{"record":{"id":"7f74a8f24cae60b0","repo":"infiniflow/ragflow","slug":"your-github-token-does-not-have-sufficient-permiss","errorCode":null,"errorMessage":"Your GitHub token does not have sufficient permissions for this repository (HTTP 403).","messagePattern":"Your GitHub token does not have sufficient permissions for this repository \\(HTTP 403\\)\\.","errorType":"validation","errorClass":"InsufficientPermissionsError","httpStatus":null,"severity":"error","filePath":"common/data_source/github/connector.py","lineNumber":744,"sourceCode":"                        raise ConnectorValidationError(\n                            f\"Your GitHub token is missing authorization to access the `{self.repo_owner}` organization. Please follow the guide to authorize your token: {SSO_GUIDE_LINK}\"\n                        )\n                    # If not an org, try as a user\n                    user = self.github_client.get_user(self.repo_owner)\n\n                    # Check if we can access any repos\n                    total_count = user.get_repos().totalCount\n                    if total_count == 0:\n                        raise ConnectorValidationError(f\"Found no repos for user: {self.repo_owner}. Does the credential have the right scopes?\")\n\n        except RateLimitExceededException:\n            raise UnexpectedValidationError(\"Validation failed due to GitHub rate-limits being exceeded. Please try again later.\")\n\n        except GithubException as e:\n            if e.status == 401:\n                raise CredentialExpiredError(\"GitHub credential appears to be invalid or expired (HTTP 401).\")\n            elif e.status == 403:\n                raise InsufficientPermissionsError(\"Your GitHub token does not have sufficient permissions for this repository (HTTP 403).\")\n            elif e.status == 404:\n                if self.repositories:\n                    if \",\" in self.repositories:\n                        raise ConnectorValidationError(f\"None of the specified GitHub repositories could be found for owner: {self.repo_owner}\")\n                    else:\n                        raise ConnectorValidationError(f\"GitHub repository not found with name: {self.repo_owner}/{self.repositories}\")\n                else:\n                    raise ConnectorValidationError(f\"GitHub user or organization not found: {self.repo_owner}\")\n            else:\n                raise ConnectorValidationError(f\"Unexpected GitHub error (status={e.status}): {e.data}\")\n\n        except Exception as exc:\n            raise Exception(f\"Unexpected error during GitHub settings validation: {exc}\")\n\n    def validate_checkpoint_json(self, checkpoint_json: str) -> GithubConnectorCheckpoint:\n        return GithubConnectorCheckpoint.model_validate_json(checkpoint_json)\n\n    def retrieve_slim_document(","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/github/connector.py#L726-L762","documentation":"InsufficientPermissionsError raised when the validation probe gets HTTP 403 without the SSO message. The token authenticates but lacks the required repository scope — the credential is valid, its grants are not. Separating 403 from 401 lets the system suggest scope fixes instead of token rotation.","triggerScenarios":"A token with only public/read:public scope calling get_repo/get_contents on a private repo, or an org-restricted fine-grained PAT probing a repo outside its allowlist, returns 403.","commonSituations":"Classic PAT created with just 'public_repo'; fine-grained PAT whose repository access list omits the target; org-app installation missing 'Contents: read' on some repos.","solutions":["Recreate the PAT including the 'repo' scope (classic) or add the specific repositories + 'Contents: Read' permission (fine-grained).","For GitHub Apps, have an org admin grant the app access to the needed repositories.","If SSO was the real cause, authorize the token for the org (see the SSO-specific error path)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    connector.validate_connector_settings()\nexcept InsufficientPermissionsError:\n    show_scope_instructions('add repo scope / grant repo access to the token')","preventionTips":["When creating the PAT, select 'repo' scope for private repos or list exact repos on fine-grained tokens.","Audit fine-grained PAT repository allowlists whenever repos are added to the connector."],"tags":["github","permissions","scopes","http-403"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}