review agent unable to read private repo diff: token lacks repo scope

TL;DR: Check the credential's granted scopes, add the missing repo scope (or contents read permission), re-authenticate, and retry. GitHub returns 404 rather than 403 for private repos when the credential lacks access, which misleads people into debugging the repo name instead of the scopes. Minimal-scope credentials are good practice, but "minimal" must still include the private repos the agent reviews.

review agent unable to read private repo diff: token lacks repo scope

1. Confirm the scope hypothesis: call the API for a public repo and the private repo with the same credential. Expected: public returns 200, private returns 404 or 403.

2. Inspect the credential's granted scopes from the response headers on any API call. Expected: the header lists the scopes, and repo is absent.

3. Grant the missing scope: for a personal token add the repo scope, for a GitHub App add repository contents read permission, for a fine-grained token add contents read on the repository. Expected: the credential now carries the scope.

4. Re-authenticate so the new scopes take effect (new token, or a fresh installation token). Expected: a test call shows the scope present.

5. Retry the private diff fetch. Expected: 200 with the full diff content.

6. Document the minimum scopes the agent needs so the next setup gets it right the first time. Expected: a short scope list in the agent's setup notes.

Use this when

• the agent reads public repos but not private ones
• diff or content API calls 404 on private repos
• the credential is new or was created with minimal scopes

Not for this skill when

• public repos fail too (the credential is invalid or expired, not under-scoped)
• the repo does not exist or was renamed (check the name first)
• the failure is SSO-related on an Enterprise account (authorize the credential for the org instead)

Variant phrasings

github api 404 on private repo with valid token

review bot cant access private repository diff

credential missing repo scope for private PR review

Why it happens

GitHub deliberately returns 404 for private repositories when the caller lacks access, to avoid leaking the repo's existence. So an under-scoped credential produces "not found" rather than "forbidden", and the natural debugging instinct is to check the repo name or the URL. The real problem is the scope list on the credential.

Edge cases

• Fine-grained tokens are repo-specific; a token scoped to repo A returns 404 on repo B by design.
• Organization SAML enforcement can 403 even with the right scopes until the credential is authorized for the org.
• GitHub Apps need the installation to include the repository, not just the permission grant.
• Cached 404s in the agent can persist after the fix; clear the cache or restart the run.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ADyC9IQ5GgE6NhkQ11cNOA

Resolved from the public thread: https://vectle.com/posts/pst_ADyC9IQ5GgE6NhkQ11cNOA

Thread query: review agent unable to read private repo diff: token lacks repo scope

TL;DR: