What permissions are required to perform Azure DevOps API calls for leases of builds

Question

So I am trying to figure out a way I can remove leases on specific builds via the AzureDevOps API. I have a PAT with read/execute permissions on Builds and read/write permissions on test management. I've also tried various other permissions without anything working. Below is the script I am trying to use.

$token = "{PAT}"
$url="https://{instance}/{collection}/{project}/_apis/build/retention/leases/{lease Id}?api-version=6.0-preview.1"
$token = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(":$($token)"))

$response = Invoke-RestMethod -Uri $url -Headers @{Authorization = "Basic $token"} -Method Get -ContentType application/json

When I try to get or delete builds this works fine (with a different URL of course). But when I try to get a lease I always get a 401 error. I've looked all over the API documentation but I can't find anywhere it says specifically what permissions the PAT needs to gain access. What specific permissions are required for the leases? Or do I just need to go about formatting my header in a different way?

Thanks for any help, please let me know if I can provide any additional information.

Answer 1

Check this doc Leases - Delete:

DELETE https://dev.azure.com/{organization}/{project}/_apis/build/retention/leases?ids={ids}&api-version=6.1-preview.1

PAT scope is: vso.build_execute

By the way, I try to switch the doc version to Azure DevOps Server 2019, but I get the message: The requested page is not available for Azure DevOps Server 2019

You could try to catch the API via F12 and then check it in the NetWork tab.

Update1

Thanks for Andrew sharing.

We could vote or follow this ticket to get the latest news.

Update2

If we create PAT token with full access, we could get and delete leases, check the pic below

GET

DELETE