REST API endpoints for rules

Get rules for a branch

Returns all active rules that apply to the specified branch. The branch does not need to exist; rules that would apply to a branch with that name will be returned. All active rules that apply will be returned, regardless of the level at which they are configured (e.g. repository or organization). Rules in rulesets with "evaluate" or "disabled" enforcement statuses are not returned.

Fine-grained access tokens for "Get rules for a branch"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Metadata" repository permissions (read)

This endpoint can be used without authentication or the aforementioned permissions if only public resources are requested.

Parameters for "Get rules for a branch"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.
`branch` string Required The name of the branch. Cannot contain wildcard characters. To use wildcard characters in branch names, use the GraphQL API.

Query parameters
Name, Type, Description
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Default: `30`
`page` integer The page number of the results to fetch. For more information, see "Using pagination in the REST API." Default: `1`

HTTP response status codes for "Get rules for a branch"

Status code	Description
`200`	OK

Code samples for "Get rules for a branch"

Request example

get/repos/{owner}/{repo}/rules/branches/{branch}

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/OWNER/REPO/rules/branches/BRANCH

Response

Status: 200

[
  {
    "type": "commit_message_pattern",
    "ruleset_source_type": "Repository",
    "ruleset_source": "monalisa/my-repo",
    "ruleset_id": 42,
    "parameters": {
      "operator": "starts_with",
      "pattern": "issue"
    }
  },
  {
    "type": "commit_author_email_pattern",
    "ruleset_source_type": "Organization",
    "ruleset_source": "my-org",
    "ruleset_id": 73,
    "parameters": {
      "operator": "contains",
      "pattern": "github"
    }
  }
]

Get all repository rulesets

Get all the rulesets for a repository.

Fine-grained access tokens for "Get all repository rulesets"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Metadata" repository permissions (read)

This endpoint can be used without authentication or the aforementioned permissions if only public resources are requested.

Parameters for "Get all repository rulesets"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.

Query parameters
Name, Type, Description
`per_page` integer The number of results per page (max 100). For more information, see "Using pagination in the REST API." Default: `30`
`page` integer The page number of the results to fetch. For more information, see "Using pagination in the REST API." Default: `1`
`includes_parents` boolean Include rulesets configured at higher levels that apply to this repository Default: `true`
`targets` string A comma-separated list of rule targets to filter by. If provided, only rulesets that apply to the specified targets will be returned. For example, `branch,tag,push`.

HTTP response status codes for "Get all repository rulesets"

Status code	Description
`200`	OK
`404`	Resource not found
`500`	Internal Error

Code samples for "Get all repository rulesets"

Request example

get/repos/{owner}/{repo}/rulesets

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/OWNER/REPO/rulesets

Response

Status: 200

[
  {
    "id": 42,
    "name": "super cool ruleset",
    "source_type": "Repository",
    "source": "monalisa/my-repo",
    "enforcement": "enabled",
    "node_id": "RRS_lACkVXNlcgQB",
    "_links": {
      "self": {
        "href": "https://api.github.com/repos/monalisa/my-repo/rulesets/42"
      },
      "html": {
        "href": "https://github.com/monalisa/my-repo/rules/42"
      }
    },
    "created_at": "2023-07-15T08:43:03Z",
    "updated_at": "2023-08-23T16:29:47Z"
  },
  {
    "id": 314,
    "name": "Another ruleset",
    "source_type": "Repository",
    "source": "monalisa/my-repo",
    "enforcement": "enabled",
    "node_id": "RRS_lACkVXNlcgQQ",
    "_links": {
      "self": {
        "href": "https://api.github.com/repos/monalisa/my-repo/rulesets/314"
      },
      "html": {
        "href": "https://github.com/monalisa/my-repo/rules/314"
      }
    },
    "created_at": "2023-08-15T08:43:03Z",
    "updated_at": "2023-09-23T16:29:47Z"
  }
]

Create a repository ruleset

Create a ruleset for a repository.

Fine-grained access tokens for "Create a repository ruleset"

This endpoint works with the following fine-grained token types:

The fine-grained token must have the following permission set:

"Administration" repository permissions (write)

Parameters for "Create a repository ruleset"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.

Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.

Name, Type, Description

name string Required

The name of the ruleset.

target string

The target of the ruleset

Default: branch

Can be one of: branch, tag, push

enforcement string Required

The enforcement level of the ruleset. evaluate allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page (evaluate is only available with GitHub Enterprise).

Can be one of: disabled, active, evaluate

bypass_actors array of objects

The actors that can bypass the rules in this ruleset

Properties of bypass_actors

Name, Type, Description
`actor_id` integer or null The ID of the actor that can bypass a ruleset. Required for `Integration`, `RepositoryRole`, `Team`, and `User` actor types. If `actor_type` is `OrganizationAdmin`, `actor_id` is ignored. If `actor_type` is `DeployKey`, this should be null. `OrganizationAdmin` is not applicable for personal repositories.
`actor_type` string Required The type of actor that can bypass a ruleset. Can be one of: `Integration`, `OrganizationAdmin`, `RepositoryRole`, `Team`, `DeployKey`, `User`
`bypass_mode` string When the specified actor can bypass the ruleset. `pull_request` means that an actor can only bypass rules on pull requests. `pull_request` is not applicable for the `DeployKey` actor type. Also, `pull_request` is only applicable to branch rulesets. When `bypass_mode` is `exempt`, rules will not be run for that actor and a bypass audit entry will not be created. Default: `always` Can be one of: `always`, `pull_request`, `exempt`

conditions object

Parameters for a repository ruleset ref name condition

Properties of conditions

Name, Type, Description

ref_name object

Properties of ref_name

Name, Type, Description
`include` array of strings Array of ref names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~DEFAULT_BRANCH` to include the default branch or `~ALL` to include all branches.
`exclude` array of strings Array of ref names or patterns to exclude. The condition will not pass if any of these patterns match.

rules array of objects

An array of rules within the ruleset.

Can be one of these objects:

Name, Type, Description

creation object

Only allow users with bypass permission to create matching refs.

Properties of creation

Name, Type, Description
`type` string Required Value: `creation`

update object

Only allow users with bypass permission to update matching refs.

Properties of update

Name, Type, Description

type string Required

Value: update

parameters object

Properties of parameters

Name, Type, Description
`update_allows_fetch_and_merge` boolean Required Branch can pull changes from its upstream repository