Can't create PRs to other repos with fine grained GithubApp user access token

[Leonidas-from-XIV]

Select Topic Area

Question

Body

Hi,

I've created a GitHub app so I can use the device flow to create a user auth token. The app has the Pull Requests: read & write permission enabled, is installed to my account and can access to all my repos. I successfully managed to create PRs against my own repo.

But when I attempt to create a PR of a branch from my repo (I'm $owner) to the repo my repo was forked like this:

curl -L \
  -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer ${token}" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  "https://api.github.com/repos/${target_owner}/${target_repo}/pulls" \
  -d "{ \"title\" : \"${pr_title}\", \"body\" : \"${pr_body}\", \"head\": \"${owner}:${branch_name}\", \"head_repo\": \"${owner}/${repo}\", \"base\" : \"${pr_base}\" }")

I get an error message:

{ "message": "Resource not accessible by integration", "documentation_url": "https://docs.github.com/rest/pulls/pulls#create-a-pull-request", "status": "403" }

The $target_owner is another user and if I just use the web UI then it works just fine. If I look at the HTTP headers, I see that it seems to want the pull_requests=write permission which I have. The token is still valid and the rate limits have not been hit.

< x-accepted-github-permissions: pull_requests=write

So my question is what am I doing wrong? Does the app need to be installed into the repo of the other user? That makes it difficult to automate if I can only create PRs to repos which have my GH app installed.