title: Azure DevOps REST API returns a 403 when using the system OAuth token during a build
body: <p>I'm running a script:</p>
  
  <pre><code># Variables
  $organization = "****"
  $project = "****"
  $repositoryId = "****"
  $pullRequestId = $env:BUILD_PULLREQUEST_ID
  
  $pat = "Bearer $env:System_AccessToken"
  $featureReleaseUrl = "http://" + $env:prSourceBranchName + ".azurewebsites.net"
  
  $body = @"
      {
          "comments": [
              {
                  "content": "Link naar feature release $featureReleaseUrl"
              }
          ]
      }
  "@ 
  
  $createThreadInPRUrl = "https://dev.azure.com/$organization/$project/_apis/git/repositories/$repositoryId/pullRequests/$pullRequestId/threads?api-version=5.0"
  if ($pullRequestId) {
      Invoke-RestMethod -Uri $createThreadInPRUrl -Headers @{Authorization = $pat} -Body $body -Method Post -ContentType 'application/json'
  }
  </code></pre>
  
  <p>When it runs it returns a:</p>
  
  <blockquote>
  <pre><code>##[error]The remote server returned an error: (403) Forbidden.
  </code></pre>
  </blockquote>
  
  <p>I've created a <code>Personal Access Tokens</code> in my personal settings. </p>
  
  <p>I've also created this script:</p>
  
  <pre><code># Variables
  $organization = "****"
  $project = "****"
  $buildId = $****
  
  $pat = "Bearer $env:System_AccessToken"
  
  if (!$env:Build_PullRequest_SourceBranchName) {
      $retrieveSourceBranchFromBuildURL = "https://dev.azure.com/$organization/$project/_apis/build/builds/$buildId" + "?api-version=5.0"
      $buildInformation = Invoke-RestMethod -Uri $retrieveSourceBranchFromBuildURL -Headers @{Authorization = $pat } -Method Get -ContentType 'application/json'
      $SourceBranchFromBuild = $buildInformation.sourceBranch.split('/')[-1]
  
      Write-Host "### no Build PullRequest SourceBranchName available ###"
      Write-Host "##vso[task.setvariable variable=prSourceBranchName;]"$SourceBranchFromBuild
  
  
  }
  </code></pre>
  
  <p>And this runs fine. The difference between the first and second script is that the first is a POST and the second a GET. But they both use the $pat token.</p>