Distillation

🔴 (13:17) User directed that the events_url URI template’s {/privacy} component be replaced with /public to retrieve only public events; omitting it retrieves public events and, when authenticated as that user, private events.

🔴 (13:17) GitHub REST API requests generally use Authorization: Bearer <YOUR-TOKEN>, Accept: application/vnd.github+json, and X-GitHub-Api-Version: 2026-03-10; the documentation’s curl examples omit these standard headers.

🔴 (13:17) GET /user documents HTTP statuses 200 OK, 304 Not modified, 401 Requires authentication, and 403 Forbidden.

🔴 (13:17) PATCH /user updates the authenticated user and accepts body fields name, email, blog, twitter_username (string or null), company, location, hireable (boolean), and bio.

🔴 (13:17) For PATCH /user, sending an email while the user’s email is private does not override privacy settings; the address remains hidden from the public profile and API.

🔴 (13:17) PATCH /user documents HTTP statuses 200 OK, 304 Not modified, 401 Requires authentication, 403 Forbidden, 404 Resource not found, and 422 Validation failed or endpoint spammed.

🔴 (13:17) The PATCH /user example updates "blog": "https://github.com/blog" and "name": "monalisa octocat".

🔴 (13:17) Requests for an Enterprise Managed User, or a GitHub App bot installed in an organization using Enterprise Managed Users, must authenticate as a user or GitHub App with organization access; unauthorized requests return 404 Not Found.

🔴 (13:17) The email returned by user-information endpoints is the publicly visible primary email from the GitHub profile, is null when no public email is configured, and is visible only in authenticated GitHub requests.

🔴 (13:17) GET /users lists personal user accounts and organization accounts in GitHub signup order.

🔴 (13:17) GET /users pagination is powered exclusively by the since parameter, with the Link header supplying the next-page URL; since returns users whose ID is greater than the supplied integer ID.

🔴 (13:17) GET /users supports integer per_page, default 30 and maximum 100, and documents HTTP statuses 200 OK and 304 Not modified.

🔴 (13:17) For GET /users/{username}, a private-profile user’s followers and following values are 0 unless the request is authenticated as that user; self-authenticated requests return actual values even when the token has no OAuth scopes.

🔴 (13:17) GET /users/{username}/hovercard provides information relating a user to pull requests, issues, repositories, and organizations; OAuth app tokens and classic personal access tokens require the repo scope.

🔴 (13:17) The hovercard endpoint’s optional subject_type can be organization, repository, issue, or pull_request; subject_type and string subject_id are mutually dependent, with each required when the other is used.

🔴 (13:17) GET /users/{username}/hovercard documents HTTP statuses 200 OK, 404 Resource not found, and 422 Validation failed or endpoint spammed.