Oauth scope write:org does not allow team membership add/update

[coxd]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps

What part(s) of the article would you like to see updated?

For a classic PAT the write:org scope is documented as:

Read and write access to organization membership, organization projects, and team membership.

Unfortunately team membership cannot be maintained with only this scope so either doc needs to be updated or more likely the implementation to allow it.

Apologies on submitting this as a doc issue, I searched quite extensively to try to determine a better place but rest-api-description was the only choice and did not seem appropriate.

Additional information

> curl -L -X PUT -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ghp_redacted-write:org-token" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/orgs/coxd-test/teams/ateam/memberships/coxd -d '{"role":"member"}'
{
  "message": "You must be an organization owner or team maintainer to add a team membership.",
  "documentation_url": "https://docs.github.com/rest/teams/members#add-or-update-team-membership-for-a-user"
}

> curl -L -X PUT -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ghp_redacted-admin:org-token" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/orgs/coxd-test/teams/ateam/memberships/coxd -d '{"role":"member"}'
{
  "state": "active",
  "role": "maintainer",
  "url": "https://api.github.com/organizations/171344193/team/10222765/memberships/coxd"
}

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[nguyenalex836]

@coxd Thanks so much for opening an issue! I'll get this triaged for review ✨

[github-actions]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert 👀

[skedwards88]

Thanks for this issue. We can update the doc for write:org to only include “Read and write access to organization membership and organization projects”. You or anyone else is welcome to open a pull request to do this.

[coxd]

@skedwards88

Apologies for the delay in replying.

I submitted this as a doc issue because I couldn't find anywhere else to bring this up. This is most likely a defect as org and team membership go hand-in-hand. I just confirmed a token scoped to only "read:org" is able to read team memberships. I do not think just changing the doc is the right outcome here based on this. If you could help me to understand where I could raise this issue in the correct location to have it treated as a defect rather than a doc issue that would be greatly appreciated.

[nguyenalex836]

@coxd Thank you for the additional context! Given your comment above, the best place to send this feedback is to https://github.com/github/feedback/discussions ✨

If there's anything in the documents that you have suggestions for updating, please feel free to open an issue in this repo 💛

[coxd]

For anyone that finds this issue - I've created a discussion. 🤞