GitHub: Creating GitHub apps using the REST API will fail with a 401 error
Timeline of updates
- resolved
Between 16:26 UTC on September 15th and 18:30 UTC on September 16th, anonymous REST API calls to approximately 20 endpoints were incorrectly rejected because they were not authenticated. While this caused unauthenticated requests to be rejected by these endpoints, all authenticated requests were unaffected, and no protected endpoints were exposed. This resulted in 100% of requests to these endpoints failing at peak, representing less than 0.1% of GitHub’s overall request volume. On average, the error rate for these endpoints was less than 50% and peaked at 100% for about 26 hours over September 16th. API requests to the impacted endpoints were rejected with a 401 error code. This was due to a mismatch in authentication policies, for specific endpoints, during a system migration. The failure to detect the errors was the result of the issue occurring for a low percentage of traffic. We mitigated the incident by reverting the policy in question, and correcting the logic associated with the degraded endpoints. We are working to improve our test suite to further validate mismatches, and refining our monitors for proactive detection.
From GitHub’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on www.githubstatus.com (opens in new tab).
Cite this
Status incident (vendor impact label: minor) posted by GitHub, started 2025-09-16 17:14 UTC, resolved after 31 min, 1 update(s).
- Title
- Creating GitHub apps using the REST API will fail with a 401 error
- Vendor
- GitHub
- Date
- URL
- https://rewindex.com/company/github/incidents/3kjv06tdxxfn
GitHub profileRecent GitHub incidentsAll outages on September 16, 2025GitHub in September 2025MarkdownJSON