Skip to content
GitmoapAPIBeta
Planissue-criteria
PUT/repositories/{repo_id}/issues/{issue_id}/criteria/order

Reorder a work item's acceptance criteria

reorder_issue_criteria
  • issue:update
    A token needs the issue:update scope: Update work items — status, fields, hierarchyGranted by mcp_agent_write, write_api, write_repository.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

Puts the work item's criteria in the order of the ids you send, first to last, and returns them in that order. The list must name every criterion exactly once. Developers and above may reorder criteria.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
  • issue_idIssueId (integer · int64)Work-item iid

Request body

application/json
  • orderarray of CriterionId (string · uuid)
Request body exampleSynthesized example
{
"order": [
"de610416-21f6-4c4e-83f9-b969253628aa",
"8cc3318a-a230-4b2d-8fa5-c301785dbb72"
]
}

Responses

200The criteria in their new orderapplication/json
  • created_atstring
  • criterion_idCriterionId (string · uuid)The criterion's identifier. It never changes, so rewording or re-binding a criterion keeps its identity and its evidence.
  • issue_uidIssueUid (string · uuid)
  • satisfiedboolean
  • stateCriterionStateunverifiedpassingfailingstalemanualA criterion's verdict.
  • textstringThe human statement — the criterion's title. The label, not the identity.
  • updated_atstring
  • bindingCriterionBinding or nulloptional
  • binding_exprstring or nulloptionalThe binding's @-expression, as written. Absent for a manual criterion.
  • binding_keystring or nulloptionalThe normalised form of binding_expr, which two equivalent spellings share. Absent for a manual criterion.
  • checkedbooleanoptionalWhether the box is ticked. Meaningful only for a manual criterion — a bound one is ticked by its state, and ticking it by hand is refused with a 409.
  • descriptionstring or nulloptionalAn optional longer description (markdown) — the per-criterion detail a flat checkbox could never hold.
  • evidenceEvidence or nulloptional
    • The Evidence schema
    • commit_shaCommitHash (string)
    • observed_atstringWhen the run that produced the evidence finished, RFC 3339.
    • pipeline_idPipelineId (string · uuid)
    • pipeline_run_idPipelineRunId (string · uuid)
    • node_run_idNodeRunId (string · uuid) or nulloptional
    • valuenumber · double or nulloptional
  • facet_categoryFacetCategory (string) or nulloptional
  • facet_keyFacetKey (string) or nulloptionalThe blueprint facet this criterion belongs to, when a blueprint added it. Absent for a criterion written directly. A facet's state is rolled up from the criteria carrying its key.
  • last_evidence_atstring or nulloptional
  • last_evidence_commit_shaCommitHash (string) or nulloptional
  • last_evidence_node_run_idNodeRunId (string · uuid) or nulloptional
  • last_evidence_pipeline_idPipelineId (string · uuid) or nulloptionalThe pipeline whose run last provided evidence for this criterion. Only a later run of the same pipeline can make the criterion stale.
  • last_evidence_run_idPipelineRunId (string · uuid) or nulloptional
  • last_evidence_valuenumber · double or nulloptionalThe observed value, for a Metric or Coverage binding.
  • ordinalinteger · int32optional0–∞Position in the description, so the list round-trips in authoring order.
  • required_for_closebooleanoptional@optional opts out. Everything else in a Definition of Done is required by definition.
200 exampleSynthesized example
[
{
"created_at": "2026-10-13T09:54:50Z",
"criterion_id": "836877f8-7068-40ce-b815-31097933db92",
"issue_uid": "7ad83c4b-3b7b-41ec-b7d5-d011f5a3679b",
"satisfied": false,
"state": "unverified",
"text": "text-c8e8",
"updated_at": "2026-10-13T01:40:31Z"
},
{
"created_at": "2026-10-09T22:32:31Z",
"criterion_id": "3a06d2a6-b093-4612-84ce-f82da0f6ab2e",
"issue_uid": "b67de9c3-a978-4463-87f5-630d6de46fd5",
"satisfied": false,
"state": "unverified",
"text": "text-586b",
"updated_at": "2026-10-15T14:02:08Z"
}
]
400The order must list every criterion exactly onceapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-35a1",
"message": "Draw the region map from operation density"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-17d3",
"message": "Pin a page's payload to the build that rendered it"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-5f2f",
"message": "Draw the region map from operation density"
}
}
404Work item or criterion not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-69cb",
"message": "Draw the region map from operation density"
}
}
409The request conflicts with the resource's current state; `reason` says howapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-6024",
"message": "Pin a page's payload to the build that rendered it"
}
}

CLI

gitmoap issue-criteria reorder

  • --repo-ididRepository ID (id or owner/repo path)
  • --issue-ididWork-item iid
  • --orderjson

Used in these guides