Create Origin Ruleset via the API

Create a repository ruleset with POST https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/rulesets. Official reference: Origin API and changelog (OpenAPI OriginService_CreateRuleset; added 2026-08-21).

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a user access token that carries repository:rulesets:write. Availability: Early Beta per the API overview.

Required body fields are name, enforcement (active, evaluate, or disabled), and kind (merge_branch, push_branch, push_tag, or push_repository). Optional fields: description, includedRefNames and excludedRefNames (globs plus ~ALL and ~DEFAULT_BRANCH), rules (RulesetRuleInput entries with ruleType and optional parameters), and bypassActors (RulesetBypassActorInput with bypassMode and one of user, team, app, or originRole). Create rejects more than 64 patterns per include/exclude list, 20 rules, or 15 bypass actors with InvalidArgument (HTTP 400).

Cost: 5 points against the principal budget (ordinary write).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity's unique slug
repoName	yes	Repo name, unique to the owner

Request body

Field	Required	Meaning
name	yes	Ruleset display name
enforcement	yes	active, evaluate, or disabled
kind	yes	merge_branch, push_branch, push_tag, or push_repository
description	no	Human-readable summary
includedRefNames	no	Ref patterns this ruleset includes
excludedRefNames	no	Ref patterns this ruleset excludes
rules	no	Protection rules (ruleType + parameters)
bypassActors	no	Bypass principals (bypassMode + typed actor)

curl --request POST \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/rulesets' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "require-review",
  "description": "Require an approving review before merging to main.",
  "enforcement": "active",
  "kind": "merge_branch",
  "includedRefNames": ["refs/heads/main"],
  "rules": [
    {
      "ruleType": "pull_request",
      "parameters": {
        "requiredApprovingReviewCount": 1
      }
    }
  ],
  "bypassActors": [
    {
      "bypassMode": "always",
      "user": {
        "id": "act_01k2ja2000e0080000000000x0"
      }
    }
  ]
}'

Response

200 returns a Ruleset including server-assigned id, rule ids (rsr_…), and bypass-actor ids (rsba_…).

{
  "id": "rs_01k2ja2000e0080000000000t7",
  "name": "require-review",
  "description": "Require an approving review before merging to main.",
  "enforcement": "active",
  "kind": "merge_branch",
  "includedRefNames": ["refs/heads/main"],
  "rules": [
    {
      "id": "rsr_01k2ja2000e0080000000000v8",
      "ruleType": "pull_request",
      "parameters": {
        "requiredApprovingReviewCount": 1
      }
    }
  ],
  "bypassActors": [
    {
      "id": "rsba_01k2ja2000e0080000000000w9",
      "bypassMode": "always",
      "user": {
        "id": "act_01k2ja2000e0080000000000x0"
      }
    }
  ]
}

Example ruleType strings from the OpenAPI schema include pull_request, require_status_checks, require_branch_up_to_date, deletion, and non_fast_forward. Base URL: https://api.cursor.com/v1/origin.