GitHub: Update pull request review protection

← Repos operations · Get started

Operation github.repos_update_pull_request_review_protection

Provider route: PATCH /repos/{owner}/{repo}/branches/{branch}/protection/required_pull_request_reviews. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["repos"]["reposUpdatePullRequestReviewProtection"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.repos.reposUpdatePullRequestReviewProtection(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.repos.repos_update_pull_request_review_protection(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
path.branch	string	Required within parent
body	object	Optional
body.bypass_pull_request_allowances	Model	Optional	Expand Update pull request review protection — request body — body bypass pull request allowances
body.dismiss_stale_reviews	boolean	Optional	Set to `true` if you want to automatically dismiss approving reviews when someone pushes a new commit.
body.dismissal_restrictions	Model	Optional	Expand Update pull request review protection — request body — body dismissal restrictions
body.require_code_owner_reviews	boolean	Optional	Blocks merging pull requests until [code owners](https://docs.github.com/articles/about-code-owners/) have reviewed.
body.require_last_push_approval	boolean	Optional	Whether the most recent push must be approved by someone other than the person who pushed it. Default: `false` Default: false
body.required_approving_review_count	integer	Optional	Specifies the number of reviewers required to approve pull requests. Use a number between 1 and 6 or 0 to not require reviewers.

Referenced models: Update pull request review protection — request body — body bypass pull request allowances, Update pull request review protection — request body — body dismissal restrictions

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Get pull request review protection — response body

Referenced models: Get pull request review protection — response body

Schemas

4 more schemas are linked from the tables above, on the schema pages.

Get pull request review protection — response body

Field	Type	Presence	Description and constraints
$	object	Root	Protected Branch Pull Request Review
bypass_pull_request_allowances	object	Optional	Allow specific users, teams, or apps to bypass pull request requirements.
bypass_pull_request_allowances.apps	array	Optional	The list of apps allowed to bypass pull request requirements.
bypass_pull_request_allowances.apps[]	Model	Each item	Expand Get an app — response body
bypass_pull_request_allowances.teams	array	Optional	The list of teams allowed to bypass pull request requirements.
bypass_pull_request_allowances.teams[]	Model	Each item	Expand List teams — response body — item
bypass_pull_request_allowances.users	array	Optional	The list of users allowed to bypass pull request requirements.
bypass_pull_request_allowances.users[]	Model	Each item	Expand List users — response body — item
dismiss_stale_reviews	boolean	Required within parent
dismissal_restrictions	object	Optional
dismissal_restrictions.apps	array	Optional	The list of apps with review dismissal access.
dismissal_restrictions.apps[]	Model	Each item	Expand Get an app — response body
dismissal_restrictions.teams	array	Optional	The list of teams with review dismissal access.
dismissal_restrictions.teams[]	Model	Each item	Expand List teams — response body — item
dismissal_restrictions.teams_url	string	Optional
dismissal_restrictions.url	string	Optional
dismissal_restrictions.users	array	Optional	The list of users with review dismissal access.
dismissal_restrictions.users[]	Model	Each item	Expand List users — response body — item
dismissal_restrictions.users_url	string	Optional
require_code_owner_reviews	boolean	Required within parent
require_last_push_approval	boolean	Optional	Whether the most recent push must be approved by someone other than the person who pushed it. Default: false
required_approving_review_count	JSON	Optional
required_approving_review_count (anyOf 1)	integer	Alternative	Maximum: 6 Minimum: 0
required_approving_review_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
url	string	Optional	Format: uri

Referenced models: Get an app — response body, List users — response body — item, List teams — response body — item

Update pull request review protection — request body — body bypass pull request allowances

Field	Type	Presence	Description and constraints
$	object	Root	Allow specific users, teams, or apps to bypass pull request requirements.
apps	array	Optional	The list of app `slug`s allowed to bypass pull request requirements.
apps[]	string	Each item
teams	array	Optional	The list of team `slug`s allowed to bypass pull request requirements.
teams[]	string	Each item
users	array	Optional	The list of user `login`s allowed to bypass pull request requirements.
users[]	string	Each item

Update pull request review protection — request body — body dismissal restrictions

Field	Type	Presence	Description and constraints
$	object	Root	Specify which users, teams, and apps can dismiss pull request reviews. Pass an empty `dismissal_restrictions` object to disable. User and team `dismissal_restrictions` are only available for organization-owned repositories. Omit this parameter for personal repositories.
apps	array	Optional	The list of app `slug`s with dismissal access
apps[]	string	Each item
teams	array	Optional	The list of team `slug`s with dismissal access
teams[]	string	Each item
users	array	Optional	The list of user `login`s with dismissal access
users[]	string	Each item

Get an app — response body

Field	Type	Presence	Description and constraints
$	JSON	Root
$ (anyOf 1)	object	Alternative	GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.
$ (anyOf 1).client_id	string	Optional
$ (anyOf 1).created_at	string	Required within parent	Format: date-time
$ (anyOf 1).description	JSON	Required within parent
$ (anyOf 1).description (anyOf 1)	string	Alternative
$ (anyOf 1).description (anyOf 2)	null	Alternative
$ (anyOf 1).events	array	Required within parent	The list of events for the GitHub app. Note that the `installation_target`, `security_advisory`, and `meta` events are not included because they are global events and not specific to an installation.
$ (anyOf 1).events[]	string	Each item
$ (anyOf 1).external_url	string	Required within parent	Format: uri
$ (anyOf 1).html_url	string	Required within parent	Format: uri
$ (anyOf 1).id	JSON	Required within parent
$ (anyOf 1).id (anyOf 1)	integer	Alternative	Unique identifier of the GitHub app
$ (anyOf 1).id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).installations_count	JSON	Optional
$ (anyOf 1).installations_count (anyOf 1)	integer	Alternative	The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself.
$ (anyOf 1).installations_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
$ (anyOf 1).name	string	Required within parent	The name of the GitHub app
$ (anyOf 1).node_id	string	Required within parent
$ (anyOf 1).owner	JSON	Required within parent
$ (anyOf 1).owner (anyOf 1)	Model	Alternative	Expand List users — response body — item
$ (anyOf 1).owner (anyOf 2)	Model	Alternative	Expand Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise
$ (anyOf 1).permissions	object	Required within parent	The set of permissions for the GitHub app Additional keys: see wildcard field
$ (anyOf 1).permissions.checks	string	Optional
$ (anyOf 1).permissions.contents	string	Optional
$ (anyOf 1).permissions.deployments	string	Optional
$ (anyOf 1).permissions.issues	string	Optional
$ (anyOf 1).permissions.metadata	string	Optional
$ (anyOf 1).permissions.*	string	Additional keys
$ (anyOf 1).slug	string	Optional	The slug name of the GitHub app
$ (anyOf 1).updated_at	string	Required within parent	Format: date-time
$ (anyOf 2)	null	Alternative

Referenced models: Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise, List users — response body — item

Get an app — response body — client id, created at, description, events, external url, html url, id, installations count, name, node id, owner, permissions, slug, updated at owner Enterprise

Field	Type	Presence	Description and constraints
$	object	Root	An enterprise on GitHub.
avatar_url	string	Required within parent	Format: uri
created_at	JSON	Required within parent
created_at (anyOf 1)	string	Alternative	Format: date-time
created_at (anyOf 2)	null	Alternative
description	JSON	Optional
description (anyOf 1)	string	Alternative	A short description of the enterprise.
description (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Unique identifier of the enterprise
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
name	string	Required within parent	The name of the enterprise.
node_id	string	Required within parent
slug	string	Required within parent	The slug url identifier for the enterprise.
updated_at	JSON	Required within parent
updated_at (anyOf 1)	string	Alternative	Format: date-time
updated_at (anyOf 2)	null	Alternative
website_url	JSON	Optional
website_url (anyOf 1)	string	Alternative	The enterprise's website URL. Format: uri
website_url (anyOf 2)	null	Alternative

Policy, approvals and errors

SDK function policy ID: github.repos_update_pull_request_review_protection. Catalog operation: repos/update-pull-request-review-protection. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source