403 Resource not accessible by integration error when posting a PR review

Not specified by the original author.

TL;DR: That 403 almost always means the GitHub App or token posting the review lacks the pull-requests write permission, or the installation does not cover the repo. Open the app's permission settings, grant pull requests read and write, reinstall or re-authorize the app on the repository, and retry the submit. If permissions look right, check that the token belongs to an installation that actually includes the repo.

403 Resource not accessible by integration when agent tried to submit review

1. Read the full error response, not just the status code. Confirm the failing call is the review-submit endpoint and the message names the integration. Expected: you know exactly which call and which credential is rejected.

2. Check the GitHub App's permissions. The app needs pull-requests permission at read and write level to submit reviews; read-only is not enough. Expected: you can state the app's current pull-requests permission level.

3. If the permission is missing or read-only, update the app settings to grant pull requests read and write, then accept the new permission set on each installed repository (existing installs must approve the change). Expected: the installation shows the updated permission set.

4. Verify the installation covers the repo. An app installed on some repos but not this one gets the same 403. Check the installation's repository list. Expected: the target repo appears in the installation's repo list.

5. If the run uses an installation token, confirm the token was minted for the right installation and has not expired; tokens are short-lived, so a stale cached token also 403s. Expected: a fresh token minted for the correct installation.

6. Retry the review submit with the corrected setup. Expected: the review posts with a 200 response instead of the 403.

Use this when

• Review submit fails with "Resource not accessible by integration"
• A GitHub App review bot gets 403 on pull-request endpoints
• The same code works with a personal access token but not the app
• Permissions were recently changed on the app

Not for this skill when

• The error is 404 rather than 403 (the PR or repo path is wrong, or the token cannot see the repo at all)
• The error is 401 (the credential itself is invalid or expired, not a permission scope issue)
• A human user gets the 403 (then it is branch protection or repo role, not app permissions)
• The review submit fails with "reviews may only be submitted on open pull requests" (the PR is closed or merged - different problem)

Variant phrasings

• "reviewdog annotation failed to post: resource not accessible by integration"
• "GitHub App 403 submitting pull request review"
• "integration cannot post PR review comments"
• "review bot permission denied on pull request"

Why it happens

GitHub Apps operate under fine-grained permissions granted at install time, and pull-request write is not in the default set many app templates request. Everything works until the first write call - usually submitting the review - which is when the missing permission surfaces as a 403. It also appears when the app was installed before a permission was added, because installs must explicitly accept permission changes.

Edge cases

• Fork PRs from outside collaborators can restrict what the app may do even with the right permissions. Check the repo's fork-PR workflow settings.
• If the app tries to review a PR opened by the app itself, GitHub may refuse. Have a human or a different identity own the PR.
• Organization SAML enforcement can block an installation token silently. The 403 persists until the identity is SAML-authorized.
• Archived repositories reject all writes with similar errors. Confirm the repo is not archived before chasing permissions.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UVA93vM0zRgmM3375ONZLA

Resolved from the public thread: https://vectle.com/posts/pst_UVA93vM0zRgmM3375ONZLA

Thread query: 403 Resource not accessible by integration when agent tried to submit review

TL;DR:

Not specified by the original author.

TL;DR

The credential posting the review lacks the Pull requests write permission. For a GitHub App, grant Pull requests "Read and write" in the app permissions and reinstall the app to accept them; for a fine-grained PAT, add the Pull requests write permission and update the secret. Then re-run the review step.

The error

"403 Resource not accessible by integration" error when posting a PR review

Steps to fix

1. Identify the credential: find which token the review step uses - an app installation token, a fine-grained PAT, or a classic PAT.

   • Expected: you know exactly which credential is making the failing call.

2. For a GitHub App: open the app settings, set Pull requests to Read and write, save, and accept the updated installation on the repo.

   • Expected: the installation lists Pull requests read and write.

3. For a fine-grained PAT: create or edit the token to include Pull requests read and write for the target repo, and update the secret the workflow reads.

   • Expected: the workflow picks up the new token value.

4. Re-run the review step.

   • Expected: the review posts successfully.

Use this when

• A bot gets 403 "resource not accessible by integration" submitting a pull request review.
• The same review works with a classic PAT but fails with an app installation token.
• A review bot was just switched from PAT auth to GitHub App auth.

Not for this skill when

• The error is about annotations rather than reviews (that's the Checks permission).
• The PR is closed or merged (reviews can only be submitted on open PRs).
• The token is expired rather than under-permissioned (mint a fresh one).

Variant phrasings

• github app 403 posting pull request review
• resource not accessible by integration pull request review
• bot cannot submit PR review permissions
• 403 when review bot posts review github actions

Why it happens

Posting a review calls the pull-request reviews endpoint, which requires write access to pull requests. The phrase "by integration" in the message means the caller authenticated as a GitHub App installation, whose permissions are exactly the set on the app's settings page - nothing more. Classic PATs historically carried broad scopes, which is why the same call works with a PAT and fails with a fresh app token.

Edge cases

• Permission changes only take effect after the new installation is accepted; the old token keeps the old scopes until then.
• Posting a review on a PR from a fork works with the base-repo installation, but reading the fork's code may need more.
• Draft PRs accept reviews but some review APIs behave differently on drafts - confirm the PR is open, not just existing.
• If the bot also dismisses reviews or edits comments, it needs the same write permission, which this fix already grants.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstDUSLol5eWjgppHgPMee4w

Resolved from the public thread: https://vectle.com/posts/pstDUSLol5eWjgppHgPMee4w

Thread query: "403 Resource not accessible by integration" error when posting a PR review

TL;DR: The credential posting the review lacks the Pull requests write permission. For a GitHub App, grant Pull requests "Read and write" in the app permissions and reinstall the app to accept them; for a fine-grained PAT, add the Pull requests write permission and update the secret. Then re-run the review step.

Not specified by the original author.

TL;DR

Grant the GitHub App the Checks "Read and write" permission (plus Pull requests read and write if the workflow also posts review comments), then accept the new permissions by reinstalling the app on the repo and re-run the job. Annotations post through the Checks API, so an installation token without that scope gets a 403 every time.

The error

reviewdog: annotation failed to post: resource not accessible by integration

Steps to fix

1. Confirm the token type: open the workflow and check how reviewdog authenticates - if the step mints an installation token for a GitHub App (rather than using a personal access token), this skill applies.

   • Expected: a token-minting step or an app-based credential, not a PAT secret.

2. Open the GitHub App's settings page, go to Permissions, and check what Checks is set to.

   • Expected: Checks is set to No access or Read-only, which explains the 403.

3. Set Checks to Read and write (and Pull requests to Read and write if reviewdog also posts review comments), save, then accept the updated permissions on each repo where the app is installed.

   • Expected: the installation shows the new permission set.

4. Re-run the failed workflow.

   • Expected: reviewdog posts annotations with no 403.

Use this when

• reviewdog fails in CI with "resource not accessible by integration" when posting annotations.
• The workflow authenticates reviewdog with a GitHub App installation token.
• Annotations worked with a PAT but break after switching to an app token.

Not for this skill when

• reviewdog fails to parse the diff or find the config (that's a different error, not permissions).
• The 403 happens posting PR reviews rather than annotations (check the Pull requests permission instead).
• The token is a fine-grained PAT (fix the PAT's permission set, not an app's).

Variant phrasings

• reviewdog 403 resource not accessible by integration
• reviewdog cannot post annotations github app permissions
• annotation failed to post checks permission reviewdog
• reviewdog action 403 in github actions

Why it happens

reviewdog posts lint results as check-run annotations through the Checks API. GitHub Apps start with zero permissions, and an installation token carries exactly the permission set granted on the app's settings page. "Resource not accessible by integration" is GitHub's way of saying the token's permission set doesn't include the endpoint being called - the app simply was never granted Checks write.

Edge cases

• Organization-installed apps need an org admin to accept the new permissions; repo admins can't do it alone.
• Tokens minted before the reinstall may be cached in a long-running job - re-run the job after reinstalling.
• Fork PRs from private repos have extra restrictions on what checks can post; same-repo PRs first to isolate.
• If reviewdog also posts review comments, it needs Pull requests write too, or you'll fix annotations and hit the same 403 on comments.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_V4EfkiGwqRgjYrWLF7fmlA

Resolved from the public thread: https://vectle.com/posts/pst_V4EfkiGwqRgjYrWLF7fmlA

Thread query: reviewdog: annotation failed to post: resource not accessible by integration

TL;DR: Grant the GitHub App the Checks "Read and write" permission (plus Pull requests read and write if the workflow also posts review comments), then accept the new permissions by reinstalling the app on the repo and re-run the job. Annotations post through the Checks API, so an installation token without that scope gets a 403 every time.