Multiple installations from /user/installations

[mdbenjam]

Hi all,

I have a question regarding the /user/installations/ endpoint. When I hit that endpoint on behalf of a user that has installed my GitHub app, I sometimes get more than one result. In some cases the results I receive have different users in the account field. It looks something like this:

{
  "total_count": 2,
  "installations": [
    {
      "id": 1,
      "account": {
        "login": "User 1"
        .....
      }
    },
    {
      "id": 2,
      "account": {
        "login": "User 2"
        .....
      }
    }
  ]
}

What account setup could lead to this? I could understand receiving multiple installations for the user, and organizations they're a part of. Or multiple installations for different apps they have installed. But in what cases would one users' token return multiple installations for the same app but different users?

[jsoref]

I have some guesses, but for the time being, I've filed https://github.com/github/docs/issues/19447

It'd be really helpful if you provided a few more fields from your output.

[mdbenjam]

I've changed all the ids in this request to avoid leaking data, but besides that, this is the full request:

[
  {
    "id": 12345,
    "app_id": 9874,
    "target_id": 827230,
    "account": {
      "login": "user1",
      "id": 827230,
      "node_id": "MDQ6VXNlcjgyNzIzMA==",
      "avatar_url": "https://avatars.githubusercontent.com/u/827230?v=4",
      "html_url": "https://github.com/user1",
      "gravatar_id": "",
      "type": "User",
      "site_admin": false,
      "url": "https://api.github.com/users/user1",
      "events_url": "https://api.github.com/users/user1/events{/privacy}",
      "following_url": "https://api.github.com/users/user1/following{/other_user}",
      "followers_url": "https://api.github.com/users/user1/followers",
      "gists_url": "https://api.github.com/users/user1/gists{/gist_id}",
      "organizations_url": "https://api.github.com/users/user1/orgs",
      "received_events_url": "https://api.github.com/users/user1/received_events",
      "repos_url": "https://api.github.com/users/user1/repos",
      "starred_url": "https://api.github.com/users/user1/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/user1/subscriptions"
    },
    "access_tokens_url": "https://api.github.com/app/installations/12345/access_tokens",
    "repositories_url": "https://api.github.com/installation/repositories",
    "html_url": "https://github.com/settings/installations/12345",
    "target_type": "User",
    "repository_selection": "all",
    "events": [
      "check_run",
      "check_suite",
      "commit_comment",
      "create",
      "delete",
      "deployment",
      "deployment_review",
      "deployment_status",
      "deploy_key",
      "fork",
      "gollum",
      "issues",
      "issue_comment",
      "label",
      "member",
      "membership",
      "milestone",
      "organization",
      "public",
      "pull_request",
      "pull_request_review",
      "pull_request_review_comment",
      "push",
      "release",
      "repository",
      "repository_dispatch",
      "star",
      "status",
      "team",
      "team_add",
      "watch",
      "workflow_dispatch",
      "workflow_run"
    ],
    "permissions": {
      "administration": "read",
      "checks": "write",
      "contents": "read",
      "deployments": "write",
      "issues": "write",
      "metadata": "read",
      "pull_requests": "write",
      "repository_hooks": "write",
      "statuses": "write",
      "vulnerability_alerts": "read"
    },
    "created_at": "2021-05-14T07:34:35+05:30",
    "updated_at": "2021-05-15T15:07:22+05:30"
  },
  {
    "id": 67890,
    "app_id": 9874,
    "target_id": 7129127,
    "account": {
      "login": "user2",
      "id": 7129127,
      "node_id": "MDQ6VXNlcjcxMjkxMjc=",
      "avatar_url": "https://avatars.githubusercontent.com/u/7129127?v=4",
      "html_url": "https://github.com/user2",
      "gravatar_id": "",
      "type": "User",
      "site_admin": false,
      "url": "https://api.github.com/users/user2",
      "events_url": "https://api.github.com/users/user2/events{/privacy}",
      "following_url": "https://api.github.com/users/user2/following{/other_user}",
      "followers_url": "https://api.github.com/users/user2/followers",
      "gists_url": "https://api.github.com/users/user2/gists{/gist_id}",
      "organizations_url": "https://api.github.com/users/user2/orgs",
      "received_events_url": "https://api.github.com/users/user2/received_events",
      "repos_url": "https://api.github.com/users/user2/repos",
      "starred_url": "https://api.github.com/users/user2/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/user2/subscriptions"
    },
    "access_tokens_url": "https://api.github.com/app/installations/67890/access_tokens",
    "repositories_url": "https://api.github.com/installation/repositories",
    "html_url": "https://github.com/settings/installations/67890",
    "target_type": "User",
    "repository_selection": "all",
    "events": [
      "check_run",
      "check_suite",
      "commit_comment",
      "create",
      "delete",
      "deployment",
      "deployment_review",
      "deployment_status",
      "deploy_key",
      "fork",
      "gollum",
      "issues",
      "issue_comment",
      "label",
      "member",
      "membership",
      "milestone",
      "organization",
      "public",
      "pull_request",
      "pull_request_review",
      "pull_request_review_comment",
      "push",
      "release",
      "repository",
      "repository_dispatch",
      "star",
      "status",
      "team",
      "team_add",
      "watch",
      "workflow_dispatch",
      "workflow_run"
    ],
    "permissions": {
      "administration": "read",
      "checks": "write",
      "contents": "read",
      "deployments": "write",
      "issues": "write",
      "metadata": "read",
      "pull_requests": "write",
      "repository_hooks": "write",
      "statuses": "write",
      "vulnerability_alerts": "read"
    },
    "created_at": "2021-03-16T13:01:08+05:30",
    "updated_at": "2021-03-16T13:01:08+05:30"
  }
]

Thanks so much for taking a look!

[jsoref]

That's what I was hoping to see...

I'd encourage you to visit:
"html_url": "https://github.com/settings/installations/12345",
"html_url": "https://github.com/settings/installations/67890",

Ideally you should be able to understand what's going on by looking at them.

If you could provide examples of them here, that'd help clarify things for everyone else.

[mdbenjam]

Unfortunately, since these accounts are for users of our app we don't have access to either of them. I know that one of the ids corresponds to the user on whose behalf we were making the request to GitHub. The other id is for a different user that I believe is part of the same organization as the first, but it's not clear to me why they are coming up in this request.

[jsoref]

My guess is that there are multiple repositories in the org, and one user installed the app to one repo and a different user installed the app to a second repo. Then one of these users authorized the app for their user to talk to each of the two repos on their behalf.

Sadly, I can't actually speak from experience. When we've made apps, we've done them on an app-per-repo basis and thus none of them would have this stuff. And when I make apps, I use the github-actions application to shield me from this overhead. I keep looking into the effort required (including the requirement to host my own service and datastore) and keep deciding I don't want to do it.

I'd love to know if my guess is correct...

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬