Skip to content
GitmoapAPIBeta
Reviewapproval-rules
GET/repositories/{repo_id}/approval-policy

The approval policy and rules in force on a repository.

get_repo_approval_policy
  • approval_rule:read
    A token needs the approval_rule:read scope: See the approval rules and policy of a group or repositoryGranted by read_api, write_api.Every operation this scope unlocks

Returns the approval switches that apply to its merge requests, the repository's own policy if it sets one, and the rules its merge requests must satisfy: every rule enforced by a group above (or the stronger version a nearer scope defines), then the nearest scope's own rules. Anyone who can see the repository may read it.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID

Responses

200The switches in force, this repository's own policy, and the rules that apply to its merge requestsapplication/json
  • effectiveApprovalSwitchesThe switches that apply here: the nearest policy, tightened by every enforced one above it.
    • The ApprovalSwitches schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
  • rulesarray of ApprovalRuleThe rules that apply to merge requests here: every enforced rule above, as strengthened beneath, then the nearest group's or repository's own rules.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • rules_herearray of ApprovalRuleThe rules this group or repository defines itself.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • policyApprovalPolicy or nulloptionalThis group's or repository's own policy, when it sets one.
    • The ApprovalPolicy schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • defined_atAccessScope
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
    • updated_atstring · date-time
200 exampleSynthesized example
{
"effective": {
"author_can_approve": false,
"committers_can_approve": false,
"last_pusher_can_approve": false,
"reset_on_push": false
},
"rules": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-16T09:44:41Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-d42d",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 21,
"rule_id": "8ecc8000-6861-4acd-96b1-449171de7ac8",
"updated_at": "2026-10-12T11:36:11Z"
}
],
"rules_here": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-12T14:06:04Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-5596",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 35,
"rule_id": "59414d66-7cf5-49f0-a4e3-14b3517f4072",
"updated_at": "2026-10-12T03:25:43Z"
}
],
"policy": {
"author_can_approve": false,
"committers_can_approve": false,
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-fbd0",
"type": "group"
},
"enforcement": "default",
"last_pusher_can_approve": false,
"reset_on_push": false,
"updated_at": "2026-10-11T17:37:12Z"
}
}
400Invalid repository idapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-e4b2",
"message": "Stream pipeline status into the run header"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-71f7",
"message": "Label every synthesized example"
}
}
403The caller cannot see this repository's rules, or the token lacks the scopeapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-3c9c",
"message": "Draw the region map from operation density"
}
}
404Repository not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-093f",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap approval-rules get-repo-approval-policy

  • --repo-ididRepository ID (id or owner/repo path)

Used in these guides