GitHub Gist

DEVELOPER · DEVELOPER

Gists, the files inside them, stars, and comments under that person’s own token.

Connecting GitHub Gist in practice

Gists sit behind their own OAuth scope, `gist`, separate from `repo`, so a token that can read every private repository still cannot list a user’s gists. The API also truncates rather than failing: a file over 1 MB comes back with truncated: true, and anything over 10 MB or past the 300th file has to be cloned from git_pull_url.

Scopes that draw scrutiny

gist Required to create gists or read a user’s gists. It is granted independently of repo access, and a token holding it can publish a public gist under that user’s name.

Worth knowing

Content is silently partial: files over 1 MB return with truncated: true and only part of the content, so an agent that reads the response body gets a plausible-looking half of a file.
Files over 10 MB are not retrievable through the API at all — the documented route is cloning the gist from the git_pull_url.
A gist with more than 300 files returns only the first 300 with a top-level truncated: true, which is a second, separate truncation to check for.
Pagination caps the reachable set: per_page maxes at 100 and the docs state you can fetch up to 3,000 gists, so a long-lived account’s history is not fully enumerable.

Checked against REST API for gists (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

gist_delete_gists_by_gist_idWRITE

Delete a gist via DELETE /gists/{gist_id}. Deletes the gist and every file and comment in it. GitHub gives a deleted gist no recycle bin and no undo, and answers 204 with an empty body -- absence is confirmed by asking for the gist again, not by reading this reply.

gist

gist_delete_gists_by_gist_id_comments_by_comment_idWRITE

Delete a gist comment via DELETE /gists/{gist_id}/comments/{comment_id}. Deletes one comment from a gist. No undo; GitHub answers 204 with an empty body, so absence is confirmed by listing the gist's comments again rather than by reading this reply.

gist

gist_delete_gists_by_gist_id_starWRITE

Unstar a gist via DELETE /gists/{gist_id}/star. Removes the connected account's star from a gist. NOT marked destructive although it is a DELETE: nothing is deleted and no content is lost, and 'Star a gist' on the same path restores it exactly.

gist

gist_get_gistsREAD

List your gists via GET /gists. The gists belonging to the account whose token this connection holds, newest first. READ THE WARNING: measured 2026-09-22, GitHub answers this exact route 200 with a page of 30 STRANGERS' public gists when no credential is attached, and its own reference says so ('When called without authentication, the endpoint returns all public gists'). A 200 here is therefore not evidence that the credential worked, and results that are not your own gists mean it did not attach -- this connector refuses the call rather than dialling without one, so that cannot happen through Agentic Fabriq. Use 'List public gists' when other people's gists are what you want.

gist

gist_get_gists_by_gist_idREAD

Get a gist via GET /gists/{gist_id}. One gist by id, with its files and their content. A public gist reads for any token; a secret one needs the token of an account that can see it. GitHub truncates large files in this payload and points at `raw_url` instead -- this integration exposes no raw-content tool, so a truncated file has to be fetched outside it.

gist

gist_get_gists_by_gist_id_by_shaREAD

Get a gist revision via GET /gists/{gist_id}/{sha}. One historical snapshot of a gist, by the revision sha that 'List gist commits' reports as `version`. The reply has the same shape as 'Get a gist' with that revision's files.

gist

gist_get_gists_by_gist_id_commentsREAD

List gist comments via GET /gists/{gist_id}/comments. The comments on one gist, oldest first.

gist

gist_get_gists_by_gist_id_comments_by_comment_idREAD

Get a gist comment via GET /gists/{gist_id}/comments/{comment_id}. One comment on a gist, by its numeric id.

gist

gist_get_gists_by_gist_id_commitsREAD

List gist commits via GET /gists/{gist_id}/commits. A gist's revision history, newest first: each entry carries the revision's `version` sha, its committer and its added/deleted line counts. Pass a `version` to 'Get a gist revision' to read that snapshot's files.

gist

gist_get_gists_by_gist_id_forksREAD

List gist forks via GET /gists/{gist_id}/forks. The gists forked from this one, newest first.

gist

gist_get_gists_by_gist_id_starREAD

Check if a gist is starred via GET /gists/{gist_id}/star. Whether the connected account has starred this gist. THE ANSWER IS NORMALISED HERE, because GitHub's is not a body: its reference documents 204 No Content when the gist IS starred and 404 Not Found when it is NOT, so left alone the negative answer would surface as an error and the tool could never say 'no'. This wrapper returns `{"starred": true}` for the 204 and `{"starred": false, "ambiguous": true, ...}` for the 404 -- ambiguous because GitHub answers the same 404 for a gist that does not exist or that this token cannot see, and those are not 'not starred'. Cited to GitHub's documented status codes, NOT measured: the route is per-user and answers 401 without a token, and no token exists for this integration yet.

gist

gist_get_gists_publicREAD

List public gists via GET /gists/public. Every public gist on GitHub, newest first -- OTHER PEOPLE'S, by design, and the name says so. Measured 2026-09-22: answers 200 with 30 results to no credential at all, so it reveals nothing about the connected account and proves nothing about the token.

gist

gist_get_gists_starredREAD

List starred gists via GET /gists/starred. The gists the connected account has starred, newest first. This is also the connection's health check: it is per-user and has NO anonymous form (measured 2026-09-22: 401 'Requires authentication' with no credential, 401 'Bad credentials' with a bogus one), which is why the probe uses it instead of 'List your gists'.

gist

gist_get_users_by_username_gistsREAD

List a user's gists via GET /users/{username}/gists. A named GitHub user's PUBLIC gists, newest first. Public data: it carries nothing the connected account owns, and the username is a caller's value rather than a credential.

gist

gist_patch_gists_by_gist_idWRITE

Update a gist via PATCH /gists/{gist_id}. Updates a gist's description and files. The file semantics are GitHub's and are easy to get wrong: each key in `files` must match the file's CURRENT filename, a `filename` value renames it, and a NULL value DELETES that file from the gist. So this write can destroy content even though it is not the delete tool.

gist

gist_patch_gists_by_gist_id_comments_by_comment_idWRITE

Update a gist comment via PATCH /gists/{gist_id}/comments/{comment_id}. Replaces a comment's text. Only the comment's author can update it; another account's token is refused by GitHub, not by this connector.

gist

gist_post_gistsWRITE

Create a gist via POST /gists. Creates a gist in the connected account. `files` is an object keyed by FILENAME, each value carrying `content`; `public` defaults to false, and GitHub's own reference warns that a secret gist is unlisted rather than private -- anyone with the URL can read it, so nothing confidential belongs in one. Requires the `gist` scope: GitHub documents that you must be signed in to create a gist.

gist

gist_post_gists_by_gist_id_commentsWRITE

Create a gist comment via POST /gists/{gist_id}/comments. Posts a comment on a gist as the connected account. `body` is required and GitHub caps it at 65,535 characters.

gist

gist_post_gists_by_gist_id_forksWRITE

Fork a gist via POST /gists/{gist_id}/forks. Copies someone else's gist into the connected account as a new gist. It creates something rather than changing the original, and the new gist's id is in the 201 body.

gist

gist_put_gists_by_gist_id_starWRITE

Star a gist via PUT /gists/{gist_id}/star. Stars a gist as the connected account. Idempotent; GitHub answers 204 with an empty body.

gist