> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Set main branch protection (owner or admin only) > This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Turns protection of the app's main branch on or off. While main is protected, calls that change main directly are refused with a 409, and the builder's AI can't edit main either. Make changes on a branch and merge it back instead. Superagents can't protect their main branch, so turning it on for one returns a 409 with error code `superagent_main_protection_unsupported`. Imported apps always protect their main branch, so turning it off for one returns a 409 with error code `imported_main_protection_required`. Setting the value the app already has changes nothing. Read the current value from `main_branch_protected` in [Get app](/api-reference/get-app). Only the app owner or an admin of the app's workspace can change it. Editors can't, even though they can edit the app. This endpoint is limited to 10 requests per minute. This endpoint accepts a personal API key belonging to the app owner or a workspace admin, or a workspace API key, which acts as the workspace owner. A read-only key is refused. ## OpenAPI ````yaml /developers/references/app-management/app-management-openapi.json put /api/apps/{app_id}/branches/main/protection openapi: 3.1.0 info: title: Base44 App Management API version: 1.0.0 servers: - url: https://app.base44.com security: - PersonalAccessTokenAuth: [] paths: /api/apps/{app_id}/branches/main/protection: put: summary: Set main branch protection (owner or admin only) description: >- This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Turns protection of the app's main branch on or off. While main is protected, calls that change main directly are refused with a 409, and the builder's AI can't edit main either. Make changes on a branch and merge it back instead. Superagents can't protect their main branch, so turning it on for one returns a 409 with error code `superagent_main_protection_unsupported`. Imported apps always protect their main branch, so turning it off for one returns a 409 with error code `imported_main_protection_required`. Setting the value the app already has changes nothing. Read the current value from `main_branch_protected` in [Get app](/api-reference/get-app). Only the app owner or an admin of the app's workspace can change it. Editors can't, even though they can edit the app. This endpoint is limited to 10 requests per minute. This endpoint accepts a personal API key belonging to the app owner or a workspace admin, or a workspace API key, which acts as the workspace owner. A read-only key is refused. operationId: >- update_main_branch_protection_api_apps__app_id__branches_main_protection_put parameters: - name: app_id in: path required: true schema: type: string description: ID of the app whose main branch to protect or unprotect. title: App Id description: ID of the app whose main branch to protect or unprotect. example: 6820f3a4e7b91d003c45a1f2 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/MainBranchProtection' responses: '200': description: The main branch's protection after the change. content: application/json: schema: $ref: '#/components/schemas/MainBranchProtection' '401': description: Missing or invalid credentials. '403': description: >- You don't have editor access to this app, you aren't the app owner or a workspace admin, or your API key is read-only. '404': description: App not found. '409': description: >- The app is a superagent, which can't protect its main branch (error code `superagent_main_protection_unsupported`), the app is imported, which always protects its main branch (error code `imported_main_protection_required`), or protection is managed by the app's connected GitHub repository. '422': description: >- `protected` is missing or isn't a boolean, or the body has other fields. '429': description: >- Rate limit exceeded. The base limit is 10 requests per minute. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets. security: - PersonalAccessTokenAuth: - full_access - WorkspaceApiKeyAuth: - full_access - WorkspaceApiKeyBearerAuth: - full_access components: schemas: MainBranchProtection: properties: protected: type: boolean title: Protected description: >- Whether the app's main branch is protected. While it is, changes to main have to go through a branch that you merge back. example: true additionalProperties: false type: object required: - protected title: MainBranchProtection securitySchemes: PersonalAccessTokenAuth: type: http scheme: bearer description: >- Personal access token, sent as `Authorization: Bearer `. Each operation lists the permission it needs: `read_only` or `full_access`. A full-access token can call every operation. A read-only token can call only the operations that list `read_only`; anything else returns 403 `read_only_credential_route_not_allowed`. WorkspaceApiKeyAuth: type: apiKey in: header name: api_key description: >- Workspace API key, sent as `api_key: `. Each operation that accepts one lists what the key needs: a permission, `read_only` or `full_access`, like a personal access token, or a scope. A key without the scope gets 403 `workspace_api_key_scope_required`. WorkspaceApiKeyBearerAuth: type: http scheme: bearer description: >- Workspace API key, sent as `Authorization: Bearer `. Accepted wherever `api_key` is, with the same permission. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.