API v4 - Unable to Retrieve Email - Resource not accessible by integration #24774

c-brooks · 2019-03-11T21:34:56Z

c-brooks
Mar 11, 2019

Hi,

I am trying to retrieve information on pull requests, including the author’s email (and the emails of reviewers and commentors). Unfortunately whenever I include the “Email” field in my query I get the error “Resource not accessible by integration”. Removing the Email field removes this error.

Simplified query:

query Github_PullRequests($name: String!, $owner: String!) {
  repository(owner: $owner, name: $name) {
    name
    pullRequests(first: 1) {
      nodes {
        number
        title
        author {
          ... on User {
            login
            email # <- causes problem
            name
          }
        }
      }
      pageInfo {
        hasNextPage
        endCursor
      }
      totalCount
    }
  }
}

Response:

{
  "data": {
    "repository": {
      "name": "api",
      "pullRequests": {
        "nodes": [
          {
            "number": 1,
            "title": "Update project's namespace",
            "author": null
          }
        ],
        "pageInfo": {
          "hasNextPage": true,
          "endCursor": "Y3Vyc29yOnYyOpHOCxMLQA=="
        },
        "totalCount": 487
      }
    }
  },
  "errors": [
    {
      "type": "FORBIDDEN",
      "path": [
        "repository",
        "pullRequests",
        "nodes",
        0,
        "author",
        "email"
      ],
      "locations": [
        {
          "line": 12,
          "column": 13
        }
      ],
      "message": "Resource not accessible by integration"
    }
  ]
}

The Permissions I have given (all read-only):

Repository contents
Issues
Repository metadata
Pull requests
Organization members
Repository webhooks

User Permissions:

Emails

I couldn’t find a comprehensive list of the permissions and what access they give, so forgive me if it’s a silly error on my part. I have tried the same query using a personal access token and it works fine.

Answered by AndreaGriffiths11

Mar 26, 2019

Hi @c-brooks,

Thanks again for your patience, here is the feedback based on our Support teams research:

The reason that request returns the specific error message is because a user’s email is only accessible via user-to-server request (in other words, an OAuth token and not an installation token).

Here’s some more context: when a GitHub App is installed to a repo, it requests repo-specific permissions to the authorizing user. However, a GitHub App can only get user-specific information if the user in question has chosen to be identified by the app as a part of the User Authorization flow described here:

https://developer.github.com/apps/building-github-apps/identifying-and-authorizing-use…

View full answer

AndreaGriffiths11 · 2019-03-18T14:52:39Z

AndreaGriffiths11
Mar 18, 2019

Hi @c-brooks ,

Thanks for being here! And thank you for your patience while we researched your question. To be able to help you better could you answer the following:

What kind of request is this?: is it server-to-server (using an installation token) or user-to-server (using an OAuth token)?

0 replies

c-brooks · 2019-03-18T16:39:52Z

c-brooks
Mar 18, 2019
Author

Thanks for the reply - sorry, I should have stated in the original post. It’s an installation token for a Github App

0 replies

AndreaGriffiths11 · 2019-03-26T15:33:10Z

AndreaGriffiths11
Mar 26, 2019

Hi @c-brooks,

Thanks again for your patience, here is the feedback based on our Support teams research:

The reason that request returns the specific error message is because a user’s email is only accessible via user-to-server request (in other words, an OAuth token and not an installation token).

Here’s some more context: when a GitHub App is installed to a repo, it requests repo-specific permissions to the authorizing user. However, a GitHub App can only get user-specific information if the user in question has chosen to be identified by the app as a part of the User Authorization flow described here:

https://developer.github.com/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps/#identifying-and-authorizing-users-for-github-apps

At the end of the authorization flow, that OAuth token can be used to make a request to the GraphQL API to obtain the email value for some author. However, only emails from author’s who have been authorized by the app can be obtained.

Thank you for your feedback on the documentation. It’s a great point all user-to-server requests are documented, but there isn’t a specific section in GitHub Developer that would tell integrators which GraphQL fields are accessible by scope. We’ve taken your feedback and passed it along to the appropriate teams. Thanks again for reaching out 😀

0 replies

allenap · 2021-04-22T19:42:20Z

allenap
Apr 22, 2021

Hi @AndreaGriffiths11,

I’m seeing inconsistency in how the access rules are applied.

I developed a GitHub App with a temporary organisation. A few colleagues joined the organisation as guinea pigs, one of whom hides his email. The following query has worked consistently, returning null for that one member’s email address:

query($nodeId: ID!, $cursor: String) {
  node(id: $nodeId) {
    ... on Organization {
      membersWithRole(first: 100, after: $cursor) {
        edges {
          hasTwoFactorEnabled
          node {
            id
            email
            name
            login
            createdAt
            updatedAt
          }
          role
        }
        pageInfo {
          endCursor
          hasNextPage
        }
      }
    }
  }
}

Now I have installed my app into another organisation, and I am consistently getting “Resource not accessible by integration” until I remove the email field from my query. Do you know what might cause the difference in behaviour?

Thanks, Gavin.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

API v4 - Unable to Retrieve Email - Resource not accessible by integration #24774

{{title}}

Replies: 4 comments

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

GitHub Community

API v4 - Unable to Retrieve Email - Resource not accessible by integration #24774

c-brooks Mar 11, 2019

Replies: 4 comments

AndreaGriffiths11 Mar 18, 2019

c-brooks Mar 18, 2019 Author

AndreaGriffiths11 Mar 26, 2019

allenap Apr 22, 2021

c-brooks
Mar 11, 2019

AndreaGriffiths11
Mar 18, 2019

c-brooks
Mar 18, 2019
Author

AndreaGriffiths11
Mar 26, 2019

allenap
Apr 22, 2021