GitHub · Pull requests · REST and GraphQL API · Checked October 25, 2026

GitHub: why the checks do not show

GitHub keeps two kinds of checks on a commit. Commit statuses, set by services that call the statuses API, are read with GET /repos/OWNER/REPO/commits/REF/status, which gives "a combined view of commit statuses" and answers 200 or 404. Check runs, which only GitHub Apps can create and in which GitHub Actions reports its jobs (GitHub's documentation gives some check run states to GitHub Actions alone), are read with GET /repos/OWNER/REPO/commits/REF/check-runs. A tool that reads only one of them shows only that kind (checked October 25, 2026).

HTTP/1.1 403 Forbidden

{"message": "Resource not accessible by personal access token", "documentation_url": "https://docs.github.com/rest/checks/runs#list-check-runs-for-a-git-reference", "status": "403"}

A fine-grained token and check runs

No Checks permission to give: the check runs page says a fine-grained token needs the Checks repository permission (read), but GitHub's list of permissions for fine-grained personal access tokens has no Checks section. Public reports say the Checks permission exists only for GitHub Apps.
Resource not accessible by personal access token (403): public reports met it with fine-grained tokens on commits/SHA/check-runs, commits/SHA/check-suites and check run annotations, and on GraphQL's statusCheckRollup contexts; one of them lists what it tried on a private repository in an organization. One report lists a token with Contents, Pull requests, Commit statuses and Actions read that still got 403 for check runs.
What still reads: the same reports read commit statuses (commits/SHA/statuses, which GitHub's list gives to Commit statuses read, as it does the combined status), and GitHub Actions runs with GET /repos/OWNER/REPO/actions/runs?head_sha=SHA, which GitHub's list gives to Actions read.
Public repositories: the check runs page says the endpoint can be used without authentication or the permission if only public resources are requested.
A classic token needs the repo scope for check runs on a private repository, the check runs page says.

Other reasons

404: the repository is not there for this token, which is also how GitHub answers a private repository the token cannot see; the combined status lists 404 as its only refusal.
The combined status covers commit statuses only: GitHub's documentation says its state is pending when there are no statuses, whatever the check runs say.
More than 1,000 check suites on one commit: the check runs page says only the 1,000 most recent suites are used.
Deleted after the retention period: since October 1, 2026, checks and commit statuses older than the repository's retention period, 90 days by default, are permanently deleted (see the retention period for checks).

What to do

See every check on a private repository: use a classic token with the repo scope, or a GitHub App with Checks read.
Keep the fine-grained token: give it Actions read and read the workflow runs for the head commit, plus Commit statuses read for the statuses; or open the pull request's checks on GitHub.
A merge refused for checks: see why GitHub refused the merge.

In IntelliJ IDEA: both kinds of checks, from the last commit, in one request

How the GitHub support built into IntelliJ IDEA reads the checks of a pull request, in its source (checked October 31, 2026; IntelliJ IDEA: findPullRequestMergeability.graphql, pullRequestMergeability.graphql, commitWithCheckStatuses.graphql, checkSuite.graphql, GHPRDetailsServiceImpl.kt, GHPRMergeabilityStateBuilder.kt, GHPRStatusViewModel.kt):

Both kinds together: one GraphQL request for the pull request asks for its last commit's commit statuses (status, contexts) and its check runs through the commit's check suites (checkSuites, checkRuns). The commit statuses and then the check runs go into one list. Checks on the earlier commits of the pull request are not read.
How many: the request asks for the first 100 check suites and the first 100 check runs in each, and the list is built from that one answer, so check runs past those are not in it.
When the request fails, the source writes the error to the IDE's log, and the status panel takes no checks from that load.
How the line reads them ("All required checks have passed" and the others, and when the line is not shown): see a required check stays "Expected".

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, reads both kinds for the pull request's head commit, commit statuses and check runs, and lists each with a link to its details next to the merge checks. When GitHub refuses the check runs, as it does for a fine-grained token on a private repository, it shows the GitHub Actions workflow runs in their place if the token has Actions read access; without that, it says the check runs were not shown and does not call the commit statuses alone "the checks passed". A classic token with the repo scope shows the check runs themselves. The review inbox, diffs, merge checks and checks are free; approving, commenting and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.