Skip to content
GitmoapAPIBeta
Identity & platformbilling
POST/admin/limit-increase-requests/{request_id}/approve

Approve a limit-increase request and apply the override (platform admin)

approve_limit_increase_request
  • billing:admin
    A token needs the billing:admin scope: Review limit-increase requests and set namespace overridesGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

The new limit takes effect at once: the requested value, or approved_value when given, capped at the limit's hard ceiling. A request to raise how many top-level groups someone may create raises the requester's own limit. Only platform administrators, in a signed-in session, decide requests, and a request already decided cannot be decided again.

Parameters

Path
  • request_idLimitIncreaseRequestId (string · uuid)Request id

Request body

application/json
  • approved_valueinteger · int64 or nulloptional0–∞Value to apply; defaults to the request's requested_value. Clamped to the ceiling.
  • decision_notestring or nulloptional
Request body exampleSynthesized example
{}

Responses

200Approved and appliedapplication/json
  • created_atstring
  • current_effectiveinteger · int640–∞
  • justificationstring
  • limit_keyLimitKeystorage_bytesmax_repos_per_groupmax_members_per_scopemax_teams_per_orgmax_members_per_teammax_custom_roles_per_orgmax_limits_per_scopemax_approval_rules_per_scopemax_scim_tokens_per_orgmax_ai_agents_per_orgmax_ai_concurrent_sessions_per_orgmax_ai_sessions_per_org_per_daymax_ai_revision_drafts_per_org_per_daymax_balance_adjustments_per_namespace_per_daymax_agent_workspace_minutes_per_monthai_management_fee_bpsmax_open_mrs_per_repomax_comments_per_mrmax_branches_per_repomax_tags_per_repomax_webhooks_per_scopemax_service_accounts_per_scopemax_branch_rules_per_scopemax_provider_connections_per_scopemax_reviewers_per_mrmax_reactions_per_commentmax_commit_statuses_per_commitmax_provider_installs_per_groupmax_concurrent_pipeline_runsmax_pipeline_runs_per_monthmax_pipeline_minutes_per_monthmax_pipeline_dag_nodesmax_push_bytesmax_package_bytesmax_release_asset_bytesmax_node_log_bytesmax_releases_per_repomax_pipelines_per_repomax_open_issues_per_scopemax_labels_per_scopemax_milestones_per_scopemax_blueprints_per_scopemax_wiki_pages_per_scopemax_services_per_scopemax_environments_per_scopemax_scorecards_per_scopemax_pipeline_components_per_scopemax_versions_per_pipeline_componentmax_comments_per_issuemax_relations_per_issuemax_children_per_issuemax_activities_per_issuemax_code_links_per_issuemax_mr_links_per_issuemax_anchors_per_issuemax_anchors_per_repomax_criteria_per_issuemax_criteria_per_repomax_code_todos_per_repomax_root_groupsA recognised limit name — every PlanLimits cap plus the user-scoped max_root_groups. The identity a limit-increase request and a namespace override are keyed by.
  • request_idLimitIncreaseRequestId (string · uuid)
  • requested_byUserId (string · uuid)
  • requested_valueinteger · int640–∞
  • root_group_idGroupId (string · uuid)
  • statusLimitRequestStatuspendingapproveddeniedappliedLifecycle of a limit-increase request. Applied is the terminal success state (the override was written); Approved exists for symmetry but the approve path applies immediately, so a persisted request is never left Approved-but-not-Applied.
  • updated_atstring
  • applied_valueinteger · int64 or nulloptional0–∞
  • decided_atstring or nulloptional
  • decided_bystring or nulloptional
  • decision_notestring or nulloptional
200 exampleSynthesized example
{
"created_at": "2026-10-13T16:05:47Z",
"current_effective": 79,
"justification": "justification-0c3b",
"limit_key": "storage_bytes",
"request_id": "297d5584-2606-444d-acd5-01eb6fee3da7",
"requested_by": "c9d8e7f6-a5b4-4c3d-9e2f-1a0b9c8d7e6f",
"requested_value": 49,
"root_group_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"status": "pending",
"updated_at": "2026-10-14T03:42:39Z",
"applied_value": 32,
"decided_at": "2026-10-16T02:02:37Z",
"decided_by": "b7e2d1c0-9f8e-4d7c-a6b5-c4d3e2f1a0b9",
"decision_note": "decision-note-2bdb"
}
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-26f2",
"message": "Inline scalar newtypes but keep their brand"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-e595",
"message": "Draw the region map from operation density"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-f281",
"message": "Pin a page's payload to the build that rendered it"
}
}
404Not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-8dd7",
"message": "Stream pipeline status into the run header"
}
}
409Already decidedapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-622d",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap billing approve-limit-increase-request

  • --request-ididRequest id
  • --approved-valuenumberoptionalValue to apply; defaults to the request's `requested_value`. Clamped to the ceiling.
  • --decision-notestringoptional

Used in these guides