GitHub API surface disposition register

This register is generated by npm run api-surface. Do not edit it by hand. The complete operation-level data is in github-api-surface.json.

Sources

Transport	Source
REST	GitHub OpenAPI 2026-03-10 at b26c240ded1c8b79cb0fb09dee4a21239061fa23, SHA-256 6f36bc90e67debdb256880d0c5daaaba0afa8ce7bde343db7cc7f608492a997f
GraphQL	Public schema mutation introspection captured 2026-08-13 (274 mutations)

Octoform 0.3 sends no REST version header, so GitHub currently applies 2022-11-28. The newer pinned description is used to disposition future API coverage; it does not claim that the 0.3 line already uses that version. Patch 0.3.2 does not add GitHub operations, so the implementation table continues to identify v0.3.1 as the release where those routes entered the product contract.

Summary

Measure	Count
All dispositioned operations	1337
REST operations	1063
GraphQL mutations	274
Implemented by v0.3.1	37
Deprecated upstream	47
declarative operations	65
excluded operations	4
observational operations	541
operational operations	432
sensitive-declarative operations	295

Planned release targets

Target	Operations
0.3.1	37
0.5.0	295
0.6.0	1001
Excluded	4

REST families

Family	Total	Observational	Declarative	Sensitive declarative	Operational	Excluded
actions	179	89	0	49	41	0
activity	21	16	0	0	5	0
agents	30	14	0	16	0	0
apps	9	7	0	0	2	0
billing	4	4	0	0	0	0
campaigns	5	2	0	0	3	0
checks	12	6	0	0	6	0
code-quality	4	3	0	1	0	0
code-scanning	21	13	0	7	1	0
code-security	11	5	0	6	0	0
codespaces	48	22	0	14	12	0
copilot	22	13	0	9	0	0
copilot-spaces	28	10	0	6	12	0
dependabot	21	11	0	9	1	0
dependency-graph	5	4	0	0	1	0
gists	1	1	0	0	0	0
git	13	6	0	0	7	0
hosted-compute	6	3	0	3	0	0
interactions	16	6	0	0	10	0
issues	57	26	0	0	31	0
licenses	1	1	0	0	0	0
migrations	22	11	0	0	11	0
oidc	5	2	0	3	0	0
orgs	109	54	0	53	1	1
packages	27	15	0	0	12	0
private-registries	6	3	0	3	0	0
projects	26	14	0	0	12	0
pulls	34	15	0	0	19	0
reactions	15	5	0	0	10	0
repos	201	105	61	20	13	2
secret-scanning	17	8	0	8	1	0
security-advisories	8	3	0	0	5	0
teams	32	17	0	15	0	0
users	47	27	0	20	0	0

GraphQL mutation families

Family	Total	Observational	Declarative	Sensitive declarative	Operational	Excluded
collaboration	58	0	0	0	58	0
delivery	41	0	0	2	39	0
migrations	3	0	0	0	3	0
organization-governance	59	0	0	32	26	1
projects	42	0	0	0	42	0
repository-governance	36	0	4	18	14	0
sponsors	9	0	0	0	9	0
user-and-platform	26	0	0	1	25	0

Operations implemented by v0.3.1

Method	Path	Operation	Disposition
GET	/orgs/{org}	orgs/get	observational
PUT	/orgs/{org}/properties/schema/{custom_property_name}	orgs/custom-properties-for-repos-create-or-update-organization-definition	sensitive-declarative
GET	/orgs/{org}/properties/values	orgs/custom-properties-for-repos-get-organization-values	observational
PATCH	/orgs/{org}/properties/values	orgs/custom-properties-for-repos-create-or-update-organization-values	sensitive-declarative
GET	/orgs/{org}/repos	repos/list-for-org	observational
GET	/orgs/{org}/rulesets	repos/get-org-rulesets	observational
GET	/repos/{owner}/{repo}	repos/get	observational
PATCH	/repos/{owner}/{repo}	repos/update	declarative
DELETE	/repos/{owner}/{repo}/automated-security-fixes	repos/disable-automated-security-fixes	declarative
GET	/repos/{owner}/{repo}/automated-security-fixes	repos/check-automated-security-fixes	observational
PUT	/repos/{owner}/{repo}/automated-security-fixes	repos/enable-automated-security-fixes	declarative
GET	/repos/{owner}/{repo}/branches/{branch}	repos/get-branch	observational
GET	/repos/{owner}/{repo}/branches/{branch}/protection	repos/get-branch-protection	observational
POST	/repos/{owner}/{repo}/branches/{branch}/rename	repos/rename-branch	declarative
GET	/repos/{owner}/{repo}/code-scanning/default-setup	code-scanning/get-default-setup	observational
PATCH	/repos/{owner}/{repo}/code-scanning/default-setup	code-scanning/update-default-setup	sensitive-declarative
GET	/repos/{owner}/{repo}/contents/{path}	repos/get-content	observational
PUT	/repos/{owner}/{repo}/contents/{path}	repos/create-or-update-file-contents	declarative
GET	/repos/{owner}/{repo}/environments	repos/get-all-environments	observational
PUT	/repos/{owner}/{repo}/environments/{environment_name}	repos/create-or-update-environment	sensitive-declarative
GET	/repos/{owner}/{repo}/git/ref/{ref}	git/get-ref	observational
POST	/repos/{owner}/{repo}/git/refs	git/create-ref	operational
DELETE	/repos/{owner}/{repo}/private-vulnerability-reporting	repos/disable-private-vulnerability-reporting	declarative
GET	/repos/{owner}/{repo}/private-vulnerability-reporting	repos/check-private-vulnerability-reporting	observational
PUT	/repos/{owner}/{repo}/private-vulnerability-reporting	repos/enable-private-vulnerability-reporting	declarative
GET	/repos/{owner}/{repo}/rulesets	repos/get-repo-rulesets	observational
POST	/repos/{owner}/{repo}/rulesets	repos/create-repo-ruleset	declarative
GET	/repos/{owner}/{repo}/rulesets/{ruleset_id}	repos/get-repo-ruleset	observational
PUT	/repos/{owner}/{repo}/rulesets/{ruleset_id}	repos/update-repo-ruleset	declarative
PUT	/repos/{owner}/{repo}/topics	repos/replace-all-topics	declarative
DELETE	/repos/{owner}/{repo}/vulnerability-alerts	repos/disable-vulnerability-alerts	declarative
GET	/repos/{owner}/{repo}/vulnerability-alerts	repos/check-vulnerability-alerts	observational
PUT	/repos/{owner}/{repo}/vulnerability-alerts	repos/enable-vulnerability-alerts	declarative
GET	/user	users/get-authenticated	observational
GET	/user/repos	repos/list-for-authenticated-user	observational
GET	/users/{username}	users/get-by-username	observational
GET	/users/{username}/repos	repos/list-for-user	observational

Implemented means that v0.3.1 invokes the operation in at least one bounded context. It does not make every possible use of that operation safe for normal desired-state reconciliation.

Regeneration and review

npm run api-surface downloads the pinned REST description and regenerates both artifacts from committed review metadata. npm run api-surface:check performs the same work without writing and fails when either artifact is stale.

To review an intentional upstream refresh:

1. Pin the official REST description's API version, commit, URL and SHA-256 in reference/github-api-surface.config.json.
2. Capture the public GraphQL mutation fields name, isDeprecated and deprecationReason with deprecated fields included.
3. Run npm run api-surface -- --graphql-snapshot <path> --update-rest-snapshot.
4. Inspect every source, review-metadata and generated-artifact diff before accepting it.

Ordinary generation never expands the reviewed operation set. The update flags are deliberately explicit so API growth cannot silently enter the register.

Interpretation

• Observational operations provide inventory, capability evidence, or audit data.
• Declarative operations can represent ordinary durable desired state.
• Sensitive declarative operations manage secrets, access, security, identity, or broad policy.
• Operational operations are transient workflows or historical events and never run as an implicit apply side effect.
• Excluded operations are outside normal reconciliation because absence must never imply deletion, transfer, or another irreversible action.

An operation's target is a planning release, not a promise that GitHub grants it to every owner or token. Runtime capability and permission evidence remains the authority.