Skip to main content
Applies to BloodHound Enterprise and CE

General Information

Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the installation are stored as scope:access values such as contents:write in the permissions property. Unlike fine-grained personal access tokens, GitHub does not expose separate organization and repository permission buckets for app installations, so this property remains a single flat permission list. Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Installations with repository_selection set to all use one GH_CanAccess edge to the organization’s repository/all GH_Scope; GH_ScopedTo edges enumerate the repositories in that reusable scope. For installations with repository_selection set to selected, the collector uses the enterprise organization-installation repositories API to enumerate the granted repositories when the enterprise installation has Enterprise organization installations: read or Enterprise organization installation repositories: read. If that permission is unavailable, selected repository edges are skipped.

Properties

Diagram

Edges

The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Outbound Edges

Properties