Skip to content
GitmoapAPIBeta
Organizeaccess
PUT/repositories/{repo_id}/access/inheritance

Stop grants made on the groups above from reaching a repository, or let them reach it again.

update_repo_access_inheritance
  • access:administer
    A token needs the access:administer scope: Limit access, and stop a group or repository inheriting itEvery operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Dry run
    Takes dry_run.

Limits and the organization's owners reach the repository either way. Only the repository's owners may call it, and switching it off is refused when it would take away the caller's own right to switch it back. Setting the state it already has changes nothing. The answer says who gains or loses access; with dry_run=true nothing changes.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
Query
  • dry_runbooleanoptionalSay who would gain or lose access, and change nothing

Request body

application/json
  • inherits_accessboolean
Request body exampleSynthesized example
{
"inherits_access": false
}

Responses

200The repository's inheritance and who it changed, or a previewapplication/json
  • dry_runboolean
  • scopeAccessPageScope
    • The AccessPageScope schema
    • full_pathstring
    • idstring
    • inherits_accessbooleanWhether access granted on the groups above reaches it. When it is false, only access granted here — and the organization's owners — reach it.
    • typeScopeTypegrouprepository
  • previewAccessPreview or nulloptional
    • The AccessPreview schema
    • changesarray of AccessDeltaEach person whose access would change at the group or repository the change is made on.
      • The AccessDelta schema
      • gainsarray of stringPermissions they would hold that they do not hold now, by key.
      • lossesarray of stringPermissions they hold now that they would no longer hold, by key.
      • principalPrincipalSummary
      • scopeAccessScope
      • rank_afterAccessLevelguestreporterdevelopermaintainerowneror nulloptional
      • rank_beforeAccessLevelguestreporterdevelopermaintainerowneror nulloptional
    • summaryAccessPreviewSummary
      • The AccessPreviewSummary schema
      • people_gaininginteger · int320–∞
      • people_losinginteger · int320–∞
      • scopes_affectedinteger · int64The group or repository the change is made on, plus every one beneath it that inherits access and so changes with it.
    • truncatedbooleanWhether changes stops short of everyone affected. The summary still counts them all.
200 exampleSynthesized example
{
"dry_run": false,
"scope": {
"full_path": "acme/payments-api",
"id": "id-f3de",
"inherits_access": false,
"type": "group"
},
"preview": {
"changes": [
{
"gains": [],
"losses": [],
"principal": {
"id": "7fadfe8d-942d-425b-8434-3cc1ba7528b5",
"kind": "user",
"username": "mara"
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-1a52",
"type": "group"
}
},
{
"gains": [],
"losses": [],
"principal": {
"id": "3a2deefa-6f14-4eed-b405-c00b43c3fe80",
"kind": "user",
"username": "lin"
},
"scope": {
"full_path": "acme/payments-api",
"id": "id-aade",
"type": "group"
}
}
],
"summary": {
"people_gaining": 37,
"people_losing": 43,
"scopes_affected": 13
},
"truncated": false
}
}
400Invalid requestapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-970b",
"message": "Stream pipeline status into the run header"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-a797",
"message": "Stream pipeline status into the run header"
}
}
403Only the owners of the repository can switch thisapplication/json
Error codes
  • ACCESS_ESCALATIONThe change would give someone more access than you hold yourself
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-1757",
"message": "Stream pipeline status into the run header"
}
}
404Repository not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-33a8",
"message": "Stream pipeline status into the run header"
}
}
409Switching it off would take away your own right to switch it backapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • GRANT_EXISTSThe person, service account or team already holds a different role here; change that grant instead
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • LIMIT_EXISTSThe person, service account or team is already limited here; remove that limit first
  • WOULD_LOCK_OUT_ACTORThe change would take away your own ability to undo it; ask an organization owner
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-4a71",
"message": "Stream pipeline status into the run header"
}
}
422The request is well-formed but asks for something the resource's rules do not allow; `reason` says whichapplication/json
Error codes
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
422 exampleSynthesized example
{
"error": {
"code": "code-6fdc",
"message": "Pin a page's payload to the build that rendered it"
}
}

CLI

gitmoap access update-repo-access-inheritance

  • --repo-ididRepository ID (id or owner/repo path)
  • --dry-runflagoptionalSay who would gain or lose access, and change nothing
  • --inherits-accessflag

Used in these guides