Not able to add sub issue using gh api

[mounakrishna99]

REST API adding sub issue problem

I generated a Fine grain PAT with writable access to Issues for the repository permissions along with other requirements of writable Github Projects etc. I am able to create issues using that PAT token. But when I try to add a sub-issue as mentioned in the API document https://docs.github.com/en/rest/issues/sub-issues?apiVersion=2022-11-28#add-sub-issue, I get status error as 403 stating resource not accessible.

I tried a new temporary Fine grain PAT token with access to all and ran, but still the same issue.

I even tried with a classic PAT token. In this case, I got status: 404 with message as "Not Found".

Am I missing something in giving the permissions or is this a bug?

[deoninja]

This is not a bug — it’s a known limitation / requirement of the Sub-Issues API.

Why you’re getting 403 (Fine-grained PAT)

The Sub-Issues REST API only works for repositories that are part of a GitHub Project (Projects v2) and the issue must already belong to that project.

Even if:

Your fine-grained PAT has write access to Issues

You can create issues successfully

You will still get:

403 Resource not accessible

if any of the following is true:

The issue is not added to a Project (Projects v2)

The authenticated user does not have write access to that Project

The repository is not associated with the Project

The Project is owned by an organization, and the token lacks Project permissions at the org level

👉 The Sub-Issues feature is Project-scoped, not just repo-scoped.

[DavidBoike]

Honestly, I can't believe that's true. Nothing in the documentation or my own attempts to use the sub_issues API supports any of that.

Using a fine-grained token (starting with github_pat_) or even a classic personal token (starting with ghp_) I can list sub-issues or get parent issue just fine using the CURL snippets provided in the documentation

It's just the three mutating operations to remove sub-issue, add sub-issue, or reprioritize sub-issue that fail.

For all 3 of these mutating operations, the docs say only that a fine-grained token must have Write access to Issues repository permissions for the repo.

The word "project" does not appear on the sub-issues documentation page at all except for the menu item for actual Project-related APIs.

And more to the point, I created a project in my test repo and moved all the issues in the repo into it, and gave my fine-grained token read/write access to org projects and a bunch of other stuff, in fact here's the details:

When I try to add a sub-issue:

curl -L \
  -X POST \
  -H "Accept: application/vnd.github.raw+json" \
  -H "Authorization: Bearer github_pat_xxxxxxxxxxxxxxxx" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/OWNER/REPO/issues/1/sub_issues \
  -d '{"sub_issue_id":10}'
{
  "message": "Resource not accessible by personal access token",
  "documentation_url": "https://docs.github.com/rest/issues/sub-issues#add-sub-issue",
  "status": "403"
}

When I try to remove a sub-issue:

curl -L \
  -X DELETE \
  -H "Accept: application/vnd.github.raw+json" \
  -H "Authorization: Bearer github_pat_xxxxxxxxxxxxxxxx" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/OWNER/REPO/issues/1/sub_issue \
  -d '{"sub_issue_id":2}'
{
  "message": "The provided sub-issue does not exist",
  "documentation_url": "https://docs.github.com/rest/issues/sub-issues#remove-sub-issue",
  "status": "404"
}

I assure you issue number 2 does exist.

When I try to reprioritize:

curl -L \
  -X PATCH \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer github_pat_xxxxxxxxxxxxxxxx" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/OWNER/REPO/issues/1/sub_issues/priority \
  -d '{"sub_issue_id":2,"after_id":9}'
{
  "message": "The provided sub-issue does not exist",
  "documentation_url": "https://docs.github.com/rest/issues/sub-issues#reprioritize-sub-issue",
  "status": "404"
}

This is when the sub-issues of 1 are 2,7,8,9 in that order.

So if the previous comment was accurate, then first of all the documentation would be a complete lie, and with the changes I've made in my environment the API endpoints should be working, but they're not.