Lomo CodeSecurity

The API reference is in English.

Current source preview reference

PATCH /v1/git/push-protection/{repository_id}

Update push policy. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/git_push_policy.py:355

Update push policy

Update push policy through PATCH /v1/git/push-protection/{repository_id}. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with project:resolve. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

NameLocationContract
repository_idpath
Required

string

Schema
{
  "title": "Repository Id",
  "type": "string"
}
X-CSRF-Tokenheader
Conditional / optional

Required for browser mutations with the exact control Origin. Not an IDE capability.

Schema
{
  "type": "string"
}

Request body

JSON body · required · PushPolicyUpdate

FieldTypePresence
confirm_bypassbooleanOptional
enabledbooleanRequired
expected_revisionintegerRequired
Complete declared request schema
{
  "additionalProperties": false,
  "properties": {
    "confirm_bypass": {
      "default": false,
      "title": "Confirm Bypass",
      "type": "boolean"
    },
    "enabled": {
      "title": "Enabled",
      "type": "boolean"
    },
    "expected_revision": {
      "maximum": 2147483646,
      "minimum": 1,
      "title": "Expected Revision",
      "type": "integer"
    }
  },
  "required": [
    "expected_revision",
    "enabled"
  ],
  "title": "PushPolicyUpdate",
  "type": "object"
}

Responses

StatusMeaning and declared shape
200

Successful Response

application/json · PushPolicy
{
  "additionalProperties": false,
  "properties": {
    "enabled": {
      "default": false,
      "title": "Enabled",
      "type": "boolean"
    },
    "git_directory": {
      "maxLength": 4096,
      "minLength": 1,
      "title": "Git Directory",
      "type": "string"
    },
    "hook_digest": {
      "anyOf": [
        {
          "pattern": "^[0-9a-f]{64}$",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Hook Digest"
    },
    "members": {
      "items": {
        "$ref": "#/components/schemas/PushMember"
      },
      "maxItems": 32,
      "title": "Members",
      "type": "array"
    },
    "name": {
      "maxLength": 120,
      "minLength": 1,
      "title": "Name",
      "type": "string"
    },
    "observed_at": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Observed At"
    },
    "observed_revision": {
      "anyOf": [
        {
          "minimum": 1,
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Observed Revision"
    },
    "observed_state": {
      "default": "not_installed",
      "enum": [
        "not_installed",
        "installed",
        "needs_repair"
      ],
      "title": "Observed State",
      "type": "string"
    },
    "project_id": {
      "minimum": 1,
      "title": "Project Id",
      "type": "integer"
    },
    "reason_code": {
      "anyOf": [
        {
          "enum": [
            "host_setup_required",
            "hook_missing_or_changed",
            "policy_changed"
          ],
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": "host_setup_required",
      "title": "Reason Code"
    },
    "repository_id": {
      "pattern": "^[0-9a-f]{64}$",
      "title": "Repository Id",
      "type": "string"
    },
    "revision": {
      "maximum": 2147483647,
      "minimum": 1,
      "title": "Revision",
      "type": "integer"
    },
    "root_path": {
      "maxLength": 4096,
      "minLength": 1,
      "title": "Root Path",
      "type": "string"
    }
  },
  "required": [
    "repository_id",
    "name",
    "project_id",
    "root_path",
    "git_directory",
    "revision"
  ],
  "title": "PushPolicy",
  "type": "object"
}
400

Exact host, malformed request or URL credential refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
401

Missing or invalid membership

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
403

Exact origin, CSRF or route authority refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
404

Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.

409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}
429

Authentication rate or connection limit

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
503

Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

9 source error observations
StatusSource detailRecovery
409 ↗{"code":"push_policy_changed","message":"Push protection changed in another window. Refresh before changing it."}Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗{"code":"push_bypass_confirmation_required","message":"Turning protection off allows failed or unscanned commits to be pushed. Confirm that choice explicitly."}Refresh current revision and identity. A conflicting command must not be blindly repeated.
403 ↗{"code":"push_approval_required","message":"Approve this editor’s repository push-protection request once in the paired browser’s Settings."}Review exact origin, CSRF, IDE scope and owner approval. Do not broaden authority.
403 ↗{"code":"push_member_revoked","message":"This editor’s repository authority is no longer active."}Review exact origin, CSRF, IDE scope and owner approval. Do not broaden authority.
409 ↗{"code":"push_policy_changed","message":"Push protection changed in another window. Refresh before changing it."}Refresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗{"code":"push_setup_required","message":"Set up push protection for this exact repository in VS Code."}Refresh the collection and verify the resource identity before retrying.
503 ↗{"code":"push_policy_corrupt","message":"Push protection configuration has a different repository identity."}Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗{"code":"push_policy_corrupt","message":"Push protection configuration needs owner review; no push is approved."}Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
422 ↗{"code":"push_repository_invalid","message":"Select one registered Git repository."}Correct the field or semantic validation error. Input values are omitted from control validation errors.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON
{
  "enabled": false,
  "expected_revision": 1
}
Response 200 JSON
{
  "git_directory": "synthetic",
  "name": "Synthetic demo",
  "project_id": 1,
  "repository_id": "0000000000000000000000000000000000000000000000000000000000000000",
  "revision": 1,
  "root_path": "/workspace/synthetic-demo"
}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.