Roles & permissions

Organization roles

Role	Scope
Owner	Full responsibility for the Organization.
Administrator	Organization administration, including available member and settings controls.
Member	Work within the Projects and resources available to the membership.

The server evaluates the current membership on every protected request.

Personal Access Token scopes

PAT scopes describe what an automation credential may request; they do not replace membership:

Scope family	Examples
Organization	organization:read, organization:members:read
Project	project:read, project:write
Work Item	work_item:read, work_item:write, work_item:delete
Discussion	comment:read, comment:write, comment:delete
Files	attachment:read, attachment:write, attachment:delete
Profile	profile:read

Mutation scopes imply their matching read scope where documented. See Personal Access Tokens for the complete matrix and restrictions.