Skip to content
GitmoapAPIBeta
Shipcatalog
POST/groups/{group_id}/catalog/environments

Declare an environment on a group

create_group_environment
  • catalog:manage
    A token needs the catalog:manage scope: Declare, edit and delete catalog servicesGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Quota · environments per scope

    x-gitmoap-quota: {"kind":"enforced","arg":"environments_per_scope"}

Declares an environment, a place services deploy to, that every repository beneath the group can deploy to unless it declares its own environment with the same slug. Maintainers and above may declare one; a production-tier environment needs an Owner. Unless you set its protection, a production environment requires an approval from the group's direct members before each deploy and accepts deploys from main only.

Parameters

Path
  • group_idGroupId (string · uuid)The owning group's id

Request body

application/json
  • slugEnvironmentSlug (string)
  • concurrencyConcurrencyPolicy or nulloptional
    • The ConcurrencyPolicy schema
    • exclusivebooleanoptionaldefault falseWhether deploys to this environment run one at a time. Off by default.
    • max_lock_wait_secondsinteger · int32optional0–∞default 0How long a queued deploy waits for its turn before failing, in seconds: from 60 (shorter values are rounded up) to 21600. 0, the default, means it waits for as long as the pipeline's timeout allows.
    • modeConcurrencyModequeueskipcancel_previousoptionalWhat happens when a run wants to deploy while another run holds the lock: queue (the default) waits its turn, skip skips the step, and cancel_previous cancels the other run. cancel_previous is available on environments only, not on a step's resource group.
  • display_namestring or nulloptional
  • protectionEnvironmentProtection or nulloptionalThe environment's protection. When absent, a production environment requires one approval from the people given access on the owning group and deploys only from the default branch; other tiers are left unprotected.
    • The EnvironmentProtection schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsoptionalWhich kinds of approval count. A deployment approved by a bot is rarely what anyone meant, so the default is people, signed in.
    • allowed_refsarray of stringoptionalGlobs the ref a run was started from must match for it to deploy here, in the same pattern language as branch rules. Empty allows any ref.
    • allowed_scopesarray of ScopeRef or nulloptionalThe only groups and repositories allowed to deploy to this environment. Absent means the group or repository that owns it and everything beneath it.
    • approversarray of ApproverRefoptionalWho may approve: people, teams, or a role at a group or repository. Authority to approve a deployment comes from being named here, never from a role alone.
    • prevent_self_approvalbooleanoptionaldefault falseWhether the person who started the run is barred from approving its deployment. What counts is who started the run, not who wrote the commit: deploying somebody else's commit is still your deploy.
    • requiredinteger · int32optional0–∞default 1Distinct approvals needed before the deployment starts, 1–10.
    • requires_approvalbooleanoptionaldefault falseWhen set, a deployment to this environment waits for approval before it starts. Nothing runs and no credentials are issued while it waits.
    • wait_timer_secondsinteger · int32optional0–∞default 0How long a deployment waits before it may start, in seconds, up to one hour. 0 means no wait.
  • tierEnvironmentTierdevelopmenttestingstagingproductionoptionalWhat kind of environment this is, whatever it is called: development, testing, staging or production. A production environment is protected by default.
  • urlstring or nulloptional
Request body exampleSynthesized example
{
"slug": "slug-f0d0"
}

Responses

201The environment was declaredapplication/json
  • approval_enforcedbooleanWhether the platform enforces protection.requires_approval on deploys, so a client can tell a policy that is applied from one that is only recorded.
  • archivedbooleanWhether the environment is archived. An archived environment can no longer be deployed to but keeps its deployment history, and archiving can be undone. An environment with deployments cannot be deleted, only archived.
  • concurrencyConcurrencyPolicy
    • The ConcurrencyPolicy schema
    • exclusivebooleanoptionaldefault falseWhether deploys to this environment run one at a time. Off by default.
    • max_lock_wait_secondsinteger · int32optional0–∞default 0How long a queued deploy waits for its turn before failing, in seconds: from 60 (shorter values are rounded up) to 21600. 0, the default, means it waits for as long as the pipeline's timeout allows.
    • modeConcurrencyModequeueskipcancel_previousoptionalWhat happens when a run wants to deploy while another run holds the lock: queue (the default) waits its turn, skip skips the step, and cancel_previous cancels the other run. cancel_previous is available on environments only, not on a step's resource group.
  • created_atstring
  • environment_idEnvironmentId (string · uuid)
  • owner_full_pathstringThe full path of the group or repository that owns the environment (e.g. acme/platform), which shows when an environment in a repository's listing comes from a group above it. With the slug it forms the environment's OIDC claim, {owner_full_path}:{slug}.
  • protectionEnvironmentProtection
    • The EnvironmentProtection schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsoptionalWhich kinds of approval count. A deployment approved by a bot is rarely what anyone meant, so the default is people, signed in.
    • allowed_refsarray of stringoptionalGlobs the ref a run was started from must match for it to deploy here, in the same pattern language as branch rules. Empty allows any ref.
    • allowed_scopesarray of ScopeRef or nulloptionalThe only groups and repositories allowed to deploy to this environment. Absent means the group or repository that owns it and everything beneath it.
    • approversarray of ApproverRefoptionalWho may approve: people, teams, or a role at a group or repository. Authority to approve a deployment comes from being named here, never from a role alone.
    • prevent_self_approvalbooleanoptionaldefault falseWhether the person who started the run is barred from approving its deployment. What counts is who started the run, not who wrote the commit: deploying somebody else's commit is still your deploy.
    • requiredinteger · int32optional0–∞default 1Distinct approvals needed before the deployment starts, 1–10.
    • requires_approvalbooleanoptionaldefault falseWhen set, a deployment to this environment waits for approval before it starts. Nothing runs and no credentials are issued while it waits.
    • wait_timer_secondsinteger · int32optional0–∞default 0How long a deployment waits before it may start, in seconds, up to one hour. 0 means no wait.
  • scopeScopeRefThe group or repository that owns the environment. Groups and repositories beneath it can use it too.
  • slugEnvironmentSlug (string)
  • tierEnvironmentTierdevelopmenttestingstagingproductionWhat kind of environment this is, whatever it is called: development, testing, staging or production. A production environment is protected by default.
  • updated_atstring
  • variable_countinteger · int32How many variables the environment holds.
  • versioninteger · int64Increases with every change. Send it with an update to have the update refused with 409 if someone else changed the environment first.
  • created_byActorSummary or nulloptional
  • display_namestring or nulloptional
  • urlstring or nulloptional
201 exampleSynthesized example
{
"approval_enforced": false,
"archived": false,
"concurrency": {
"exclusive": false,
"max_lock_wait_seconds": 0,
"mode": "queue"
},
"created_at": "2026-10-13T13:57:40Z",
"environment_id": "a478db14-3e26-447a-834a-9920722e137e",
"owner_full_path": "owner-full-path-95dd",
"protection": {
"accept_from": "people_signed_in",
"allowed_refs": [
"allowed-refs-a357"
],
"allowed_scopes": [
{
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
}
],
"approvers": [
{
"anyone": {}
},
{
"anyone": {}
}
],
"prevent_self_approval": false,
"required": 1,
"requires_approval": false,
"wait_timer_seconds": 0
},
"scope": {
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
},
"slug": "slug-1c42",
"tier": "development",
"updated_at": "2026-10-14T14:39:00Z",
"variable_count": 4,
"version": 57,
"created_by": {
"email": "lin@acme.example",
"id": "id-4648",
"username": "lin",
"avatar_url": "https://gitmoap.example/acme/293460d1"
},
"display_name": "Mara Okafor",
"url": "https://gitmoap.example/acme/9e99bf2f"
}
400Validation error, or a gate with no approver groupsapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-e9bb",
"message": "Inline scalar newtypes but keep their brand"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-2fb5",
"message": "Stream pipeline status into the run header"
}
}
403Insufficient standing, or Maintainer attempting a production-tier environmentapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-5019",
"message": "Inline scalar newtypes but keep their brand"
}
}
404No such group, or it is not visible to the callerapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-5792",
"message": "Label every synthesized example"
}
}
409The slug is already taken on this scopeapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-60ef",
"message": "Inline scalar newtypes but keep their brand"
}
}
429The scope is at its environment limitapplication/json
Error codes
  • TOO_MANY_REQUESTSRetryableA quota, a rate limit or a transfer budget is spent. When the response carries Retry-After, retry after that many seconds
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
429 exampleSynthesized example
{
"error": {
"code": "code-0154",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap catalog create-group-environment

  • --group-ididThe owning group's id (id or group path)
  • --concurrencyjsonoptional
  • --display-namestringoptional
  • --protectionjsonoptional
  • --slugstring
  • --tierdevelopment | testing | staging | productionoptional
  • --urlstringoptional

Used in these guides