Skip to content
GitmoapAPIBeta
Planissue-blueprints
POST/repositories/{repo_id}/issues/{issue_id}/apply-blueprint

Apply a custom type's facets to an existing work item

apply_blueprint
  • issue:update
    A token needs the issue:update scope: Update work items — status, fields, hierarchyGranted by mcp_agent_write, write_api, write_repository.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Quota · criteria per issue

    x-gitmoap-quota: {"kind":"enforced","arg":"criteria_per_issue"}

Adds the type's facets to the work item as acceptance criteria, after the ones it already has, and marks the work item as that type. Facets it already carries are left as they are, so applying the same type again adds nothing. The type must be one the repository offers: defined on the repository itself or on a group above it. Developers and above may do this, within the per-work-item and per-repository criteria limits.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
  • issue_idIssueId (integer · int64)Work-item iid

Request body

application/json
  • blueprintBlueprintRefThe custom type to apply: one defined on the work item's repository or on a group above it.
Request body exampleSynthesized example
{
"blueprint": {
"blueprint_id": "ce089782-cf38-41a4-822e-cd77a4509b8a",
"scope": {
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
}
}
}

Responses

200The work item's criteria after seeding the missing facetsapplication/json
  • created_atstring
  • criterion_idCriterionId (string · uuid)The criterion's identifier. It never changes, so rewording or re-binding a criterion keeps its identity and its evidence.
  • issue_uidIssueUid (string · uuid)
  • satisfiedboolean
  • stateCriterionStateunverifiedpassingfailingstalemanualA criterion's verdict.
  • textstringThe human statement — the criterion's title. The label, not the identity.
  • updated_atstring
  • bindingCriterionBinding or nulloptional
  • binding_exprstring or nulloptionalThe binding's @-expression, as written. Absent for a manual criterion.
  • binding_keystring or nulloptionalThe normalised form of binding_expr, which two equivalent spellings share. Absent for a manual criterion.
  • checkedbooleanoptionalWhether the box is ticked. Meaningful only for a manual criterion — a bound one is ticked by its state, and ticking it by hand is refused with a 409.
  • descriptionstring or nulloptionalAn optional longer description (markdown) — the per-criterion detail a flat checkbox could never hold.
  • evidenceEvidence or nulloptional
    • The Evidence schema
    • commit_shaCommitHash (string)
    • observed_atstringWhen the run that produced the evidence finished, RFC 3339.
    • pipeline_idPipelineId (string · uuid)
    • pipeline_run_idPipelineRunId (string · uuid)
    • node_run_idNodeRunId (string · uuid) or nulloptional
    • valuenumber · double or nulloptional
  • facet_categoryFacetCategory (string) or nulloptional
  • facet_keyFacetKey (string) or nulloptionalThe blueprint facet this criterion belongs to, when a blueprint added it. Absent for a criterion written directly. A facet's state is rolled up from the criteria carrying its key.
  • last_evidence_atstring or nulloptional
  • last_evidence_commit_shaCommitHash (string) or nulloptional
  • last_evidence_node_run_idNodeRunId (string · uuid) or nulloptional
  • last_evidence_pipeline_idPipelineId (string · uuid) or nulloptionalThe pipeline whose run last provided evidence for this criterion. Only a later run of the same pipeline can make the criterion stale.
  • last_evidence_run_idPipelineRunId (string · uuid) or nulloptional
  • last_evidence_valuenumber · double or nulloptionalThe observed value, for a Metric or Coverage binding.
  • ordinalinteger · int32optional0–∞Position in the description, so the list round-trips in authoring order.
  • required_for_closebooleanoptional@optional opts out. Everything else in a Definition of Done is required by definition.
200 exampleSynthesized example
[
{
"created_at": "2026-10-14T09:55:17Z",
"criterion_id": "78e71cbb-b9b5-4d93-8168-0c652ba1c4d0",
"issue_uid": "cc63f7a2-861c-4000-8f16-aff7250fc425",
"satisfied": false,
"state": "unverified",
"text": "text-8a10",
"updated_at": "2026-10-10T05:11:56Z"
},
{
"created_at": "2026-10-16T17:28:36Z",
"criterion_id": "cc262cc4-b986-4021-a975-526dd83b8986",
"issue_uid": "c7de645a-8764-48c5-962c-e28b2acead94",
"satisfied": false,
"state": "unverified",
"text": "text-8c65",
"updated_at": "2026-10-09T23:55:36Z"
}
]
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-0a3f",
"message": "Stream pipeline status into the run header"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-c50a",
"message": "Pin a page's payload to the build that rendered it"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-36e3",
"message": "Draw the region map from operation density"
}
}
404Work item not found, or no such blueprint on this repository or the groups above itapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-a40c",
"message": "Inline scalar newtypes but keep their brand"
}
}
409The request conflicts with the resource's current state; `reason` says howapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-ce61",
"message": "Draw the region map from operation density"
}
}
429Per-issue or per-repository criteria limit reachedapplication/json
Error codes
  • TOO_MANY_REQUESTSRetryableA quota, a rate limit or a transfer budget is spent. When the response carries Retry-After, retry after that many seconds
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
429 exampleSynthesized example
{
"error": {
"code": "code-a43f",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap issue-blueprints apply-blueprint

  • --repo-ididRepository ID (id or owner/repo path)
  • --issue-ididWork-item iid
  • --blueprintjsonThe custom type to apply: one defined on the work item's repository or on a group above it.

Used in these guides