collaborator**\n    * `login`: required, string\n    * `id`: required, integer, format: int64\n    * `email`: string or null\n    * `name`: string or null\n    * `node_id`: required, string\n    * `avatar_url`: required, string, format: uri\n    * `gravatar_id`: required, string or null\n    * `url`: required, string, format: uri\n    * `html_url`: required, string, format: uri\n    * `followers_url`: required, string, format: uri\n    * `following_url`: required, string\n    * `gists_url`: required, string\n    * `starred_url`: required, string\n    * `subscriptions_url`: required, string, format: uri\n    * `organizations_url`: required, string, format: uri\n    * `repos_url`: required, string, format: uri\n    * `events_url`: required, string\n    * `received_events_url`: required, string, format: uri\n    * `type`: required, string\n    * `site_admin`: required, boolean\n    * `permissions`: object:\n      * `pull`: required, boolean\n      * `triage`: boolean\n      * `push`: required, boolean\n      * `maintain`: boolean\n      * `admin`: required, boolean\n    * `role_name`: required, string\n    * `user_view_type`: string"}