Each webhook topic requires the same oAuth scopes as if you were calling the topic as a API call directly. But I’ll throw it in the github docs issues