GitHub Fine-Grained Personal Access Token - Required Permissions

This page defines the process to create GitHub Access Token and the minimum GitHub fine-grained personal access token (PAT) permissions required for Delivery Shield's automated remediation workflow, including branch creation, committing changes, and opening pull requests.

To Create a GitHub Access Token

Follow the steps below to generate a Fine-Grained Personal Access Token in GitHub:

1. Click on your profile icon (top-right corner) and select Settings.

1. Scroll down in the left sidebar and click Developer settings.

1. Under Personal access tokens, select Fine-grained tokens.

1. Click Generate new token.

2. Fill in the token details:

   1. Token name — Give it a descriptive name

   2. Resource owner — Select the appropriate owner (your account or an organization)

   3. Expiration — Choose an expiration period

1. Under Repository access, select the repository or repositories this token should apply to.

2. Configure the required Permissions for the token.

3. Click Generate token.

Copy and save your token immediately — GitHub will not show it again after you leave the page.

Required Permissions:

The following permissions are required in Delivery Shield.

Permission	Access Level	Purpose
Contents	Read and write	Required to create branches and commit remediation changes to the repository.
Pull requests	Read and write	Required to open and manage pull requests for remediation changes.
Metadata	Read Only (required)	Mandatory baseline permission auto-included by GitHub on every fine-grained PAT; grants repository search, collaborator listing, and metadata access. Cannot be removed.

Notes

• The permissions mentioned above are sufficient for the remediation workflow end-to-end — no additional scopes are required.

• The token must be scoped to Only select repositories and explicitly include each target repository.