GitHub Actions: "Must have admin rights to Repository." when downloading logs
Despite the wording, you do not need admin rights. GitHub's API gives Actions logs only to a signed-in request. With no token it answers HTTP 403 with this message, even for a public repository whose logs anyone can open in the browser. A token that can read the repository is enough.
The whole answer
What api.github.com answered on October 24, 2026 for a job of a public repository, with no token:
curl -i 'https://api.github.com/repos/<owner>/<repo>/actions/jobs/<job_id>/logs'
HTTP 403
{
"message": "Must have admin rights to Repository.",
"documentation_url": "https://docs.github.com/rest/actions/workflow-jobs#download-job-logs-for-a-workflow-run",
"status": "403"
}
- The logs of the whole run (
/actions/runs/<run_id>/logs, a zip file) answered the same. - With a token of an account that has no admin rights on that repository (a classic token with the repo and workflow scopes), the same request got HTTP 302 to a download address, and following it gave the log.
What the token needs
GitHub's documentation for this endpoint (Download job logs for a workflow run): "Anyone with read access to the repository can use this endpoint." For a private repository, a classic personal access token or an OAuth token needs the repo scope.
# one job's log, as text curl -L -H 'Authorization: Bearer <token>' \ 'https://api.github.com/repos/<owner>/<repo>/actions/jobs/<job_id>/logs' # or with the GitHub CLI, signed in with gh auth login gh run view --log --job <job_id>
-L follows the 302. The download address it points to expires after one minute (GitHub's documentation), so fetch it right away instead of keeping it.
Without a token
The log of a public repository is still readable on github.com: open the run, then the job. Only the API asks for a token.
GitHub Actions logs in IntelliJ IDEA and other JetBrains IDEs
Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, shows the runs of all your repositories with their jobs, steps and logs in an IDE tool window. With a token it reads the logs for you; without one, it says that GitHub gives job logs only with a token, also for public repositories, with links to the token setting and to the log on GitHub. A read-only token is enough for everything free; re-running, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).
GitHub and GitHub Actions are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.
More: GitHub Actions plugins for IntelliJ IDEA compared · 日本語