List org members via Github App

[utkarsha-ubale-sp]

Select Topic Area

Question

Body

I was using PAT for authentication and below GraphQL query to fetch org members. Now, I want to support auth via github apps as well, but this query doesn't provide the expected response. what is the correct query to fetch org members with github app authentication. I am using Ocktokit in ts for generating token

query ListOrganizationMembers($org: String!, $cursor: String, $first: Int = 100) {
		viewer {
			organization(login: $org) {
                viewerIsAMember
                viewerCanCreateTeams
				membersWithRole(after: $cursor, first: $first) {
					totalCount
                    
					edges {
						hasTwoFactorEnabled
						role
						node {
							databaseId
							login
							name
							id
							email
							twitterUsername
							url
							bio
							bioHTML
							location
                            
							company
							companyHTML
							isBountyHunter
							isHireable
							isEmployee
							isSiteAdmin
							isGitHubStar
							isViewer
							isCampusExpert
							isDeveloperProgramMember
							hasSponsorsListing
							followers {
								totalCount
							}
							following {
								totalCount
							}
							gists {
								totalCount
							}
							repositories {
								totalCount
                            
                                
							}
							watching {
								totalCount
							}
							estimatedNextSponsorsPayoutInCents
							monthlyEstimatedSponsorsIncomeInCents
							websiteUrl
							createdAt
							updatedAt
                            
						}
					}
					pageInfo {
						endCursor
						hasNextPage
                    }
                    
				}
			}
            
		}
	}

[Pramesh-Bhurtel]

The issue is not your query structure. The problem is authentication context when switching from a PAT to a GitHub App.
With a PAT, viewer represents a user, so this works:

viewer {
  organization(login: $org) { ... }
}

With a GitHub App, viewer is the app installation, not a user. That breaks access to fields like:

• viewerIsAMember
• membersWithRole (restricted depending on permissions)

[utkarsha-ubale-sp]

is there a query for fetching list of members via github app auth?

[Pramesh-Bhurtel]

query ListOrganizationMembers($org: String!, $cursor: String, $first: Int = 100) {
  organization(login: $org) {
    membersWithRole(first: $first, after: $cursor) {
      totalCount
      edges {
        role
        node {
          id
          login
          name
          url
        }
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}`

[frazrajpoot01]

Hi there! 👋

Yes, there absolutely is a query for this! You are very close, but the key difference lies in how GitHub's GraphQL API handles the viewer node depending on your authentication method.

When you use a Personal Access Token (PAT), the viewer represents your personal user account, so querying the organization through viewer works perfectly. However, when you authenticate via a GitHub App, the viewer becomes the App's bot account. Because the bot is not a traditional "member" of the organization, nesting the query inside viewer will fail or return empty results.

To fix this, you simply need to drop the viewer wrapper and query the organization directly at the root level.

1. The Corrected GraphQL Query

Here is the exact query you need. I have also removed viewerIsAMember and viewerCanCreateTeams from your original code, as those specific fields are meant for user interfaces and do not apply to a GitHub App bot context:

query ListOrganizationMembers($org: String!, $cursor: String, $first: Int = 100) {
  organization(login: $org) {
    membersWithRole(after: $cursor, first: $first) {
      totalCount
      edges {
        hasTwoFactorEnabled
        role
        node {
          databaseId
          login
          name
          id
          email
          twitterUsername
          url
          bio
          bioHTML
          location
          company
          companyHTML
          isBountyHunter
          isHireable
          isEmployee
          isSiteAdmin
          isGitHubStar
          isCampusExpert
          isDeveloperProgramMember
          hasSponsorsListing
          followers { totalCount }
          following { totalCount }
          gists { totalCount }
          repositories { totalCount }
          watching { totalCount }
          estimatedNextSponsorsPayoutInCents
          monthlyEstimatedSponsorsIncomeInCents
          websiteUrl
          createdAt
          updatedAt
        }
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}

2. Verify Your GitHub App Permissions

Because GitHub Apps rely on strict, granular permissions rather than inheriting user access, you must ensure your App is explicitly allowed to read organization members.

• Go to your GitHub App settings -> Permissions & events.
• Under Organization permissions, ensure Members is set to Read-only.
• Crucial Note: If you have to update this permission right now, the organization administrator must accept the new permissions on the installation before your App can actually fetch the data!

3. Authenticating with Octokit in TypeScript

Since you mentioned using Octokit in TS, make sure you are executing the GraphQL query using an installation token, not the App's JWT. Here is the standard implementation:

import { App } from "octokit";

// 1. Initialize the App
const app = new App({
  appId: process.env.APP_ID,
  privateKey: process.env.PRIVATE_KEY,
});

// 2. Get the authenticated Octokit client for the specific installation
const octokit = await app.getInstallationOctokit(YOUR_INSTALLATION_ID);

// 3. Execute your GraphQL query
const response = await octokit.graphql(YOUR_QUERY, {
    org: "your-org-name"
});

Let me know if this gets your member list fetching correctly!

[utkarsha-ubale-sp]

this worked for me, thank you!
There is another query which I am using to fetch similar details of a single member as below, with github app token, it doesn't provide expected result. Is there an alternate query for this?

query ReadOrganizationUser($org: String!, $nativeIdentifier: String!, $first: Int = 100) {
		user(login: $nativeIdentifier) {
			databaseId
			login
			name
			id
			email
			twitterUsername
			url
			bio
			bioHTML
			location
			company
			companyHTML
			isBountyHunter
			isHireable
			isEmployee
			isSiteAdmin
			isGitHubStar
			isViewer
			isCampusExpert
			isDeveloperProgramMember
			hasSponsorsListing
			followers {
				totalCount
			}
			following {
				totalCount
			}
			gists {
				totalCount
			}
			repositories{
                totalCount
            }
			estimatedNextSponsorsPayoutInCents
			monthlyEstimatedSponsorsIncomeInCents
			websiteUrl
			createdAt
			updatedAt
            
		}
		organization(login: $org) {
			teams(userLogins: [$nativeIdentifier], first: $first, rootTeamsOnly: false) {
				totalCount
				nodes {
					databaseId
					slug
					name
					id
				}
				pageInfo {
					endCursor
					hasNextPage
				}
			}
		}
	}

[utkarsha-ubale-sp]

And for getting outside collaborators as well, I am currently using this query

query($login: String!, $cursor: String) {
        organization(login: $login) {
            url
            login
            repositories(first: 100, after: $cursor) {
                pageInfo {
                    endCursor
                    hasNextPage
                }
                nodes {
                    name
                    collaborators(affiliation: OUTSIDE, first: 100) {
                        edges {
                            permission
                        }
                        nodes {
                            databaseId
							login
							name
							id
							email
							twitterUsername
							url
							bio
							bioHTML
							location
							company
							companyHTML
							isBountyHunter
							isHireable
							isEmployee
							isSiteAdmin
							isGitHubStar
							isViewer
							isCampusExpert
							isDeveloperProgramMember
							hasSponsorsListing
							followers {
								totalCount
							}
							following {
								totalCount
							}
							gists {
								totalCount
							}
							repositories {
								totalCount
							}
							watching {
								totalCount
							}
							estimatedNextSponsorsPayoutInCents
							monthlyEstimatedSponsorsIncomeInCents
							websiteUrl
							createdAt
							updatedAt
                        }
                    }
                }
            }
        }
    }

[M677871]

Use this:

For GitHub App authentication, viewer { organization(...) } is the problem. With an installation token, the app is not a user, so viewer is not the right entry point.

Query the organization directly instead:

query ListOrganizationMembers($org: String!, $cursor: String, $first: Int = 100) {
  organization(login: $org) {
    membersWithRole(first: $first, after: $cursor) {
      totalCount
      edges {
        role
        node {
          id
          login
          name
          url
        }
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}

Also make sure the GitHub App is installed on that org and has the required Members organization permission.
If you need private member details like email, many user fields will not be available with an app token.