Skip to content
forgit api docs

Update branch protection

PUT
/repos/{owner}/{repo}/branches/{branch}/protection

Protected branches are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server. For more information, see GitHub’s products in the GitHub Help documentation.

Protecting a branch requires admin or owner permissions to the repository.

[!NOTE] Passing new arrays of users and teams replaces their previous values.

[!NOTE] The list of users, apps, and teams in total is limited to 100 items.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

branch
required
string

The name of the branch. Cannot contain wildcard characters. To use wildcard characters in branch names, use the GraphQL API.

Request Body required

Section titled “ Request Body required ”
Media type application/json
object
required_status_checks
required

Require status checks to pass before merging. Set to null to disable.

object
strict
required

Require branches to be up to date before merging.

boolean
contexts
required

Closing down notice: The list of status checks to require in order to merge into this branch. If any of these checks have recently been set by a particular GitHub App, they will be required to come from that app in future for the branch to merge. Use checks instead of contexts for more fine-grained control.

Array<string>
checks

The list of status checks to require in order to merge into this branch.

Array<object>
object
context
required

The name of the required check

string
app_id

The ID of the GitHub App that must provide this check. Omit this field to automatically select the GitHub App that has recently provided this check, or any app if it was not set by a GitHub App. Pass -1 to explicitly allow any app to set the status.

integer
enforce_admins
required

Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.

boolean
nullable
required_pull_request_reviews
required

Require at least one approving review on a pull request, before merging. Set to null to disable.

object
dismissal_restrictions

Specify which users, teams, and apps can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.

object
users

The list of user logins with dismissal access

Array<string>
teams

The list of team slugs with dismissal access

Array<string>
apps

The list of app slugs with dismissal access

Array<string>
dismiss_stale_reviews

Set to true if you want to automatically dismiss approving reviews when someone pushes a new commit.

boolean
require_code_owner_reviews

Blocks merging pull requests until code owners review them.

boolean
required_approving_review_count

Specify the number of reviewers required to approve pull requests. Use a number between 1 and 6 or 0 to not require reviewers.

integer
require_last_push_approval

Whether the most recent push must be approved by someone other than the person who pushed it. Default: false.

boolean
bypass_pull_request_allowances

Allow specific users, teams, or apps to bypass pull request requirements.

object
users

The list of user logins allowed to bypass pull request requirements.

Array<string>
teams

The list of team slugs allowed to bypass pull request requirements.

Array<string>
apps

The list of app slugs allowed to bypass pull request requirements.

Array<string>
restrictions
required

Restrict who can push to the protected branch. User, app, and team restrictions are only available for organization-owned repositories. Set to null to disable.

object
users
required

The list of user logins with push access

Array<string>
teams
required

The list of team slugs with push access

Array<string>
apps

The list of app slugs with push access

Array<string>
required_linear_history

Enforces a linear commit Git history, which prevents anyone from pushing merge commits to a branch. Set to true to enforce a linear commit history. Set to false to disable a linear commit Git history. Your repository must allow squash merging or rebase merging before you can enable a linear commit history. Default: false. For more information, see “Requiring a linear commit history” in the GitHub Help documentation.

boolean
allow_force_pushes

Permits force pushes to the protected branch by anyone with write access to the repository. Set to true to allow force pushes. Set to false or null to block force pushes. Default: false. For more information, see “Enabling force pushes to a protected branch” in the GitHub Help documentation.“

boolean
nullable
allow_deletions

Allows deletion of the protected branch by anyone with write access to the repository. Set to false to prevent deletion of the protected branch. Default: false. For more information, see “Enabling force pushes to a protected branch” in the GitHub Help documentation.

boolean
block_creations

If set to true, the restrictions branch protection settings which limits who can push will also block pushes which create new branches, unless the push is initiated by a user, team, or app which has the ability to push. Set to true to restrict new branch creation. Default: false.

boolean
required_conversation_resolution

Requires all conversations on code to be resolved before a pull request can be merged into a branch that matches this rule. Set to false to disable. Default: false.

boolean
lock_branch

Whether to set the branch as read-only. If this is true, users will not be able to push to the branch. Default: false.

boolean
allow_fork_syncing

Whether users can pull changes from upstream when the branch is locked. Set to true to allow fork syncing. Set to false to prevent fork syncing. Default: false.

boolean
Examples
Example default 
{
  "required_status_checks": {
    "strict": true,
    "contexts": [
      "continuous-integration/travis-ci"
    ]
  },
  "enforce_admins": true,
  "required_pull_request_reviews": {
    "dismissal_restrictions": {
      "users": [
        "octocat"
      ],
      "teams": [
        "justice-league"
      ]
    },
    "dismiss_stale_reviews": true,
    "require_code_owner_reviews": true,
    "required_approving_review_count": 2,
    "require_last_push_approval": true,
    "bypass_pull_request_allowances": {
      "users": [
        "octocat"
      ],
      "teams": [
        "justice-league"
      ]
    }
  },
  "restrictions": {
    "users": [
      "octocat"
    ],
    "teams": [
      "justice-league"
    ],
    "apps": [
      "super-ci"
    ]
  },
  "required_linear_history": true,
  "allow_force_pushes": true,
  "allow_deletions": true,
  "block_creations": true,
  "required_conversation_resolution": true,
  "lock_branch": true,
  "allow_fork_syncing": true
}

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json
Protected Branch

Branch protections protect branches

object
url
required
string format: uri
required_status_checks
Status Check Policy

Status Check Policy

object
url
required
string format: uri
strict
required
boolean
contexts
required
Array<string>
checks
required
Array<object>
object
context
required
string
app_id
required
integer
nullable
contexts_url
required
string format: uri
required_pull_request_reviews
object
url
required
string format: uri
dismiss_stale_reviews
boolean
require_code_owner_reviews
boolean
required_approving_review_count
integer
require_last_push_approval

Whether the most recent push must be approved by someone other than the person who pushed it.

boolean
dismissal_restrictions
object
url
required
string format: uri
users_url
required
string format: uri
teams_url
required
string format: uri
users
required
Array<object>
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
teams
required
Array<object>
Team

Groups of organization members that gives permissions on specified repositories.

object
id
required
integer
node_id
required
string
name
required
string
slug
required
string
description
required
string
nullable
privacy
string
notification_setting
string
permission
required
string
permissions
object
pull
required
boolean
triage
required
boolean
push
required
boolean
maintain
required
boolean
admin
required
boolean
url
required
string format: uri
html_url
required
string format: uri
members_url
required
string
repositories_url
required
string format: uri
type
required

The ownership type of the team

string
Allowed values: enterprise organization
access_source

How the team’s access to the repository was granted. This property is only present when the team is returned in a repository context, such as GET /repos/{owner}/{repo}/teams.

string
Allowed values: direct organization enterprise
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
parent
required
Team Simple

Groups of organization members that gives permissions on specified repositories.

object
id
required

Unique identifier of the team

integer
node_id
required
string
url
required

URL for the team

string format: uri
members_url
required
string
name
required

Name of the team

string
description
required

Description of the team

string
nullable
permission
required

Permission that the team will have for its repositories

string
privacy

The level of privacy this team should have

string
notification_setting

The notification setting the team has set

string
html_url
required
string format: uri
repositories_url
required
string format: uri
slug
required
string
ldap_dn

Distinguished Name (DN) that team maps to within LDAP environment

string
type
required

The ownership type of the team

string
Allowed values: enterprise organization
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
apps
Array<object>
GitHub app

GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.

object
id
required

Unique identifier of the GitHub app

integer
slug

The slug name of the GitHub app

string
node_id
required
string
client_id
string
owner
required
One of:
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
name
required

The name of the GitHub app

string
description
required
string
nullable
external_url
required
string format: uri
html_url
required
string format: uri
created_at
required
string format: date-time
updated_at
required
string format: date-time
permissions
required

The set of permissions for the GitHub app

object
issues
string
checks
string
metadata
string
contents
string
deployments
string
key
additional properties
string
events
required

The list of events for the GitHub app. Note that the installation_target, security_advisory, and meta events are not included because they are global events and not specific to an installation.

Array<string>
installations_count

The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself.

integer
bypass_pull_request_allowances
object
users
required
Array<object>
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
teams
required
Array<object>
Team

Groups of organization members that gives permissions on specified repositories.

object
id
required
integer
node_id
required
string
name
required
string
slug
required
string
description
required
string
nullable
privacy
string
notification_setting
string
permission
required
string
permissions
object
pull
required
boolean
triage
required
boolean
push
required
boolean
maintain
required
boolean
admin
required
boolean
url
required
string format: uri
html_url
required
string format: uri
members_url
required
string
repositories_url
required
string format: uri
type
required

The ownership type of the team

string
Allowed values: enterprise organization
access_source

How the team’s access to the repository was granted. This property is only present when the team is returned in a repository context, such as GET /repos/{owner}/{repo}/teams.

string
Allowed values: direct organization enterprise
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
parent
required
Team Simple

Groups of organization members that gives permissions on specified repositories.

object
id
required

Unique identifier of the team

integer
node_id
required
string
url
required

URL for the team

string format: uri
members_url
required
string
name
required

Name of the team

string
description
required

Description of the team

string
nullable
permission
required

Permission that the team will have for its repositories

string
privacy

The level of privacy this team should have

string
notification_setting

The notification setting the team has set

string
html_url
required
string format: uri
repositories_url
required
string format: uri
slug
required
string
ldap_dn

Distinguished Name (DN) that team maps to within LDAP environment

string
type
required

The ownership type of the team

string
Allowed values: enterprise organization
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
apps
Array<object>
GitHub app

GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.

object
id
required

Unique identifier of the GitHub app

integer
slug

The slug name of the GitHub app

string
node_id
required
string
client_id
string
owner
required
One of:
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
name
required

The name of the GitHub app

string
description
required
string
nullable
external_url
required
string format: uri
html_url
required
string format: uri
created_at
required
string format: date-time
updated_at
required
string format: date-time
permissions
required

The set of permissions for the GitHub app

object
issues
string
checks
string
metadata
string
contents
string
deployments
string
key
additional properties
string
events
required

The list of events for the GitHub app. Note that the installation_target, security_advisory, and meta events are not included because they are global events and not specific to an installation.

Array<string>
installations_count

The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself.

integer
required_signatures
object
url
required
string format: uri
enabled
required
boolean
enforce_admins
object
url
required
string format: uri
enabled
required
boolean
required_linear_history
object
enabled
required
boolean
allow_force_pushes
object
enabled
required
boolean
allow_deletions
object
enabled
required
boolean
restrictions
Branch Restriction Policy

Branch Restriction Policy

object
url
required
string format: uri
users_url
required
string format: uri
teams_url
required
string format: uri
apps_url
required
string format: uri
users
required
Array<object>
object
login
string
id
integer format: int64
node_id
string
avatar_url
string
gravatar_id
string
url
string
html_url
string
followers_url
string
following_url
string
gists_url
string
starred_url
string
subscriptions_url
string
organizations_url
string
repos_url
string
events_url
string
received_events_url
string
type
string
site_admin
boolean
user_view_type
string
teams
required
Array<object>
Team

Groups of organization members that gives permissions on specified repositories.

object
id
required
integer
node_id
required
string
name
required
string
slug
required
string
description
required
string
nullable
privacy
string
notification_setting
string
permission
required
string
permissions
object
pull
required
boolean
triage
required
boolean
push
required
boolean
maintain
required
boolean
admin
required
boolean
url
required
string format: uri
html_url
required
string format: uri
members_url
required
string
repositories_url
required
string format: uri
type
required

The ownership type of the team

string
Allowed values: enterprise organization
access_source

How the team’s access to the repository was granted. This property is only present when the team is returned in a repository context, such as GET /repos/{owner}/{repo}/teams.

string
Allowed values: direct organization enterprise
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
parent
required
Team Simple

Groups of organization members that gives permissions on specified repositories.

object
id
required

Unique identifier of the team

integer
node_id
required
string
url
required

URL for the team

string format: uri
members_url
required
string
name
required

Name of the team

string
description
required

Description of the team

string
nullable
permission
required

Permission that the team will have for its repositories

string
privacy

The level of privacy this team should have

string
notification_setting

The notification setting the team has set

string
html_url
required
string format: uri
repositories_url
required
string format: uri
slug
required
string
ldap_dn

Distinguished Name (DN) that team maps to within LDAP environment

string
type
required

The ownership type of the team

string
Allowed values: enterprise organization
organization_id

Unique identifier of the organization to which this team belongs

integer
enterprise_id

Unique identifier of the enterprise to which this team belongs

integer
apps
required
Array<object>
object
id
integer
slug
string
node_id
string
owner
object
login
string
id
integer
node_id
string
url
string
repos_url
string
events_url
string
hooks_url
string
issues_url
string
members_url
string
public_members_url
string
avatar_url
string
description
string
gravatar_id
string
html_url
string
followers_url
string
following_url
string
gists_url
string
starred_url
string
subscriptions_url
string
organizations_url
string
received_events_url
string
type
string
site_admin
boolean
user_view_type
string
name
string
client_id
string
description
string
external_url
string
html_url
string
created_at
string
updated_at
string
permissions
object
metadata
string
contents
string
issues
string
single_file
string
events
Array<string>
required_conversation_resolution
object
enabled
boolean
block_creations
object
enabled
required
boolean
lock_branch

Whether to set the branch as read-only. If this is true, users will not be able to push to the branch.

object
enabled
boolean
allow_fork_syncing

Whether users can pull changes from upstream when the branch is locked. Set to true to allow fork syncing. Set to false to prevent fork syncing.

object
enabled
boolean
Examples
Example default 
{
  "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection",
  "required_status_checks": {
    "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/required_status_checks",
    "strict": true,
    "contexts": [
      "continuous-integration/travis-ci"
    ],
    "contexts_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/required_status_checks/contexts",
    "checks": [
      {
        "context": "continuous-integration/travis-ci",
        "app_id": null
      }
    ]
  },
  "restrictions": {
    "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/restrictions",
    "users_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/restrictions/users",
    "teams_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/restrictions/teams",
    "apps_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/restrictions/apps",
    "users": [],
    "teams": [],
    "apps": []
  },
  "required_pull_request_reviews": {
    "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/required_pull_request_reviews",
    "dismiss_stale_reviews": true,
    "require_code_owner_reviews": true,
    "required_approving_review_count": 2,
    "require_last_push_approval": true,
    "dismissal_restrictions": {
      "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/dismissal_restrictions",
      "users_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/dismissal_restrictions/users",
      "teams_url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/dismissal_restrictions/teams",
      "users": [],
      "teams": [],
      "apps": []
    }
  },
  "required_signatures": {
    "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/required_signatures",
    "enabled": false
  },
  "enforce_admins": {
    "url": "https://api.github.com/repos/octocat/hello-world/branches/main/protection/enforce_admins",
    "enabled": true
  },
  "required_linear_history": {
    "enabled": true
  },
  "allow_force_pushes": {
    "enabled": true
  },
  "allow_deletions": {
    "enabled": true
  },
  "block_creations": {
    "enabled": true
  },
  "required_conversation_resolution": {
    "enabled": true
  },
  "lock_branch": {
    "enabled": true
  },
  "allow_fork_syncing": {
    "enabled": true
  }
}

403

Section titled “ 403 ”

Forbidden

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Section titled “ 404 ”

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Section titled “ 422 ”

Validation failed, or the endpoint has been spammed.

Media type application/json
Validation Error Simple

Validation Error Simple

object
message
required
string
documentation_url
required
string
errors
Array<string>
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    "example"
  ]
}