Auth issue resulting in API impacts, including some Slack and Teams channel subscriptions
This summary is created by Generative AI and may differ from the actual content.
Overview
On June 5 2026, from 15:35 UTC to 16:45 UTC, an authentication issue caused 0.11 % of authenticated GitHub REST API requests to return “not found” errors. The problem was limited to requests using user‑to‑server tokens for organization‑owned repositories and led to the removal of Slack and Microsoft Teams channel subscriptions for a subset of customers. The incident was traced to a recent change in an internal authorization component that mis‑resolved access rights. The feature flag governing this change was disabled at 16:45 UTC, after which API behavior returned to normal and the affected channel subscriptions were restored by 22:21 UTC.
Impact
• 0.11 % of authenticated REST API requests returned “not found” responses. • A 1‑2 % increase in 4xx errors on endpoints such as /repos/{owner}/{repo}, /repos/{owner}/{repo}/pulls/{pull_number}, and /repos/{owner}/{repo}/contents/{path}. • Approximately 12 % of organizations with active Slack or Teams channel subscriptions were impacted, resulting in the deletion of about 2 % of all channel subscriptions. • The majority of requests succeeded; customers could retry after the incident and receive successful responses.
Trigger
A recently enabled feature flag in an internal authorization component failed to correctly resolve access for user‑to‑server tokens against organization‑owned repositories, causing the erroneous “not found” responses.
Detection
Monitoring systems observed an elevated rate of 4xx responses on several repository‑related endpoints, and on‑call engineers received reports of authorization failures and missing channel subscriptions. The spike in error metrics triggered investigation of the recent feature‑flag change.
Resolution
At 16:45 UTC the offending feature flag was disabled, restoring normal API responses. Subsequent remediation included restoring the deleted Slack and Teams channel subscriptions (completed by 22:21 UTC) and adding retry and grace‑period logic to the chat integrations to prevent transient errors from causing subscription deletions. Additional work is underway to improve observability and to gate future authorization changes with scoped rollouts.
Root Cause
A bug in the internal authorization component, introduced by a feature‑flagged change, caused incorrect resolution of user‑to‑server tokens for organization‑owned repositories, leading to spurious “not found” errors and downstream subscription deletions.