GitHub: Update branch protection

← Repos operations · Get started

Operation github.repos_update_branch_protection

Provider route: PUT /repos/{owner}/{repo}/branches/{branch}/protection. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["repos"]["reposUpdateBranchProtection"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.repos.reposUpdateBranchProtection(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.repos.repos_update_branch_protection(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.branch	string	Required within parent
body	object	Required within parent
body.allow_deletions	boolean	Optional	Allows deletion of the protected branch by anyone with write access to the repository. Set to `false` to prevent deletion of the protected branch. Default: `false`. For more information, see “[Enabling force pushes to a protected branch](https://docs.github.com/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)” in the GitHub Help documentation.
body.allow_force_pushes	JSON	Optional
body.allow_force_pushes (anyOf 1)	boolean	Alternative	Permits force pushes to the protected branch by anyone with write access to the repository. Set to `true` to allow force pushes. Set to `false` or `null` to block force pushes. Default: `false`. For more information, see “[Enabling force pushes to a protected branch](https://docs.github.com/github/administering-a-repository/enabling-force-pushes-to-a-protected-branch)” in the GitHub Help documentation.”
body.allow_force_pushes (anyOf 2)	null	Alternative
body.allow_fork_syncing	boolean	Optional	Whether users can pull changes from upstream when the branch is locked. Set to `true` to allow fork syncing. Set to `false` to prevent fork syncing. Default: `false`. Default: false
body.block_creations	boolean	Optional	If set to `true`, the `restrictions` branch protection settings which limits who can push will also block pushes which create new branches, unless the push is initiated by a user, team, or app which has the ability to push. Set to `true` to restrict new branch creation. Default: `false`.
body.enforce_admins	JSON	Required within parent
body.enforce_admins (anyOf 1)	boolean	Alternative	Enforce all configured restrictions for administrators. Set to `true` to enforce required status checks for repository administrators. Set to `null` to disable.
body.enforce_admins (anyOf 2)	null	Alternative
body.lock_branch	boolean	Optional	Whether to set the branch as read-only. If this is true, users will not be able to push to the branch. Default: `false`. Default: false
body.required_conversation_resolution	boolean	Optional	Requires all conversations on code to be resolved before a pull request can be merged into a branch that matches this rule. Set to `false` to disable. Default: `false`.
body.required_linear_history	boolean	Optional	Enforces a linear commit Git history, which prevents anyone from pushing merge commits to a branch. Set to `true` to enforce a linear commit history. Set to `false` to disable a linear commit Git history. Your repository must allow squash merging or rebase merging before you can enable a linear commit history. Default: `false`. For more information, see “[Requiring a linear commit history](https://docs.github.com/github/administering-a-repository/requiring-a-linear-commit-history)” in the GitHub Help documentation.
body.required_pull_request_reviews	JSON	Required within parent
body.required_pull_request_reviews (anyOf 1)	object	Alternative	Require at least one approving review on a pull request, before merging. Set to `null` to disable.
body.required_pull_request_reviews (anyOf 1).bypass_pull_request_allowances	Model	Optional	Expand Update pull request review protection — request body — body bypass pull request allowances
body.required_pull_request_reviews (anyOf 1).dismiss_stale_reviews	boolean	Optional	Set to `true` if you want to automatically dismiss approving reviews when someone pushes a new commit.
body.required_pull_request_reviews (anyOf 1).dismissal_restrictions	Model	Optional	Expand Update pull request review protection — request body — body dismissal restrictions
body.required_pull_request_reviews (anyOf 1).require_code_owner_reviews	boolean	Optional	Blocks merging pull requests until [code owners](https://docs.github.com/articles/about-code-owners/) review them.
body.required_pull_request_reviews (anyOf 1).require_last_push_approval	boolean	Optional	Whether the most recent push must be approved by someone other than the person who pushed it. Default: `false`. Default: false
body.required_pull_request_reviews (anyOf 1).required_approving_review_count	integer	Optional	Specify the number of reviewers required to approve pull requests. Use a number between 1 and 6 or 0 to not require reviewers.
body.required_pull_request_reviews (anyOf 2)	null	Alternative
body.required_status_checks	JSON	Required within parent
body.required_status_checks (anyOf 1)	object	Alternative	Require status checks to pass before merging. Set to `null` to disable.
body.required_status_checks (anyOf 1).checks	array	Optional	The list of status checks to require in order to merge into this branch.
body.required_status_checks (anyOf 1).checks[]	object	Each item
body.required_status_checks (anyOf 1).checks[].app_id	integer	Optional	The ID of the GitHub App that must provide this check. Omit this field to automatically select the GitHub App that has recently provided this check, or any app if it was not set by a GitHub App. Pass -1 to explicitly allow any app to set the status.
body.required_status_checks (anyOf 1).checks[].context	string	Required within parent	The name of the required check
body.required_status_checks (anyOf 1).contexts	array	Required within parent	Closing down notice: The list of status checks to require in order to merge into this branch. If any of these checks have recently been set by a particular GitHub App, they will be required to come from that app in future for the branch to merge. Use `checks` instead of `contexts` for more fine-grained control.
body.required_status_checks (anyOf 1).contexts[]	string	Each item
body.required_status_checks (anyOf 1).strict	boolean	Required within parent	Require branches to be up to date before merging.
body.required_status_checks (anyOf 2)	null	Alternative
body.restrictions	JSON	Required within parent
body.restrictions (anyOf 1)	object	Alternative	Restrict who can push to the protected branch. User, app, and team `restrictions` are only available for organization-owned repositories. Set to `null` to disable.
body.restrictions (anyOf 1).apps	array	Optional	The list of app `slug`s with push access
body.restrictions (anyOf 1).apps[]	string	Each item
body.restrictions (anyOf 1).teams	array	Required within parent	The list of team `slug`s with push access
body.restrictions (anyOf 1).teams[]	string	Each item
body.restrictions (anyOf 1).users	array	Required within parent	The list of user `login`s with push access
body.restrictions (anyOf 1).users[]	string	Each item
body.restrictions (anyOf 2)	null	Alternative

Referenced models: Update pull request review protection — request body — body bypass pull request allowances, Update pull request review protection — request body — body dismissal restrictions

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Update branch protection — response body

Referenced models: Update branch protection — response body

Schemas

6 more schemas are linked from the tables above, on the schema pages.

Update branch protection — response body

Field	Type	Presence	Description and constraints
$	object	Root	Branch protections protect branches
allow_deletions	object	Optional	Additional keys: not allowed
allow_deletions.enabled	boolean	Required within parent
allow_force_pushes	object	Optional	Additional keys: not allowed
allow_force_pushes.enabled	boolean	Required within parent
allow_fork_syncing	object	Optional	Whether users can pull changes from upstream when the branch is locked. Set to `true` to allow fork syncing. Set to `false` to prevent fork syncing. Additional keys: not allowed
allow_fork_syncing.enabled	boolean	Optional	Default: false
block_creations	object	Optional	Additional keys: not allowed
block_creations.enabled	boolean	Required within parent
enforce_admins	object	Optional	Additional keys: not allowed
enforce_admins.enabled	boolean	Required within parent
enforce_admins.url	string	Required within parent	Format: uri
lock_branch	object	Optional	Whether to set the branch as read-only. If this is true, users will not be able to push to the branch. Additional keys: not allowed
lock_branch.enabled	boolean	Optional	Default: false
required_conversation_resolution	object	Optional	Additional keys: not allowed
required_conversation_resolution.enabled	boolean	Optional
required_linear_history	object	Optional	Additional keys: not allowed
required_linear_history.enabled	boolean	Required within parent
required_pull_request_reviews	object	Optional
required_pull_request_reviews.bypass_pull_request_allowances	object	Optional
required_pull_request_reviews.bypass_pull_request_allowances.apps	array	Optional
required_pull_request_reviews.bypass_pull_request_allowances.apps[]	Model	Each item	Expand Get an app — response body
required_pull_request_reviews.bypass_pull_request_allowances.teams	array	Required within parent
required_pull_request_reviews.bypass_pull_request_allowances.teams[]	Model	Each item	Expand List teams — response body — item
required_pull_request_reviews.bypass_pull_request_allowances.users	array	Required within parent
required_pull_request_reviews.bypass_pull_request_allowances.users[]	Model	Each item	Expand List users — response body — item
required_pull_request_reviews.dismiss_stale_reviews	boolean	Optional
required_pull_request_reviews.dismissal_restrictions	object	Optional
required_pull_request_reviews.dismissal_restrictions.apps	array	Optional
required_pull_request_reviews.dismissal_restrictions.apps[]	Model	Each item	Expand Get an app — response body
required_pull_request_reviews.dismissal_restrictions.teams	array	Required within parent
required_pull_request_reviews.dismissal_restrictions.teams[]	Model	Each item	Expand List teams — response body — item
required_pull_request_reviews.dismissal_restrictions.teams_url	string	Required within parent	Format: uri
required_pull_request_reviews.dismissal_restrictions.url	string	Required within parent	Format: uri
required_pull_request_reviews.dismissal_restrictions.users	array	Required within parent
required_pull_request_reviews.dismissal_restrictions.users[]	Model	Each item	Expand List users — response body — item
required_pull_request_reviews.dismissal_restrictions.users_url	string	Required within parent	Format: uri
required_pull_request_reviews.require_code_owner_reviews	boolean	Optional
required_pull_request_reviews.require_last_push_approval	boolean	Optional	Whether the most recent push must be approved by someone other than the person who pushed it. Default: false
required_pull_request_reviews.required_approving_review_count	JSON	Optional
required_pull_request_reviews.required_approving_review_count (anyOf 1)	integer	Alternative
required_pull_request_reviews.required_approving_review_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
required_pull_request_reviews.url	string	Required within parent	Format: uri
required_signatures	object	Optional
required_signatures.enabled	boolean	Required within parent
required_signatures.url	string	Required within parent	Format: uri
required_status_checks	Model	Optional	Expand Get status checks protection — response body
restrictions	Model	Optional	Expand Get access restrictions — response body
url	string	Required within parent	Format: uri

Referenced models: Get access restrictions — response body, Get an app — response body, List users — response body — item, Get status checks protection — response body, List teams — response body — item

Update pull request review protection — request body — body bypass pull request allowances

Field	Type	Presence	Description and constraints
$	object	Root	Allow specific users, teams, or apps to bypass pull request requirements.
apps	array	Optional	The list of app `slug`s allowed to bypass pull request requirements.
apps[]	string	Each item
teams	array	Optional	The list of team `slug`s allowed to bypass pull request requirements.
teams[]	string	Each item
users	array	Optional	The list of user `login`s allowed to bypass pull request requirements.
users[]	string	Each item

Update pull request review protection — request body — body dismissal restrictions

Field	Type	Presence	Description and constraints
$	object	Root	Specify which users, teams, and apps can dismiss pull request reviews. Pass an empty `dismissal_restrictions` object to disable. User and team `dismissal_restrictions` are only available for organization-owned repositories. Omit this parameter for personal repositories.
apps	array	Optional	The list of app `slug`s with dismissal access
apps[]	string	Each item
teams	array	Optional	The list of team `slug`s with dismissal access
teams[]	string	Each item
users	array	Optional	The list of user `login`s with dismissal access
users[]	string	Each item

List users — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	A GitHub user.
avatar_url	string	Required within parent	Format: uri
email	JSON	Optional
email (anyOf 1)	string	Alternative
email (anyOf 2)	null	Alternative
events_url	string	Required within parent
followers_url	string	Required within parent	Format: uri
following_url	string	Required within parent
gists_url	string	Required within parent
gravatar_id	JSON	Required within parent
gravatar_id (anyOf 1)	string	Alternative
gravatar_id (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Format: int64
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
login	string	Required within parent
name	JSON	Optional
name (anyOf 1)	string	Alternative
name (anyOf 2)	null	Alternative
node_id	string	Required within parent
organizations_url	string	Required within parent	Format: uri
received_events_url	string	Required within parent	Format: uri
repos_url	string	Required within parent	Format: uri
site_admin	boolean	Required within parent
starred_at	string	Optional
starred_url	string	Required within parent
subscriptions_url	string	Required within parent	Format: uri
type	string	Required within parent
url	string	Required within parent	Format: uri
user_view_type	string	Optional

Create a team — response body — parent

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	Model	Alternative	Expand Create a team — response body — parent / type: enterprise, organization
$ (anyOf 2)	null	Alternative

Referenced models: Create a team — response body — parent / type: enterprise, organization

Policy, approvals and errors

SDK function policy ID: github.repos_update_branch_protection. Catalog operation: repos/update-branch-protection. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source