POST /v1/git/push-protection

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

This address preserves one reviewed source snapshot. Use the current entry point for the selected documentation version.

Read pinned handler: apps/api/kodesec_api/git_push_policy.py:254

Register push repository

Register push repository through POST /v1/git/push-protection. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with project:create. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

Name	Location	Contract
`X-CSRF-Token`	header Conditional / optional	Required for browser mutations with the exact control Origin. Not an IDE capability. Schema `{ "type": "string" }`

Request body

JSON body · required · PushPolicyCreate

Field	Type	Presence
`git_directory`	string	Required
`name`	string	Required
`project_id`	integer \| null	Optional
`repository_id`	string	Required
`root_path`	string	Required

Complete declared request schema

{
  "additionalProperties": false,
  "properties": {
    "git_directory": {
      "maxLength": 4096,
      "minLength": 1,
      "title": "Git Directory",
      "type": "string"
    },
    "name": {
      "maxLength": 120,
      "minLength": 1,
      "title": "Name",
      "type": "string"
    },
    "project_id": {
      "anyOf": [
        {
          "minimum": 1,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Project Id"
    },
    "repository_id": {
      "pattern": "^[0-9a-f]{64}$",
      "title": "Repository Id",
      "type": "string"
    },
    "root_path": {
      "maxLength": 4096,
      "minLength": 1,
      "title": "Root Path",
      "type": "string"
    }
  },
  "required": [
    "repository_id",
    "name",
    "root_path",
    "git_directory"
  ],
  "title": "PushPolicyCreate",
  "type": "object"
}

Responses

Status	Meaning and declared shape
`201`	Successful Response application/json · PushPolicy { "additionalProperties": false, "properties": { "enabled": { "default": false, "title": "Enabled", "type": "boolean" }, "git_directory": { "maxLength": 4096, "minLength": 1, "title": "Git Directory", "type": "string" }, "hook_digest": { "anyOf": [ { "pattern": "^[0-9a-f]{64}$", "type": "string" }, { "type": "null" } ], "title": "Hook Digest" }, "members": { "items": { "$ref": "#/components/schemas/PushMember" }, "maxItems": 32, "title": "Members", "type": "array" }, "name": { "maxLength": 120, "minLength": 1, "title": "Name", "type": "string" }, "observed_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Observed At" }, "observed_revision": { "anyOf": [ { "minimum": 1, "type": "integer" }, { "type": "null" } ], "title": "Observed Revision" }, "observed_state": { "default": "not_installed", "enum": [ "not_installed", "installed", "needs_repair" ], "title": "Observed State", "type": "string" }, "project_id": { "minimum": 1, "title": "Project Id", "type": "integer" }, "reason_code": { "anyOf": [ { "enum": [ "host_setup_required", "hook_missing_or_changed", "policy_changed" ], "type": "string" }, { "type": "null" } ], "default": "host_setup_required", "title": "Reason Code" }, "repository_id": { "pattern": "^[0-9a-f]{64}$", "title": "Repository Id", "type": "string" }, "revision": { "maximum": 2147483647, "minimum": 1, "title": "Revision", "type": "integer" }, "root_path": { "maxLength": 4096, "minLength": 1, "title": "Root Path", "type": "string" } }, "required": [ "repository_id", "name", "project_id", "root_path", "git_directory", "revision" ], "title": "PushPolicy", "type": "object" }
`400`	Exact host, malformed request or URL credential refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`401`	Missing or invalid membership application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`403`	Exact origin, CSRF or route authority refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`404`	Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.
`409`	Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`429`	Authentication rate or connection limit application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`503`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

14 source error observations

Status	Source detail	Recovery
403 ↗	`{"code":"push_member_revoked","message":"Only a currently approved editor can request repository push protection."}`	Review exact origin, CSRF, IDE scope and owner approval. Do not broaden authority.
409 ↗	`{"code":"push_repository_limit","message":"The installation already has the maximum registered push-protection repositories."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`{"code":"push_revision_exhausted","message":"This repository exhausted its safe policy revision range. Owner review is required."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`{"code":"push_project_conflict","message":"This repository is bound to a different source project. Review its existing policy."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`{"code":"push_member_limit","message":"Review existing repository members before requesting another editor."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`{"code":"push_project_conflict","message":"The selected project does not identify this exact repository source."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`{"code":"push_policy_changed","message":"Another profile registered this repository. Refresh its existing policy."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗	`{"code":"push_setup_required","message":"Set up push protection for this exact repository in VS Code."}`	Refresh the collection and verify the resource identity before retrying.
503 ↗	`{"code":"push_policy_corrupt","message":"Push protection configuration has a different repository identity."}`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗	`{"code":"push_policy_corrupt","message":"Push protection configuration needs owner review; no push is approved."}`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
422 ↗	`{"code":"push_repository_invalid","message":"Select one registered Git repository."}`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
409 ↗	`{"code":"push_policy_changed","message":"Push protection changed in another window. Refresh before changing it."}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
503 ↗	`{"code":"push_removal_corrupt","message":"The removal receipt names another repository."}`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗	`{"code":"push_removal_corrupt","message":"This repository's removal receipt needs owner review."}`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON

{
  "git_directory": "synthetic",
  "name": "Synthetic demo",
  "repository_id": "0000000000000000000000000000000000000000000000000000000000000000",
  "root_path": "/workspace/synthetic-demo"
}

Response 201 JSON

{
  "git_directory": "synthetic",
  "name": "Synthetic demo",
  "project_id": 1,
  "repository_id": "0000000000000000000000000000000000000000000000000000000000000000",
  "revision": 1,
  "root_path": "/workspace/synthetic-demo"
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.