Skip to content
GitmoapAPIBeta
Reviewapproval-rules
GET/groups/{group_id}/approval-policy

The approval policy and rules in force on a group.

get_group_approval_policy
  • approval_rule:read
    A token needs the approval_rule:read scope: See the approval rules and policy of a group or repositoryGranted by read_api, write_api.Every operation this scope unlocks

Returns who may approve their own work and whether approvals survive a push, as they apply here; the group's own policy if it sets one; the approval rules that apply; and the rules the group defines itself. Anyone who can see the group may read it.

Parameters

Path
  • group_idGroupId (string · uuid)Group ID

Responses

200The switches in force, this group's own policy, and the rules that apply hereapplication/json
  • effectiveApprovalSwitchesThe switches that apply here: the nearest policy, tightened by every enforced one above it.
    • The ApprovalSwitches schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
  • rulesarray of ApprovalRuleThe rules that apply to merge requests here: every enforced rule above, as strengthened beneath, then the nearest group's or repository's own rules.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • rules_herearray of ApprovalRuleThe rules this group or repository defines itself.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • policyApprovalPolicy or nulloptionalThis group's or repository's own policy, when it sets one.
    • The ApprovalPolicy schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • defined_atAccessScope
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
    • updated_atstring · date-time
200 exampleSynthesized example
{
"effective": {
"author_can_approve": false,
"committers_can_approve": false,
"last_pusher_can_approve": false,
"reset_on_push": false
},
"rules": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-10T15:28:17Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-fa21",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 1,
"rule_id": "61096213-e7cd-46f0-8de4-a0e97c284375",
"updated_at": "2026-10-13T03:45:49Z"
}
],
"rules_here": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-10T22:55:34Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-f239",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 81,
"rule_id": "d36075cd-428a-419e-bec2-16741e3ab63e",
"updated_at": "2026-10-16T09:05:56Z"
},
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-12T16:57:20Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-b0c9",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 67,
"rule_id": "bb89dfd8-a724-48f3-94b2-bd28109a5704",
"updated_at": "2026-10-11T02:28:41Z"
}
],
"policy": {
"author_can_approve": false,
"committers_can_approve": false,
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-a24e",
"type": "group"
},
"enforcement": "default",
"last_pusher_can_approve": false,
"reset_on_push": false,
"updated_at": "2026-10-10T05:16:14Z"
}
}
400Invalid group idapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-5b07",
"message": "Pin a page's payload to the build that rendered it"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-8b76",
"message": "Inline scalar newtypes but keep their brand"
}
}
403The caller cannot see this group's rules, or the token lacks the scopeapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-a000",
"message": "Draw the region map from operation density"
}
}
404Group not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-8223",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap approval-rules get-group-approval-policy

  • --group-ididGroup ID (id or group path)

Used in these guides