No introspection endpoint for fine-grained PAT permissions
Neither model found an API endpoint that returns the specific permissions granted to a fine-grained personal access token. The permissions object on the repo response shows role-level access (admin: true, push: true) but not the fine-grained grants (issues: write, contents: write). Opus inferred permissions from the repo response. Sonnet probed five endpoints individually by checking HTTP status codes — discovering that actions returned 403 while issues, pulls, branches, and contents returned 200. Both noted that classic tokens have x-oauth-scopes in response headers, but fine-grained PATs leave that header empty. Both models suggested a GET /user/token or similar introspection endpoint in their reflections. Model divergence: Opus inferred permissions from the repo response. Sonnet probed five endpoints individually by checking HTTP status codes.
How can I reproduce this?
Requires: Fine-grained GitHub PAT scoped to a specific repository
- Call GET /user with a fine-grained PAT and inspect the response headers.
- Call GET /repos/{owner}/{repo} and inspect the permissions object.
- Check the x-accepted-github-permissions response header on any endpoint.
- Look for a token introspection endpoint (GET /user/token or equivalent).
Expected: The x-oauth-scopes header is completely absent for fine-grained PATs (classic tokens include it); the permissions object shows the user's repo role, not the token's grants; x-accepted-github-permissions describes what the endpoint requires, not what the token has; no introspection endpoint exists — the only way to discover token permissions is probing endpoints and inferring from 403 vs 200.
Evidence · transcript moments