Reference B: Customer Owned GitHub App permissions

This reference lists the GitHub App permissions a Customer Owned GitHub App requests. A Customer Owned GitHub App requests every permission the shared Cortex GitHub App requests (see Reference A: Shared Cortex GitHub App permissions), plus additional organization-level and identity permissions. Cortex Cloud defines these permissions in the configuration manifest embedded in the GitHub app creation page.

IMPORTANT: If you downgrade a Customer Owned GitHub App permissions after the GitHub App is created, the corresponding Cortex Cloud capability may become unavailable. Refer to Update Customer Owned GitHub App permissions or resolve integration errors.

The following table lists the additional permissions a Customer Owned GitHub App requests beyond the shared Cortex GitHub App permissions set.

Permission	Access	Purpose
emails	Read	Read user email for contributor identification
members	Read	Read organization membership, roles, and outside collaborators
organization_actions_variables	Read	Read organization-level Actions variables for CI/CD security
organization_administration	Read	Read organization metadata, installations, and credential authorizations
organization_hooks	Write	Register and manage organization-level webhooks for scan triggers
organization_secrets	Read	Read organization-level Actions secrets metadata for CI/CD security
organization_self_hosted_runners	Read	Read runner group configurations for CI/CD security analysis
organization_user_blocking	Read	Read blocked-user information for security posture assessment

NOTE: A Customer Owned GitHub App requests the union of the shared Cortex GitHub App permissions in Reference A and the additional permissions in this table.