> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set main branch protection

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Turns protection of the app's main branch on or off.

While main is protected, calls that change main directly are refused with a 409, and the builder's AI can't edit main either. Make changes on a branch and merge it back instead. Setting the value the app already has changes nothing. Read the current value from `main_branch_protected` in [Get app](/api-reference/get-app).

Only the app owner or an admin of the app's workspace can change it. Editors can't, even though they can edit the app. This endpoint is limited to 10 requests per minute.

<Note>This endpoint accepts a personal API key belonging to the app owner or a workspace admin. A read-only key is refused, and workspace API keys are not accepted.</Note>



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json put /api/apps/{app_id}/branches/main/protection
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/branches/main/protection:
    put:
      summary: Set main branch protection
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Turns protection of the app's main branch on or off.


        While main is protected, calls that change main directly are refused
        with a 409, and the builder's AI can't edit main either. Make changes on
        a branch and merge it back instead. Setting the value the app already
        has changes nothing. Read the current value from `main_branch_protected`
        in [Get app](/api-reference/get-app).


        Only the app owner or an admin of the app's workspace can change it.
        Editors can't, even though they can edit the app. This endpoint is
        limited to 10 requests per minute.


        <Note>This endpoint accepts a personal API key belonging to the app
        owner or a workspace admin. A read-only key is refused, and workspace
        API keys are not accepted.</Note>
      operationId: >-
        update_main_branch_protection_api_apps__app_id__branches_main_protection_put
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app whose main branch to protect or unprotect.
            title: App Id
          description: ID of the app whose main branch to protect or unprotect.
          example: 6820f3a4e7b91d003c45a1f2
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MainBranchProtection'
      responses:
        '200':
          description: The main branch's protection after the change.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MainBranchProtection'
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, you aren't the app owner
            or a workspace admin, or your API key is read-only.
        '404':
          description: App not found.
        '422':
          description: >-
            `protected` is missing or isn't a boolean, or the body has other
            fields.
        '429':
          description: >-
            Rate limit exceeded. The base limit is 10 requests per minute. See
            [Rate
            limits](/developers/references/apps-api/get-started/rate-limits) for
            the multiplier your plan gets.
components:
  schemas:
    MainBranchProtection:
      properties:
        protected:
          type: boolean
          title: Protected
          description: >-
            Whether the app's main branch is protected. While it is, changes to
            main have to go through a branch that you merge back.
          example: true
      additionalProperties: false
      type: object
      required:
        - protected
      title: MainBranchProtection
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: 'Personal access token, sent as `Authorization: Bearer <token>`.'

````