PUT/groups/{group_id}/approval-policy

Set a group's approval policy — who may not approve, and whether approvals survive a push.

update_group_approval_policy

approval_rule:manage
A token needs the approval_rule:manage scope: Define, change and delete approval rules, and set the approval policyGranted by write_api.Every operation this scope unlocks
Audited · mutation
x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

Sets whether a merge request's author, its committers and its last pusher may approve it, and whether a push resets approvals, for every repository beneath that sets nothing nearer. Maintainers and above may set it; making it enforced, so everything beneath may only be stricter, or changing it once enforced needs an Owner. A setting looser than a policy enforced above is refused.

Parameters

Path

group_idGroupId (string · uuid)Group ID

Request body

application/json

author_can_approveboolean
committers_can_approveboolean
last_pusher_can_approveboolean
reset_on_pushboolean
enforcementRuleEnforcementdefaultenforcedoptionalenforced holds every group and repository beneath to these switches or stricter. Only someone who administers access here may set or clear it.

Request body exampleSynthesized example

Responses

200The policy and rules now in forceapplication/json

effectiveApprovalSwitchesThe switches that apply here: the nearest policy, tightened by every enforced one above it.
- The ApprovalSwitches schema
- author_can_approvebooleanWhether a merge request's author may approve it.
- committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
- last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
- reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
rulesarray of ApprovalRuleThe rules that apply to merge requests here: every enforced rule above, as strengthened beneath, then the nearest group's or repository's own rules.
- The ApprovalRule schema
- accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
- approversarray of ApproverRef
- created_atstring · date-time
- defined_atAccessScopeThe group or repository that defines it.
  - The AccessScope schema
  - full_pathstring
  - idstring
  - typeScopeTypegrouprepository
- enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
- namestring
- requiredinteger · int320–∞Distinct approvals that must count, 1–10.
- rule_idApprovalRuleId (string · uuid)
- updated_atstring · date-time
- applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
- strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
rules_herearray of ApprovalRuleThe rules this group or repository defines itself.
- The ApprovalRule schema
- accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
- approversarray of ApproverRef
- created_atstring · date-time
- defined_atAccessScopeThe group or repository that defines it.
  - The AccessScope schema
  - full_pathstring
  - idstring
  - typeScopeTypegrouprepository
- enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
- namestring
- requiredinteger · int320–∞Distinct approvals that must count, 1–10.
- rule_idApprovalRuleId (string · uuid)
- updated_atstring · date-time
- applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
- strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
policyApprovalPolicy or nulloptionalThis group's or repository's own policy, when it sets one.
- The ApprovalPolicy schema
- author_can_approvebooleanWhether a merge request's author may approve it.
- committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
- defined_atAccessScope
  - The AccessScope schema
  - full_pathstring
  - idstring
  - typeScopeTypegrouprepository
- enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
- last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
- reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
- updated_atstring · date-time

200 exampleSynthesized example

400Invalid requestapplication/json

Error codes

BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

400 exampleSynthesized example

401Authentication requiredapplication/json

Error codes

UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

401 exampleSynthesized example

403The caller cannot manage this group's rules, or cannot enforce themapplication/json

Error codes

FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

403 exampleSynthesized example

404Group not foundapplication/json

Error codes

NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

404 exampleSynthesized example

409The request conflicts with the resource's current state; `reason` says howapplication/json

Error codes

CONFLICTThe request conflicts with the resource's current state; reason says how
LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

409 exampleSynthesized example

422A switch would be weaker than a policy enforced above allowsapplication/json

Error codes

UNPROCESSABLE_ENTITYThe request is well-formed but asks for something the resource's rules do not allow; reason says which
WOULD_WEAKEN_ENFORCED_RULEThe setting would be weaker than a rule enforced above it allows

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

422 exampleSynthesized example

CLI

gitmoap approval-rules update-group-approval-policy

--group-ididGroup ID (id or group path)
--author-can-approveflag
--committers-can-approveflag
--enforcementdefault | enforcedoptional`enforced` holds every group and repository beneath to these switches or stricter. Only someone who administers access here may set or clear it.
--last-pusher-can-approveflag
--reset-on-pushflag

Used in these guides

Approval rules

Request

curl -X PUT "https://api.gitmoap.com/groups//approval-policy" \
  -H "Authorization: Bearer $GITMOAP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "author_can_approve": ,
    "committers_can_approve": ,
    "last_pusher_can_approve": ,
    "reset_on_push": 
  }'

gitmoap approval-rules update-group-approval-policy \
  --group-id

import { createApiClient } from "@gitmoap/backend-types";

const client = createApiClient({
  baseUrl: "https://api.gitmoap.com",
  headers: { Authorization: `Bearer ${process.env.GITMOAP_TOKEN}` },
});

const { data, error } = await client.PUT("/groups/{group_id}/approval-policy", {
  params: {
    path: { group_id: "" },
  },
  body: {
    author_can_approve: ,
    committers_can_approve: ,
    last_pusher_can_approve: ,
    reset_on_push: 
  },
});

PUT /groups//approval-policy HTTP/1.1
Host: api.gitmoap.com
Authorization: Bearer $GITMOAP_TOKEN
Content-Type: application/json

{
  "author_can_approve": ,
  "committers_can_approve": ,
  "last_pusher_can_approve": ,
  "reset_on_push": 
}

⌘↵

Send to see the sandbox's answer. Nothing leaves your browser.