Azure DevOps Python API获取PR的最小权限Scope咨询

通过Azure DevOps Python API拉取Pull Requests（PR）时，现有代码使用/.default权限范围可正常运行，但仅需只读调用，不想使用该范围。更换其他Scope时，creds.get_token报错：

InteractiveBrowserCredential.get_token failed: Authentication failed: AADSTS65002: Consent between first party application 'xxxxx' and first party resource 'xxxxx' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API

想咨询获取Pull Requests所需的最小权限Scope是什么，现有代码如下：

creds = InteractiveBrowserCredential()

# I'd rather not use .default here
auth = BasicTokenAuthentication({'access_token': creds.get_token('499b84ac-1321-427f-aa17-267ca6975798/.default').token})

conn = Connection(base_url='https://dev.azure.com/xxx/', creds=auth)
client = conn.clients.get_git_client()
result = client.get_pull_requests("xxxx")

print(result)

最小权限Scope #

获取Pull Requests只读访问的最小权限Scope是：499b84ac-1321-427f-aa17-267ca6975798/Git.Read，该Scope仅授予Git资源的只读权限，完全满足拉取PR的需求。

解决AADSTS65002报错的两种方案 #

方案1：使用Personal Access Token (PAT)（推荐） #

生成PAT时仅勾选Code (read)权限，这种方式无需处理AAD预授权问题，代码修改如下：

from azure.devops.connection import Connection
from msrest.authentication import BasicAuthentication

# 替换为你的PAT和组织URL
pat = '你的个人访问令牌'
organization_url = 'https://dev.azure.com/xxx/'

creds = BasicAuthentication('', pat)
conn = Connection(base_url=organization_url, creds=creds)
client = conn.clients.get_git_client()
result = client.get_pull_requests("xxxx")

print(result)

方案2：配置AAD应用预授权（若坚持用AAD认证） #

需要联系Azure AD管理员或Azure DevOps组织管理员，为你的AAD应用预授权Git.Read权限。配置完成后，修改代码使用指定Scope：

creds = InteractiveBrowserCredential()
# 使用Git.Read权限范围
auth = BasicTokenAuthentication({'access_token': creds.get_token('499b84ac-1321-427f-aa17-267ca6975798/Git.Read').token})

conn = Connection(base_url='https://dev.azure.com/xxx/', creds=auth)
client = conn.clients.get_git_client()
result = client.get_pull_requests("xxxx")

print(result)

内容的提问来源于stack exchange，提问作者kevinpeterson