Как добавить пользователей в тот или иной репозиторий с помощью API

Судя по дальнейшим обсуждениям, фактическое требование состоит в том, чтобы разрешить пользователям доступ к одному репозиторию в проекте и запретить доступ к другим репозиториям в этом проекте. Для этого вы можете попробовать приведенный ниже пример сценария PowerShell, который запретит всем репозиториям разрешение на участие для группы [PrjectA]\Contributors и разрешит разрешение Repo1 Contribute для группы [PrjectA]\Contributors.

$organization = "YourADOOrgName"
$project = "ProjectA"
$groupName = "Contributors"
$allowRepo = "Repo1"

$MyPat = 'xxxxx'
$B64Pat = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes(":$MyPat"))
$headers = @{
    'Authorization' = 'Basic ' + $B64Pat
    'Content-Type' = 'application/json'
}

# Get projects GET https://dev.azure.com/{organization}/_apis/projects?api-version=7.1-preview.4
$projectsURL = "https://dev.azure.com/$organization/_apis/projects?api-version=7.1-preview.4"
$projects = Invoke-RestMethod -Uri $projectsURL -Method Get -Headers $headers
$projectA = $projects.value | Where-Object { $_.name -eq "$project" }
$projectAId = $projectA.id
Write-Host "The id of $project is $projectAId"

# Get repos GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories?api-version=7.1-preview.1
$reposURL = "https://dev.azure.com/$organization/$project/_apis/git/repositories?api-version=7.1-preview.1"
$repos = Invoke-RestMethod -Uri $reposURL -Method Get -Headers $headers
$repo = $repos.value | Where-Object { $_.name -eq "$allowRepo" }
$repoId = $repo.id
Write-Host "The id of $allowRepo is $repoId"

# Get group identity GET https://vssps.dev.azure.com/{organization}/_apis/identities?searchFilter=General&filterValue=Project Collection Valid Users&queryMembership=None&api-version=7.2-preview.1
$groupIdsURL = "https://vssps.dev.azure.com/$organization/_apis/identities?searchFilter=General&filterValue=[$project]\$groupName&queryMembership=None&api-version=7.2-preview.1"
$groupIds = Invoke-RestMethod -Uri $groupIdsURL -Method Get -Headers $headers
$groupId = $groupIds.value | Where-Object { $_.providerDisplayName -eq "[$project]\$groupName" }
$groupDescriptor = $groupId.descriptor
Write-Host "The descriptor for group [$project]\$groupName is $groupDescriptor"

# All security namespaces GET https://dev.azure.com/{organization}/_apis/securitynamespaces?api-version=7.2-preview.1
$namespacesURL = "https://dev.azure.com/$organization/_apis/securitynamespaces?api-version=7.2-preview.1"
$namespaces = Invoke-RestMethod -Uri $namespacesURL -Method Get -Headers $headers
$namespaces |  ConvertTo-Json -Depth 100 | Out-File "C:\Users\Alvin\Desktop\namespaces.json"
$namespaceGitRepos = $namespaces.value | Where-Object { $_.displayName -eq "Git Repositories" }
$namespaceIdGitReposContribute = $namespaceGitRepos.actions | Where-Object { $_.displayName -eq "Contribute" }
$namespaceIdGitReposContributeBit = $namespaceIdGitReposContribute.bit
$namespaceIdGitRepos = $namespaceGitRepos.namespaceId
Write-Host "The id for namespace Git Repositories is $namespaceIdGitRepos"
Write-Host "The bit for permission Contribute in namespace Git Repositories is $namespaceIdGitReposContributeBit"

# Access Control Entries - Set Access Control Entries POST https://dev.azure.com/{organization}/_apis/accesscontrolentries/{securityNamespaceId}?api-version=7.2-preview.1
$contributeACEURL = "https://dev.azure.com/$organization/_apis/accesscontrolentries/${namespaceIdGitRepos}?api-version=7.2-preview.1"

# Deny All repositories Contribute permission for [PrjectA]\Contributors group
$contributeDenyACEBody = @{
    "token" = "repoV2/$projectAId"
    "merge" = $true
    "accessControlEntries" = @(
        @{
            "descriptor" = "$groupDescriptor"
            "allow" = 0
            "deny" = $namespaceIdGitReposContributeBit
            "extendedInfo"= @{
                "effectiveAllow" = 0
                "effectiveDeny" = $namespaceIdGitReposContributeBit
                "inheritedAllow" = 0
                "inheritedDeny" = $namespaceIdGitReposContributeBit
            }
        }
    )
} | ConvertTo-Json -Depth 100
Invoke-RestMethod -Uri $contributeACEURL -Method Post -Headers $headers -Body $contributeDenyACEBody 

# Allow Repo1 Contribute permission for [PrjectA]\Contributors group
$contributeAllowACEBody = @{
    "token" = "repoV2/$projectAId/$repoId"
    "merge" = $true
    "accessControlEntries" = @(
        @{
            "descriptor" = "$groupDescriptor"
            "allow" = $namespaceIdGitReposContributeBit
            "deny" = 0
            "extendedInfo"= @{
                "effectiveAllow" = $namespaceIdGitReposContributeBit
                "effectiveDeny" = 0
                "inheritedAllow" = $namespaceIdGitReposContributeBit
                "inheritedDeny" = 0
            }
        }
    )
} | ConvertTo-Json -Depth 100
Invoke-RestMethod -Uri $contributeACEURL -Method Post -Headers $headers -Body $contributeAllowACEBody

После проверки работоспособности вы можете распространить другие разрешения, например «Чтение», и установить разрешения для другой группы пользователей, например «Читатели».