# Permissions

> Every GitHub permission opsen requests, and the call that needs it.

These are the permissions in the app's manifest. GitHub shows them on the install screen; nothing outside this list is requested.

| Permission | Scope | Access | Used for |
| --- | --- | --- | --- |
| `organization_administration` | Organization | read | Last month's billed Actions spend from the billing usage report |
| `members` | Organization | write | Members, outside collaborators and invitations; cancelling an invitation |
| `organization_copilot_seat_management` | Organization | write | Copilot seats and their activity; reclaiming a seat |
| `organization_plan` | Organization | read | The plan and its filled seat count |
| `metadata` | Repository | read | Listing repositories (every GitHub App has this) |
| `actions` | Repository | write | Workflow runs and job timings; disabling a dormant schedule |
| `contents` | Repository | write | Reading workflow files; committing a fix to a new branch |
| `pull_requests` | Repository | write | Opening a fix pull request |
| `workflows` | Repository | write | GitHub requires it to change any file under .github/workflows |
| `plan` | Account | read | A personal account's own billing, read with its owner's sign-in, never another person's |
| `emails` | Account | read | The verified email address of the person signing in, for sign-in and the reports they ask for |

## Sign-in

Signing in to opsen uses a separate GitHub OAuth flow with these scopes:

| Scope | Why |
| --- | --- |
| `read:user` | Your login and name |
| `user:email` | Your primary verified email, for the report-ready email |
| `read:org` | Whether you are an owner of an organisation that installed opsen |

An installation can read an organisation, but it cannot say who is asking. Owner status is checked with your own token on every sign-in, when you press **Re-check access**, and again at most an hour after the last check. When someone leaves the organisation, GitHub's `member_removed` event removes their access at once, and their API keys with it. If GitHub cannot answer a check, access stays as it was until it can; only an answer that you are not an owner removes it.

A personal account belongs to the GitHub account id that installed opsen, not to its login, so a login that is renamed and taken by someone else does not carry access with it.

## Events

opsen subscribes to `installation`, `installation_repositories`, `organization`, `member` and `repository` events, to keep the installation record current, and to `pull_request` so that, when an owner turns on [notes on merged pull requests](/docs/sharing#notes-on-merged-pull-requests), it can price a pull request's CI when it merges. Nothing is done with a pull request event while that setting is off. It does not subscribe to push or workflow events.