--- title: "Create a repository Actions policy" method: POST path: "/repos/{owner}/{repo}/actions/policies" tags: ["actions"] --- # Create a repository Actions policy `POST /repos/{owner}/{repo}/actions/policies` Create an Actions policy for a repository. Omitting `workflow_path` targets all workflows without storing an explicit condition. ## Path parameters - `owner` string, required - `repo` string, required ## Request body - object - `name` string, required — The name of the policy. - `enforcement` 'disabled' | 'active' | 'evaluate', required — The enforcement level of the ruleset. `evaluate` allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. `evaluate` is not available for the `repository` target. - `conditions` union — Conditions for a repository Actions policy. The object may be empty to preserve or use the default workflow targeting, or contain only `workflow_path`. - object - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `workflow_path` object, required - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - `rules` ActionsRule[] — An array of rules within the policy. - union — An actions rule. - object — Choose specific actors that are authorized to trigger Actions workflows. - `type` 'restrict_actions_actors', required - `parameters` object - `allowed_actors` ActionsRuleParamsActor[], required — Select the actors who can run Actions workflows. - `id` integer, required — ID of the actor authorized to trigger Actions workflows. - `type` 'User' | 'Bot' | 'Team' | 'BusinessTeam' | 'EnterpriseTeam' | 'IntegrationInstallation' | 'App' | 'RepositoryRole', required — The type of the actor - object — Choose specific GitHub events that will trigger Actions workflows. - `type` 'restrict_action_events', required - `parameters` object - `allowed_events` string[], required — Select the events that can trigger Actions workflows. ## Response `201` Response - ActionsPolicy — An Actions policy defines rules for workflow execution protection. - `id` integer, required — The ID of the policy - `name` string, required — The name of the policy - `target` 'actions', required — The target of the policy - `source_type` 'Repository' | 'Organization' | 'Enterprise', required — The type of the source of the policy - `source` string, required — The name of the source - `enforcement` 'disabled' | 'active' | 'evaluate', required — The enforcement level of the ruleset. `evaluate` allows admins to test rules before enforcing them. Admins can view insights on the Rule Insights page. `evaluate` is not available for the `repository` target. - `conditions` union — When workflow path targeting is available, detailed responses represent an omitted stored workflow condition as `workflow_path` with `include` set to `["~ALL"]` and `exclude` set to `[]`. When workflow path targeting is unavailable, an omitted stored condition remains omitted. - union — Conditions for a repository Actions policy. The object may be empty to preserve or use the default workflow targeting, or contain only `workflow_path`. - object - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `workflow_path` object, required - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - union — Conditions for an organization Actions policy. The conditions object should contain one of `repository_name`, `repository_id`, or `repository_property`, and may also contain `workflow_path`. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `repository_name` object, required - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories. - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match. - `protected` boolean — Whether renaming of target repositories is prevented. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `repository_id` object, required - `repository_ids` integer[] — The repository IDs that the ruleset applies to. One of these IDs must match for the condition to pass. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `repository_property` object, required - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - union — Conditions for an enterprise Actions policy. The conditions object supports one organization target (`organization_name`, `organization_id`, or `organization_property`) combined with one repository target (`repository_name` or `repository_property`), and may also contain `workflow_path`. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_name` object, required - `include` string[] — Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all organizations and ~EMUS to target all enterprise managed user accounts. - `exclude` string[] — Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match. - `repository_name` object, required - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories. - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match. - `protected` boolean — Whether renaming of target repositories is prevented. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_name` object, required - `include` string[] — Array of organization names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all organizations and ~EMUS to target all enterprise managed user accounts. - `exclude` string[] — Array of organization names or patterns to exclude. The condition will not pass if any of these patterns match. - `repository_property` object, required - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_id` object, required - `organization_ids` integer[] — The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass. - `repository_name` object, required - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories. - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match. - `protected` boolean — Whether renaming of target repositories is prevented. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_id` object, required - `organization_ids` integer[] — The organization IDs that the ruleset applies to. One of these IDs must match for the condition to pass. - `repository_property` object, required - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_property` object, required - `include` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the organization property to target - `property_values` string[], required — The values to match for the organization property - `exclude` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the organization property to target - `property_values` string[], required — The values to match for the organization property - `repository_name` object, required - `include` string[] — Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories. - `exclude` string[] — Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match. - `protected` boolean — Whether renaming of target repositories is prevented. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - object — Parameters for an Actions policy workflow path condition. Omitting `workflow_path` when creating a policy targets all workflows without storing an explicit condition. Omitting it when updating a policy preserves the existing workflow targeting. For new or changed workflow conditions, the API requires at least one included or excluded pattern. This is validated server-side rather than by this schema, which can also describe existing stored conditions. - `organization_property` object, required - `include` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the organization property to target - `property_values` string[], required — The values to match for the organization property - `exclude` EnterpriseRulesetConditionsOrganizationPropertySpec[] — The organization properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the organization property to target - `property_values` string[], required — The values to match for the organization property - `repository_property` object, required - `include` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to include. All of these properties must match for the condition to pass. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `exclude` RepositoryRulesetConditionsRepositoryPropertySpec[] — The repository properties and values to exclude. The condition will not pass if any of these properties match. - `name` string, required — The name of the repository property to target - `property_values` string[], required — The values to match for the repository property - `source` 'custom' | 'system' — The source of the repository property. Defaults to 'custom' if not specified. - `workflow_path` object - `include` string[], required — Array of workflow file paths or glob patterns to include. An empty array includes all workflows not matched by an excluded pattern. Use `~ALL` by itself to include all workflows. `~ALL` cannot be combined with other included patterns. - `exclude` string[], required — Array of workflow file paths or glob patterns to exclude. The condition will not pass if any of these patterns match. `~ALL` is not allowed in this array. - `rules` ActionsRule[] — An array of rules within the policy - union — An actions rule. - object — Choose specific actors that are authorized to trigger Actions workflows. - `type` 'restrict_actions_actors', required - `parameters` object - `allowed_actors` ActionsRuleParamsActor[], required — Select the actors who can run Actions workflows. - `id` integer, required — ID of the actor authorized to trigger Actions workflows. - `type` 'User' | 'Bot' | 'Team' | 'BusinessTeam' | 'EnterpriseTeam' | 'IntegrationInstallation' | 'App' | 'RepositoryRole', required — The type of the actor - object — Choose specific GitHub events that will trigger Actions workflows. - `type` 'restrict_action_events', required - `parameters` object - `allowed_events` string[], required — Select the events that can trigger Actions workflows. - `node_id` string - `_links` object - `self` object - `href` string — The URL of the policy - `html` object - `href` string — The html URL of the policy - `created_at` string, date-time - `updated_at` string, date-time ## Other responses - `404` — Resource not found - `422` — Validation failed, or the endpoint has been spammed. - `500` — Internal Error ## Changes - **2026-09-16** `bfb6c99dc39c` — 1 info - endpoint added [Change history](https://skmtc.dev/github/apis/enterprise-cloud/changes/repos/:owner/:repo/actions/policies/post.md) --- [API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/github/apis/enterprise-cloud/revisions/e9af1ee5b414?raw)