Skip to content
GitmoapAPIBeta
Reviewapproval-rules
PUT/repositories/{repo_id}/approval-policy

Set a repository's approval policy — who may not approve, and whether approvals survive a push.

update_repo_approval_policy
  • approval_rule:manage
    A token needs the approval_rule:manage scope: Define, change and delete approval rules, and set the approval policyGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

Sets whether a merge request's author, its committers and its last pusher may approve it, and whether a push resets approvals. Maintainers and above may set it. A setting looser than a policy enforced by a group above is refused, and a repository's policy cannot be enforced.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID

Request body

application/json
  • author_can_approveboolean
  • committers_can_approveboolean
  • last_pusher_can_approveboolean
  • reset_on_pushboolean
  • enforcementRuleEnforcementdefaultenforcedoptionalenforced holds every group and repository beneath to these switches or stricter. Only someone who administers access here may set or clear it.
Request body exampleSynthesized example
{
"author_can_approve": false,
"committers_can_approve": false,
"last_pusher_can_approve": false,
"reset_on_push": false
}

Responses

200The policy and rules now in forceapplication/json
  • effectiveApprovalSwitchesThe switches that apply here: the nearest policy, tightened by every enforced one above it.
    • The ApprovalSwitches schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
  • rulesarray of ApprovalRuleThe rules that apply to merge requests here: every enforced rule above, as strengthened beneath, then the nearest group's or repository's own rules.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • rules_herearray of ApprovalRuleThe rules this group or repository defines itself.
    • The ApprovalRule schema
    • accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsWhich kinds of approval count toward a rule.
    • approversarray of ApproverRef
    • created_atstring · date-time
    • defined_atAccessScopeThe group or repository that defines it.
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • namestring
    • requiredinteger · int320–∞Distinct approvals that must count, 1–10.
    • rule_idApprovalRuleId (string · uuid)
    • updated_atstring · date-time
    • applies_to_branchesBranchPattern (string) or nulloptionalThe branches whose merge requests this rule applies to; absent means every branch.
    • strengthensApprovalRuleId (string · uuid) or nulloptionalThe enforced rule above this one that it strengthens, in whose place it applies here and beneath.
  • policyApprovalPolicy or nulloptionalThis group's or repository's own policy, when it sets one.
    • The ApprovalPolicy schema
    • author_can_approvebooleanWhether a merge request's author may approve it.
    • committers_can_approvebooleanWhether someone who authored or committed a commit in it may approve it.
    • defined_atAccessScope
    • enforcementRuleEnforcementdefaultenforcedWhether the scopes beneath may replace a rule, or only strengthen it.
    • last_pusher_can_approvebooleanWhether whoever pushed its current head may approve it.
    • reset_on_pushbooleanWhether an approval stops counting when new commits are pushed.
    • updated_atstring · date-time
200 exampleSynthesized example
{
"effective": {
"author_can_approve": false,
"committers_can_approve": false,
"last_pusher_can_approve": false,
"reset_on_push": false
},
"rules": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-12T03:00:29Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-4477",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 44,
"rule_id": "14a1da66-a872-4f2f-9a7e-56366b1322d2",
"updated_at": "2026-10-08T11:05:09Z"
}
],
"rules_here": [
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-13T15:56:38Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-7fad",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 71,
"rule_id": "8e376427-43af-4994-92fe-62493215aeec",
"updated_at": "2026-10-11T22:35:47Z"
},
{
"accept_from": "people_signed_in",
"approvers": [],
"created_at": "2026-10-09T02:13:39Z",
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-1d03",
"type": "group"
},
"enforcement": "default",
"name": "payments-api",
"required": 35,
"rule_id": "e50a6661-b8ba-489d-a446-e5dd9fe85e7b",
"updated_at": "2026-10-15T03:02:08Z"
}
],
"policy": {
"author_can_approve": false,
"committers_can_approve": false,
"defined_at": {
"full_path": "acme/payments-api",
"id": "id-c531",
"type": "group"
},
"enforcement": "default",
"last_pusher_can_approve": false,
"reset_on_push": false,
"updated_at": "2026-10-12T19:44:56Z"
}
}
400Invalid request, or enforcement asked of a repositoryapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-e3ec",
"message": "Draw the region map from operation density"
}
}
401Authentication requiredapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-67a1",
"message": "Inline scalar newtypes but keep their brand"
}
}
403The caller cannot manage this repository's rulesapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-8f42",
"message": "Inline scalar newtypes but keep their brand"
}
}
404Repository not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-82b3",
"message": "Label every synthesized example"
}
}
409The request conflicts with the resource's current state; `reason` says howapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-634a",
"message": "Pin a page's payload to the build that rendered it"
}
}
422A switch would be weaker than a policy enforced above allowsapplication/json
Error codes
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
422 exampleSynthesized example
{
"error": {
"code": "code-1674",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap approval-rules update-repo-approval-policy

  • --repo-ididRepository ID (id or owner/repo path)
  • --author-can-approveflag
  • --committers-can-approveflag
  • --enforcementdefault | enforcedoptional`enforced` holds every group and repository beneath to these switches or stricter. Only someone who administers access here may set or clear it.
  • --last-pusher-can-approveflag
  • --reset-on-pushflag

Used in these guides