Azure DevOps Personal Access Token (PAT) Scopes(Permissions)
Updated
by
Kelly watts
To create a work item using an Azure DevOps API token (PAT), these are the permissions you need.
✅ Required Permissions for Creating a Work Item
1️⃣ Personal Access Token (PAT) Scopes
When generating the PAT, make sure you enable:
✔ Work Items – Read & Write
This is the minimum and mandatory scope to:
- Create work items
- Update work items
- Link work items
👉 If you only select Read, creation will fail.
2️⃣ Project-Level Permissions (User Access)
The user account that creates the PAT must have:
- Basic access (not Stakeholder-only for API creation)
- Added to the Azure DevOps Project
3️⃣ Security Permissions in the Project
Under Project Settings → Permissions, ensure the user has:
- Create work items → Allow
- Edit work items in this node → Allow
(Usually granted automatically to Contributors)
4️⃣ Area Path Permissions (Important!)
Work items are created under an Area Path.
Go to:
Project Settings → Boards → Area Paths
Ensure the user has:
- Create work items permission for that Area Path
🚨 This is a very common reason for 403 errors.
🔐 Recommended Minimal Setup (Best Practice)
For API-only usage:
- PAT Scope: Work Items – Read & Write
- Project Role: Contributor
- Area Path: Create permission allowe
🧪 Common Errors & Causes
Error | Cause |
401 Unauthorized | Invalid / expired PAT |
403 Forbidden | Missing Work Item or Area Path permission |
TF401232 | User doesn’t have access to project |
Work item type not supported | Wrong project or process |
