---
title: "Create a package protection rule"
method: POST
path: "/api/v4/projects/{id}/packages/protection/rules"
tags: ["projects"]
---

# Create a package protection rule

`POST /api/v4/projects/{id}/packages/protection/rules`

## Request

- Base URL: `https://gitlab.com`
- URL: `https://gitlab.com/api/v4/projects/{id}/packages/protection/rules`
- Auth: none declared

Creates a package protection rule for a specified project.

## Path parameters

- `id` string, required

## Request body

- PostApiV4ProjectsIdPackagesProtectionRules: Create a package protection rule
  - `package_name_pattern` string, required: Package name protected by the rule. For example @my-scope/my-package-*. Wildcard character * allowed.
  - `package_type` 'cargo' | 'conan' | 'generic' | 'helm' | 'maven' | 'npm' | 'nuget' | 'pypi' | 'rubygems' | 'terraform_module', required: Package type protected by the rule. For example npm.
  - `minimum_access_level_for_delete` 'owner' | 'admin': Minimum GitLab access level required to delete a package. Valid values include `null`, `owner` or `admin`. If the value is `null`, the default minimum access level is `maintainer`. Must be provided when `minimum_access_level_for_push` is not set. Behind a feature flag named `packages_protected_packages_delete`. Disabled by default.
  - `minimum_access_level_for_push` 'maintainer' | 'owner' | 'admin': Minimum GitLab access level required to push a package. Valid values include `null`, `maintainer`, `owner` or `admin`. If the value is `null`, the default minimum access level is `developer`. Must be provided when `minimum_access_level_for_delete` is not set.

## Response `201`

Create a package protection rule

- APIEntitiesProjectsPackagesProtectionRule: API_Entities_Projects_Packages_Protection_Rule model
  - `id` integer, required
  - `project_id` integer, required
  - `package_name_pattern` string, required
  - `package_type` string, required
  - `minimum_access_level_for_delete` string, required
  - `minimum_access_level_for_push` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/gitlab/apis/gitlab-api.md) - [All operations](https://skmtc.dev/gitlab/apis/gitlab-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitlab/apis/gitlab-api/revisions/b234947ef3f2?raw)