2020-07-30 12:09:33 +00:00
---
stage: Create
group: Source Code
2020-11-26 06:09:20 +00:00
info: "To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments"
2020-07-30 12:09:33 +00:00
type: reference, api
---
2021-02-09 18:09:59 +00:00
# Protected branches API **(FREE)**
2017-08-02 10:16:17 +00:00
2020-07-23 18:10:06 +00:00
> Introduced in GitLab 9.5.
2017-08-02 10:16:17 +00:00
**Valid access levels**
2018-08-28 16:30:38 +00:00
The access levels are defined in the `ProtectedRefAccess.allowed_access_levels` method. Currently, these levels are recognized:
2019-02-15 09:39:23 +00:00
2020-02-28 00:09:08 +00:00
```plaintext
2017-08-02 10:16:17 +00:00
0 => No access
30 => Developer access
2018-05-22 10:16:06 +00:00
40 => Maintainer access
2019-07-03 09:32:54 +00:00
60 => Admin access
2017-08-02 10:16:17 +00:00
```
## List protected branches
2021-06-01 18:10:04 +00:00
Gets a list of protected branches from a project as they are defined [in the UI ](../user/project/protected_branches.md#configure-a-protected-branch ). If a wildcard is set, it is returned instead of the exact name of the branches that match that wildcard.
2017-08-02 10:16:17 +00:00
2020-02-28 00:09:08 +00:00
```plaintext
2017-08-02 10:16:17 +00:00
GET /projects/:id/protected_branches
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer/string | yes | The ID or [URL-encoded path of the project ](README.md#namespaced-path-encoding ) owned by the authenticated user |
2020-02-10 15:08:54 +00:00
| `search` | string | no | Name or part of the name of protected branches to be searched for |
2017-08-02 10:16:17 +00:00
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches"
2017-08-02 10:16:17 +00:00
```
Example response:
```json
[
{
2020-01-20 15:09:18 +00:00
"id": 1,
2017-08-02 10:16:17 +00:00
"name": "master",
"push_access_levels": [
{
"access_level": 40,
2018-05-22 10:16:06 +00:00
"access_level_description": "Maintainers"
2017-08-02 10:16:17 +00:00
}
],
"merge_access_levels": [
{
"access_level": 40,
2018-05-22 10:16:06 +00:00
"access_level_description": "Maintainers"
2017-08-02 10:16:17 +00:00
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2017-08-02 10:16:17 +00:00
},
2021-06-01 18:10:04 +00:00
{
"id": 1,
"name": "release/*",
"push_access_levels": [
{
"access_level": 40,
"access_level_description": "Maintainers"
}
],
"merge_access_levels": [
{
"access_level": 40,
"access_level_description": "Maintainers"
}
],
"allow_force_push":false,
"code_owner_approval_required": false
},
2017-08-02 10:16:17 +00:00
...
]
```
2021-02-03 15:09:24 +00:00
Users on GitLab Premium or higher also see
2019-07-03 09:32:54 +00:00
the `user_id` and `group_id` parameters:
Example response:
```json
[
{
2020-01-20 15:09:18 +00:00
"id": 1,
2019-07-03 09:32:54 +00:00
"name": "master",
"push_access_levels": [
{
"access_level": 40,
"user_id": null,
"group_id": null,
"access_level_description": "Maintainers"
}
],
"merge_access_levels": [
{
"access_level": null,
"user_id": null,
"group_id": 1234,
"access_level_description": "Example Merge Group"
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2019-07-03 09:32:54 +00:00
},
...
]
```
2017-08-02 10:16:17 +00:00
## Get a single protected branch or wildcard protected branch
Gets a single protected branch or wildcard protected branch.
2020-02-28 00:09:08 +00:00
```plaintext
2017-08-02 10:16:17 +00:00
GET /projects/:id/protected_branches/:name
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer/string | yes | The ID or [URL-encoded path of the project ](README.md#namespaced-path-encoding ) owned by the authenticated user |
| `name` | string | yes | The name of the branch or wildcard |
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches/master"
2017-08-02 10:16:17 +00:00
```
Example response:
```json
{
2020-01-20 15:09:18 +00:00
"id": 1,
2017-08-02 10:16:17 +00:00
"name": "master",
"push_access_levels": [
{
"access_level": 40,
2018-05-22 10:16:06 +00:00
"access_level_description": "Maintainers"
2017-08-02 10:16:17 +00:00
}
],
"merge_access_levels": [
{
"access_level": 40,
2018-05-22 10:16:06 +00:00
"access_level_description": "Maintainers"
2017-08-02 10:16:17 +00:00
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2017-08-02 10:16:17 +00:00
}
```
2021-02-03 15:09:24 +00:00
Users on GitLab Premium or higher also see
2019-07-03 09:32:54 +00:00
the `user_id` and `group_id` parameters:
Example response:
```json
{
2020-01-20 15:09:18 +00:00
"id": 1,
2019-07-03 09:32:54 +00:00
"name": "master",
"push_access_levels": [
{
"access_level": 40,
"user_id": null,
"group_id": null,
"access_level_description": "Maintainers"
}
],
"merge_access_levels": [
{
"access_level": null,
"user_id": null,
"group_id": 1234,
"access_level_description": "Example Merge Group"
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2019-07-03 09:32:54 +00:00
}
```
2017-08-02 10:16:17 +00:00
## Protect repository branches
Protects a single repository branch or several project repository
branches using a wildcard protected branch.
2020-02-28 00:09:08 +00:00
```plaintext
2017-08-02 10:16:17 +00:00
POST /projects/:id/protected_branches
```
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --request POST --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches?name=*-stable& push_access_level=30& merge_access_level=30& unprotect_access_level=40"
2017-08-02 10:16:17 +00:00
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
2019-09-19 06:06:09 +00:00
| `id` | integer/string | yes | The ID or [URL-encoded path of the project ](README.md#namespaced-path-encoding ) owned by the authenticated user |
| `name` | string | yes | The name of the branch or wildcard |
2021-05-31 18:09:56 +00:00
| `push_access_level` | string | no | Access levels allowed to push (defaults: `40` , Maintainer role) |
| `merge_access_level` | string | no | Access levels allowed to merge (defaults: `40` , Maintainer role) |
| `unprotect_access_level` | string | no | Access levels allowed to unprotect (defaults: `40` , Maintainer role) |
2021-06-08 09:09:56 +00:00
| `allow_force_push` | boolean | no | Allow all users with push access to force push. (default: `false` ) |
2021-02-03 15:09:24 +00:00
| `allowed_to_push` | array | no | ** (PREMIUM)** Array of access levels allowed to push, with each described by a hash |
| `allowed_to_merge` | array | no | ** (PREMIUM)** Array of access levels allowed to merge, with each described by a hash |
| `allowed_to_unprotect` | array | no | ** (PREMIUM)** Array of access levels allowed to unprotect, with each described by a hash |
2019-09-19 06:06:09 +00:00
| `code_owner_approval_required` | boolean | no | ** (PREMIUM)** Prevent pushes to this branch if it matches an item in the [`CODEOWNERS` file ](../user/project/code_owners.md ). (defaults: false) |
2019-07-03 09:32:54 +00:00
Example response:
```json
{
2020-01-20 15:09:18 +00:00
"id": 1,
2019-07-03 09:32:54 +00:00
"name": "*-stable",
"push_access_levels": [
{
"access_level": 30,
"access_level_description": "Developers + Maintainers"
}
],
"merge_access_levels": [
{
"access_level": 30,
"access_level_description": "Developers + Maintainers"
2019-08-22 08:50:31 +00:00
}
2019-07-03 09:32:54 +00:00
],
"unprotect_access_levels": [
{
"access_level": 40,
"access_level_description": "Maintainers"
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2019-07-03 09:32:54 +00:00
}
```
2021-02-03 15:09:24 +00:00
Users on GitLab Premium or higher also see
2019-07-03 09:32:54 +00:00
the `user_id` and `group_id` parameters:
2017-08-02 10:16:17 +00:00
Example response:
```json
{
2020-01-20 15:09:18 +00:00
"id": 1,
2017-08-02 10:16:17 +00:00
"name": "*-stable",
"push_access_levels": [
{
"access_level": 30,
2019-07-03 09:32:54 +00:00
"user_id": null,
"group_id": null,
2018-05-22 11:54:50 +00:00
"access_level_description": "Developers + Maintainers"
2017-08-02 10:16:17 +00:00
}
],
"merge_access_levels": [
{
"access_level": 30,
2019-07-03 09:32:54 +00:00
"user_id": null,
"group_id": null,
2018-05-22 11:54:50 +00:00
"access_level_description": "Developers + Maintainers"
2019-08-22 08:50:31 +00:00
}
2019-07-03 09:32:54 +00:00
],
"unprotect_access_levels": [
{
"access_level": 40,
"user_id": null,
"group_id": null,
"access_level_description": "Maintainers"
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2019-07-03 09:32:54 +00:00
}
```
2021-02-03 15:09:24 +00:00
### Example with user / group level access **(PREMIUM)**
2019-07-03 09:32:54 +00:00
Elements in the `allowed_to_push` / `allowed_to_merge` / `allowed_to_unprotect` array should take the
2020-09-07 15:09:04 +00:00
form `{user_id: integer}` , `{group_id: integer}` or `{access_level: integer}` . Each user must have access to the project and each group must [have this project shared ](../user/project/members/share_project_with_groups.md ). These access levels allow [more granular control over protected branch access ](../user/project/protected_branches.md#restricting-push-and-merge-access-to-certain-users ) and were [added to the API ](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/3516 ) in GitLab 10.3 EE.
2019-07-03 09:32:54 +00:00
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --request POST --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches?name=*-stable& allowed_to_push%5B%5D%5Buser_id%5D=1"
2019-07-03 09:32:54 +00:00
```
Example response:
```json
{
2020-01-20 15:09:18 +00:00
"id": 1,
2019-08-22 08:50:31 +00:00
"name": "*-stable",
2019-07-03 09:32:54 +00:00
"push_access_levels": [
{
2019-08-22 08:50:31 +00:00
"access_level": null,
"user_id": 1,
"group_id": null,
"access_level_description": "Administrator"
2019-07-03 09:32:54 +00:00
}
],
"merge_access_levels": [
{
2019-08-22 08:50:31 +00:00
"access_level": 40,
"user_id": null,
"group_id": null,
"access_level_description": "Maintainers"
2019-07-03 09:32:54 +00:00
}
],
"unprotect_access_levels": [
{
2019-08-22 08:50:31 +00:00
"access_level": 40,
"user_id": null,
"group_id": null,
"access_level_description": "Maintainers"
2017-08-02 10:16:17 +00:00
}
2019-09-19 06:06:09 +00:00
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
"code_owner_approval_required": false
2017-08-02 10:16:17 +00:00
}
```
2021-02-03 15:09:24 +00:00
### Example with allow to push and allow to merge access **(PREMIUM)**
> Moved to GitLab Premium in 13.9.
2020-10-12 12:08:37 +00:00
Example request:
```shell
curl --request POST \
--header "PRIVATE-TOKEN: < your_access_token > " \
--header "Content-Type: application/json" \
--data '{
"id": 5,
"name": "master",
"allowed_to_push": [{"access_level": 30}],
"allowed_to_merge": [{
"access_level": 30
},{
"access_level": 40
}
]}'
"https://gitlab.example.com/api/v4/projects/5/protected_branches"
```
Example response:
```json
{
"id": 5,
"name": "master",
"push_access_levels": [
{
"access_level": 30,
"access_level_description": "Developers + Maintainers",
"user_id": null,
"group_id": null
}
],
"merge_access_levels": [
{
"access_level": 30,
"access_level_description": "Developers + Maintainers",
"user_id": null,
"group_id": null
},
{
"access_level": 40,
"access_level_description": "Maintainers",
"user_id": null,
"group_id": null
}
],
"unprotect_access_levels": [
{
"access_level": 40,
"access_level_description": "Maintainers",
"user_id": null,
"group_id": null
}
],
2021-03-11 18:09:23 +00:00
"allow_force_push":false,
2020-10-12 12:08:37 +00:00
"code_owner_approval_required": false
}
```
2017-08-02 10:16:17 +00:00
## Unprotect repository branches
Unprotects the given protected branch or wildcard protected branch.
2020-02-28 00:09:08 +00:00
```plaintext
2017-08-02 10:16:17 +00:00
DELETE /projects/:id/protected_branches/:name
```
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --request DELETE --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches/*-stable"
2017-08-02 10:16:17 +00:00
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer/string | yes | The ID or [URL-encoded path of the project ](README.md#namespaced-path-encoding ) owned by the authenticated user |
| `name` | string | yes | The name of the branch |
2019-10-09 00:06:06 +00:00
## Require code owner approvals for a single branch
2021-01-21 18:09:11 +00:00
Update the "code owner approval required" option for the given protected branch.
2019-10-09 00:06:06 +00:00
2020-02-28 00:09:08 +00:00
```plaintext
2019-10-09 00:06:06 +00:00
PATCH /projects/:id/protected_branches/:name
```
2020-01-30 15:09:15 +00:00
```shell
2020-05-28 00:08:37 +00:00
curl --request PATCH --header "PRIVATE-TOKEN: < your_access_token > " "https://gitlab.example.com/api/v4/projects/5/protected_branches/feature-branch"
2019-10-09 00:06:06 +00:00
```
| Attribute | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `id` | integer/string | yes | The ID or [URL-encoded path of the project ](README.md#namespaced-path-encoding ) owned by the authenticated user |
| `name` | string | yes | The name of the branch |
| `code_owner_approval_required` | boolean | no | ** (PREMIUM)** Prevent pushes to this branch if it matches an item in the [`CODEOWNERS` file ](../user/project/code_owners.md ). (defaults: false)|