--- title: "Update branch protection" method: PUT path: "/repos/{owner}/{repo}/branches/{branch}/protection" tags: ["repos"] --- # Update branch protection `PUT /repos/{owner}/{repo}/branches/{branch}/protection` Protected branches are available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server. For more information, see [GitHub's products](https://docs.github.com/enterprise-cloud@latest/github/getting-started-with-github/githubs-products) in the GitHub Help documentation. Protecting a branch requires admin or owner permissions to the repository. > [!NOTE] > Passing new arrays of `users` and `teams` replaces their previous values. > [!NOTE] > The list of users, apps, and teams in total is limited to 100 items. ## Path parameters - `owner` string, required - `repo` string, required - `branch` string, required ## Request body - object - `required_status_checks` object, nullable, required — Require status checks to pass before merging. Set to `null` to disable. - `strict` boolean, required — Require branches to be up to date before merging. - `contexts` string[], required — **Closing down notice**: The list of status checks to require in order to merge into this branch. If any of these checks have recently been set by a particular GitHub App, they will be required to come from that app in future for the branch to merge. Use `checks` instead of `contexts` for more fine-grained control. - `checks` object[] — The list of status checks to require in order to merge into this branch. - `context` string, required — The name of the required check - `app_id` integer — The ID of the GitHub App that must provide this check. Omit this field to automatically select the GitHub App that has recently provided this check, or any app if it was not set by a GitHub App. Pass -1 to explicitly allow any app to set the status. - `enforce_admins` boolean, nullable, required — Enforce all configured restrictions for administrators. Set to `true` to enforce required status checks for repository administrators. Set to `null` to disable. - `required_pull_request_reviews` object, nullable, required — Require at least one approving review on a pull request, before merging. Set to `null` to disable. - `dismissal_restrictions` object — Specify which users, teams, and apps can dismiss pull request reviews. Pass an empty `dismissal_restrictions` object to disable. User and team `dismissal_restrictions` are only available for organization-owned repositories. Omit this parameter for personal repositories. - `users` string[] — The list of user `login`s with dismissal access - `teams` string[] — The list of team `slug`s with dismissal access - `apps` string[] — The list of app `slug`s with dismissal access - `dismiss_stale_reviews` boolean — Set to `true` if you want to automatically dismiss approving reviews when someone pushes a new commit. - `require_code_owner_reviews` boolean — Blocks merging pull requests until [code owners](https://docs.github.com/enterprise-cloud@latest/articles/about-code-owners/) review them. - `required_approving_review_count` integer — Specify the number of reviewers required to approve pull requests. Use a number between 1 and 6 or 0 to not require reviewers. - `require_last_push_approval` boolean — Whether the most recent push must be approved by someone other than the person who pushed it. Default: `false`. - `bypass_pull_request_allowances` object — Allow specific users, teams, or apps to bypass pull request requirements. - `users` string[] — The list of user `login`s allowed to bypass pull request requirements. - `teams` string[] — The list of team `slug`s allowed to bypass pull request requirements. - `apps` string[] — The list of app `slug`s allowed to bypass pull request requirements. - `restrictions` object, nullable, required — Restrict who can push to the protected branch. User, app, and team `restrictions` are only available for organization-owned repositories. Set to `null` to disable. - `users` string[], required — The list of user `login`s with push access - `teams` string[], required — The list of team `slug`s with push access - `apps` string[] — The list of app `slug`s with push access - `required_linear_history` boolean — Enforces a linear commit Git history, which prevents anyone from pushing merge commits to a branch. Set to `true` to enforce a linear commit history. Set to `false` to disable a linear commit Git history. Your repository must allow squash merging or rebase merging before you can enable a linear commit history. Default: `false`. For more information, see "[Requiring a linear commit history](https://docs.github.com/enterprise-cloud@latest/github/administering-a-repository/requiring-a-linear-commit-history)" in the GitHub Help documentation. - `allow_force_pushes` boolean, nullable — Permits force pushes to the protected branch by anyone with write access to the repository. Set to `true` to allow force pushes. Set to `false` or `null` to block force pushes. Default: `false`. For more information, see "[Enabling force pushes to a protected branch](https://docs.github.com/enterprise-cloud@latest/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)" in the GitHub Help documentation." - `allow_deletions` boolean — Allows deletion of the protected branch by anyone with write access to the repository. Set to `false` to prevent deletion of the protected branch. Default: `false`. For more information, see "[Enabling force pushes to a protected branch](https://docs.github.com/enterprise-cloud@latest/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)" in the GitHub Help documentation. - `block_creations` boolean — If set to `true`, the `restrictions` branch protection settings which limits who can push will also block pushes which create new branches, unless the push is initiated by a user, team, or app which has the ability to push. Set to `true` to restrict new branch creation. Default: `false`. - `required_conversation_resolution` boolean — Requires all conversations on code to be resolved before a pull request can be merged into a branch that matches this rule. Set to `false` to disable. Default: `false`. - `lock_branch` boolean — Whether to set the branch as read-only. If this is true, users will not be able to push to the branch. Default: `false`. - `allow_fork_syncing` boolean — Whether users can pull changes from upstream when the branch is locked. Set to `true` to allow fork syncing. Set to `false` to prevent fork syncing. Default: `false`. ## Response `200` Response - ProtectedBranch — Branch protections protect branches - `url` string, uri, required - `required_status_checks` StatusCheckPolicy — Status Check Policy - `url` string, uri, required - `strict` boolean, required - `contexts` string[], required - `checks` object[], required - `context` string, required - `app_id` integer, nullable, required - `contexts_url` string, uri, required - `required_pull_request_reviews` object - `url` string, uri, required - `dismiss_stale_reviews` boolean - `require_code_owner_reviews` boolean - `required_approving_review_count` integer - `require_last_push_approval` boolean — Whether the most recent push must be approved by someone other than the person who pushed it. - `dismissal_restrictions` object - `url` string, uri, required - `users_url` string, uri, required - `teams_url` string, uri, required - `users` SimpleUser[], required - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - `teams` Team[], required - `id` integer, required - `node_id` string, required - `name` string, required - `slug` string, required - `description` string, nullable, required - `privacy` string - `notification_setting` string - `permission` string, required - `permissions` object - `pull` boolean, required - `triage` boolean, required - `push` boolean, required - `maintain` boolean, required - `admin` boolean, required - `url` string, uri, required - `html_url` string, uri, required - `members_url` string, required - `repositories_url` string, uri, required - `type` 'enterprise' | 'organization', required — The ownership type of the team - `access_source` 'direct' | 'organization' | 'enterprise' — How the team's access to the repository was granted. This property is only present when the team is returned in a repository context, such as `GET /repos/{owner}/{repo}/teams`. - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `parent` NullableTeamSimple, nullable, required — Groups of organization members that gives permissions on specified repositories. - `id` integer, required — Unique identifier of the team - `node_id` string, required - `url` string, uri, required — URL for the team - `members_url` string, required - `name` string, required — Name of the team - `description` string, nullable, required — Description of the team - `permission` string, required — Permission that the team will have for its repositories - `privacy` string — The level of privacy this team should have - `notification_setting` string — The notification setting the team has set - `html_url` string, uri, required - `repositories_url` string, uri, required - `slug` string, required - `ldap_dn` string — Distinguished Name (DN) that team maps to within LDAP environment - `type` 'enterprise' | 'organization', required — The ownership type of the team - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `apps` Integration[] - `id` integer, required — Unique identifier of the GitHub app - `slug` string — The slug name of the GitHub app - `node_id` string, required - `client_id` string - `owner` union, required - SimpleUser — A GitHub user. - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - Enterprise — An enterprise on GitHub. - `description` string, nullable — A short description of the enterprise. - `html_url` string, uri, required - `website_url` string, uri, nullable — The enterprise's website URL. - `id` integer, required — Unique identifier of the enterprise - `node_id` string, required - `name` string, required — The name of the enterprise. - `slug` string, required — The slug url identifier for the enterprise. - `created_at` string, date-time, nullable, required - `updated_at` string, date-time, nullable, required - `avatar_url` string, uri, required - `name` string, required — The name of the GitHub app - `description` string, nullable, required - `external_url` string, uri, required - `html_url` string, uri, required - `created_at` string, date-time, required - `updated_at` string, date-time, required - `permissions` object, required — The set of permissions for the GitHub app - `issues` string - `checks` string - `metadata` string - `contents` string - `deployments` string - `events` string[], required — The list of events for the GitHub app. Note that the `installation_target`, `security_advisory`, and `meta` events are not included because they are global events and not specific to an installation. - `installations_count` integer — The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself. - `bypass_pull_request_allowances` object - `users` SimpleUser[], required - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - `teams` Team[], required - `id` integer, required - `node_id` string, required - `name` string, required - `slug` string, required - `description` string, nullable, required - `privacy` string - `notification_setting` string - `permission` string, required - `permissions` object - `pull` boolean, required - `triage` boolean, required - `push` boolean, required - `maintain` boolean, required - `admin` boolean, required - `url` string, uri, required - `html_url` string, uri, required - `members_url` string, required - `repositories_url` string, uri, required - `type` 'enterprise' | 'organization', required — The ownership type of the team - `access_source` 'direct' | 'organization' | 'enterprise' — How the team's access to the repository was granted. This property is only present when the team is returned in a repository context, such as `GET /repos/{owner}/{repo}/teams`. - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `parent` NullableTeamSimple, nullable, required — Groups of organization members that gives permissions on specified repositories. - `id` integer, required — Unique identifier of the team - `node_id` string, required - `url` string, uri, required — URL for the team - `members_url` string, required - `name` string, required — Name of the team - `description` string, nullable, required — Description of the team - `permission` string, required — Permission that the team will have for its repositories - `privacy` string — The level of privacy this team should have - `notification_setting` string — The notification setting the team has set - `html_url` string, uri, required - `repositories_url` string, uri, required - `slug` string, required - `ldap_dn` string — Distinguished Name (DN) that team maps to within LDAP environment - `type` 'enterprise' | 'organization', required — The ownership type of the team - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `apps` Integration[] - `id` integer, required — Unique identifier of the GitHub app - `slug` string — The slug name of the GitHub app - `node_id` string, required - `client_id` string - `owner` union, required - SimpleUser — A GitHub user. - `name` string, nullable - `email` string, nullable - `login` string, required - `id` integer, required - `node_id` string, required - `avatar_url` string, uri, required - `gravatar_id` string, nullable, required - `url` string, uri, required - `html_url` string, uri, required - `followers_url` string, uri, required - `following_url` string, required - `gists_url` string, required - `starred_url` string, required - `subscriptions_url` string, uri, required - `organizations_url` string, uri, required - `repos_url` string, uri, required - `events_url` string, required - `received_events_url` string, uri, required - `type` string, required - `site_admin` boolean, required - `starred_at` string - `user_view_type` string - Enterprise — An enterprise on GitHub. - `description` string, nullable — A short description of the enterprise. - `html_url` string, uri, required - `website_url` string, uri, nullable — The enterprise's website URL. - `id` integer, required — Unique identifier of the enterprise - `node_id` string, required - `name` string, required — The name of the enterprise. - `slug` string, required — The slug url identifier for the enterprise. - `created_at` string, date-time, nullable, required - `updated_at` string, date-time, nullable, required - `avatar_url` string, uri, required - `name` string, required — The name of the GitHub app - `description` string, nullable, required - `external_url` string, uri, required - `html_url` string, uri, required - `created_at` string, date-time, required - `updated_at` string, date-time, required - `permissions` object, required — The set of permissions for the GitHub app - `issues` string - `checks` string - `metadata` string - `contents` string - `deployments` string - `events` string[], required — The list of events for the GitHub app. Note that the `installation_target`, `security_advisory`, and `meta` events are not included because they are global events and not specific to an installation. - `installations_count` integer — The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself. - `required_signatures` object - `url` string, uri, required - `enabled` boolean, required - `enforce_admins` object - `url` string, uri, required - `enabled` boolean, required - `required_linear_history` object - `enabled` boolean, required - `allow_force_pushes` object - `enabled` boolean, required - `allow_deletions` object - `enabled` boolean, required - `restrictions` BranchRestrictionPolicy — Branch Restriction Policy - `url` string, uri, required - `users_url` string, uri, required - `teams_url` string, uri, required - `apps_url` string, uri, required - `users` object[], required - `login` string - `id` integer - `node_id` string - `avatar_url` string - `gravatar_id` string - `url` string - `html_url` string - `followers_url` string - `following_url` string - `gists_url` string - `starred_url` string - `subscriptions_url` string - `organizations_url` string - `repos_url` string - `events_url` string - `received_events_url` string - `type` string - `site_admin` boolean - `user_view_type` string - `teams` Team[], required - `id` integer, required - `node_id` string, required - `name` string, required - `slug` string, required - `description` string, nullable, required - `privacy` string - `notification_setting` string - `permission` string, required - `permissions` object - `pull` boolean, required - `triage` boolean, required - `push` boolean, required - `maintain` boolean, required - `admin` boolean, required - `url` string, uri, required - `html_url` string, uri, required - `members_url` string, required - `repositories_url` string, uri, required - `type` 'enterprise' | 'organization', required — The ownership type of the team - `access_source` 'direct' | 'organization' | 'enterprise' — How the team's access to the repository was granted. This property is only present when the team is returned in a repository context, such as `GET /repos/{owner}/{repo}/teams`. - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `parent` NullableTeamSimple, nullable, required — Groups of organization members that gives permissions on specified repositories. - `id` integer, required — Unique identifier of the team - `node_id` string, required - `url` string, uri, required — URL for the team - `members_url` string, required - `name` string, required — Name of the team - `description` string, nullable, required — Description of the team - `permission` string, required — Permission that the team will have for its repositories - `privacy` string — The level of privacy this team should have - `notification_setting` string — The notification setting the team has set - `html_url` string, uri, required - `repositories_url` string, uri, required - `slug` string, required - `ldap_dn` string — Distinguished Name (DN) that team maps to within LDAP environment - `type` 'enterprise' | 'organization', required — The ownership type of the team - `organization_id` integer — Unique identifier of the organization to which this team belongs - `enterprise_id` integer — Unique identifier of the enterprise to which this team belongs - `apps` object[], required - `id` integer - `slug` string - `node_id` string - `owner` object - `login` string - `id` integer - `node_id` string - `url` string - `repos_url` string - `events_url` string - `hooks_url` string - `issues_url` string - `members_url` string - `public_members_url` string - `avatar_url` string - `description` string - `gravatar_id` string - `html_url` string - `followers_url` string - `following_url` string - `gists_url` string - `starred_url` string - `subscriptions_url` string - `organizations_url` string - `received_events_url` string - `type` string - `site_admin` boolean - `user_view_type` string - `name` string - `client_id` string - `description` string - `external_url` string - `html_url` string - `created_at` string - `updated_at` string - `permissions` object - `metadata` string - `contents` string - `issues` string - `single_file` string - `events` string[] - `required_conversation_resolution` object - `enabled` boolean - `block_creations` object - `enabled` boolean, required - `lock_branch` object — Whether to set the branch as read-only. If this is true, users will not be able to push to the branch. - `enabled` boolean - `allow_fork_syncing` object — Whether users can pull changes from upstream when the branch is locked. Set to `true` to allow fork syncing. Set to `false` to prevent fork syncing. - `enabled` boolean ## Other responses - `403` — Forbidden - `404` — Resource not found - `422` — Validation failed, or the endpoint has been spammed. --- [API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)