Distillation

Date: Sep 9, 2026

• 🔴 (16:41) GitHub’s REST API endpoint for the authenticated user is GET /user; most endpoints use Authorization: Bearer <YOUR-TOKEN>, Accept: application/vnd.github+json, and X-GitHub-Api-Version: 2026-03-10.
• 🔴 (16:41) OAuth app tokens and personal access tokens (classic) require the read:user scope or broader user scope for GET /user to return the private-user response; otherwise it returns the public-user response while still authenticating as the token owner.
• 🔴 (16:41) GET /user documents HTTP statuses 200 OK, 304 Not modified, 401 Requires authentication, and 403 Forbidden.
• 🔴 (16:41) The GitHub user lookup endpoint is GET /users/USERNAME and provides publicly available information about a GitHub account.
• 🔴 (16:41) For a private GitHub profile, followers and following are 0 unless the request is authenticated as that user; authentication as that user returns the actual values even without OAuth scopes.
• 🔴 (16:41) Replace {/privacy} with /public in events_url to retrieve only public events. Omitting it retrieves public events and, when authenticated as that user, private events.
• 🔴 (16:41) Requests for an Enterprise Managed User, or a GitHub App bot installed in an organization using Enterprise Managed Users, must be authenticated as a user or GitHub App with organization access; unauthorized requests return 404 Not Found.
• 🔴 (16:41) The email field from the user endpoint contains only the publicly visible profile email and is null when no public email is configured; publicly visible email addresses are shown only to authenticated requests.