GitHub: Set app access restrictions

← Repos operations · Get started

Operation github.repos_set_app_access_restrictions

Provider route: PUT /repos/{owner}/{repo}/branches/{branch}/protection/restrictions/apps. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["repos"]["reposSetAppAccessRestrictions"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.repos.reposSetAppAccessRestrictions(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.repos.repos_set_app_access_restrictions(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.branch	string	Required within parent
body	object	Required within parent
body.apps	array	Required within parent	The GitHub Apps that have push access to this branch. Use the slugified version of the app name. Note: The list of users, apps, and teams in total is limited to 100 items.
body.apps[]	string	Each item

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	array	Root
$[]	Model	Each item	Expand Get an app — response body

Referenced models: Get an app — response body

Schemas

Get an app — response body

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.
$ (anyOf 1).client_id	string	Optional
$ (anyOf 1).created_at	string	Required within parent	Format: date-time
$ (anyOf 1).description	JSON	Required within parent
$ (anyOf 1).description (anyOf 1)	string	Alternative
$ (anyOf 1).description (anyOf 2)	null	Alternative
$ (anyOf 1).events	array	Required within parent	The list of events for the GitHub app. Note that the `installation_target`, `security_advisory`, and `meta` events are not included because they are global events and not specific to an installation.
$ (anyOf 1).events[]	string	Each item
$ (anyOf 1).external_url	string	Required within parent	Format: uri
$ (anyOf 1).html_url	string	Required within parent	Format: uri
$ (anyOf 1).id	JSON	Required within parent
$ (anyOf 1).id (anyOf 1)	integer	Alternative	Unique identifier of the GitHub app
$ (anyOf 1).id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).installations_count	JSON	Optional
$ (anyOf 1).installations_count (anyOf 1)	integer	Alternative	The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself.
$ (anyOf 1).installations_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).name	string	Required within parent	The name of the GitHub app
$ (anyOf 1).node_id	string	Required within parent
$ (anyOf 1).owner	JSON	Required within parent
$ (anyOf 1).owner (anyOf 1)	Model	Alternative	Expand List users — response body — item
$ (anyOf 1).owner (anyOf 2)	Model	Alternative	Expand Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise
$ (anyOf 1).permissions	object	Required within parent	The set of permissions for the GitHub app Additional keys: see wildcard field
$ (anyOf 1).permissions.checks	string	Optional
$ (anyOf 1).permissions.contents	string	Optional
$ (anyOf 1).permissions.deployments	string	Optional
$ (anyOf 1).permissions.issues	string	Optional
$ (anyOf 1).permissions.metadata	string	Optional
$ (anyOf 1).permissions.*	string	Additional keys
$ (anyOf 1).slug	string	Optional	The slug name of the GitHub app
$ (anyOf 1).updated_at	string	Required within parent	Format: date-time
$ (anyOf 2)	null	Alternative

Referenced models: Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise, List users — response body — item

Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise

Field	Type	Presence	Description and constraints
$	object	Root	An enterprise on GitHub.
avatar_url	string	Required within parent	Format: uri
created_at	JSON	Required within parent
created_at (anyOf 1)	string	Alternative	Format: date-time
created_at (anyOf 2)	null	Alternative
description	JSON	Optional
description (anyOf 1)	string	Alternative	A short description of the enterprise.
description (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Unique identifier of the enterprise
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
name	string	Required within parent	The name of the enterprise.
node_id	string	Required within parent
slug	string	Required within parent	The slug url identifier for the enterprise.
updated_at	JSON	Required within parent
updated_at (anyOf 1)	string	Alternative	Format: date-time
updated_at (anyOf 2)	null	Alternative
website_url	JSON	Optional
website_url (anyOf 1)	string	Alternative	The enterprise's website URL. Format: uri
website_url (anyOf 2)	null	Alternative

List users — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	A GitHub user.
avatar_url	string	Required within parent	Format: uri
email	JSON	Optional
email (anyOf 1)	string	Alternative
email (anyOf 2)	null	Alternative
events_url	string	Required within parent
followers_url	string	Required within parent	Format: uri
following_url	string	Required within parent
gists_url	string	Required within parent
gravatar_id	JSON	Required within parent
gravatar_id (anyOf 1)	string	Alternative
gravatar_id (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Format: int64
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
login	string	Required within parent
name	JSON	Optional
name (anyOf 1)	string	Alternative
name (anyOf 2)	null	Alternative
node_id	string	Required within parent
organizations_url	string	Required within parent	Format: uri
received_events_url	string	Required within parent	Format: uri
repos_url	string	Required within parent	Format: uri
site_admin	boolean	Required within parent
starred_at	string	Optional
starred_url	string	Required within parent
subscriptions_url	string	Required within parent	Format: uri
type	string	Required within parent
url	string	Required within parent	Format: uri
user_view_type	string	Optional

Policy, approvals and errors

SDK function policy ID: github.repos_set_app_access_restrictions. Catalog operation: repos/set-app-access-restrictions. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source