Update Origin Ruleset via the API

Replace a repository ruleset's configuration with PUT https://api.cursor.com/v1/origin/repos/{ownerSlug}/{repoName}/rulesets/{rulesetId}. Official reference: Origin API and changelog (OpenAPI OriginService_UpdateRuleset; added 2026-08-21).

Origin is in Early Beta and subject to change. Authenticate with an installation access token (oit_…) or a user access token that carries repository:rulesets:write. Availability: Early Beta per the API overview.

The body uses the same required fields as Create (name, enforcement, kind) plus optional description, ref-name lists, rules, and bypassActors. Nested rules and bypassActors are fully replaced: send every rule and bypass actor you want to keep. Caps match Create — more than 64 patterns per list, 20 rules, or 15 bypass actors returns InvalidArgument (HTTP 400). A missing or unreachable ruleset returns 404.

Cost: 5 points against the principal budget (ordinary write).

Path parameters

Param	Required	Meaning
ownerSlug	yes	Owning entity's unique slug
repoName	yes	Repo name, unique to the owner
rulesetId	yes	Stable Origin ruleset id

Request body

Field	Required	Meaning
name	yes	Ruleset display name
enforcement	yes	active, evaluate, or disabled
kind	yes	merge_branch, push_branch, push_tag, or push_repository
description	no	Human-readable summary
includedRefNames	no	Ref patterns this ruleset includes
excludedRefNames	no	Ref patterns this ruleset excludes
rules	no	Full replacement list of rules
bypassActors	no	Full replacement list of bypass principals

curl --request PUT \
  --url 'https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME/rulesets/rs_01k2ja2000e0080000000000t7' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "require-review",
  "description": "Require an approving review before merging to main.",
  "enforcement": "active",
  "kind": "merge_branch",
  "includedRefNames": ["refs/heads/main"],
  "rules": [
    {
      "ruleType": "pull_request",
      "parameters": {
        "requiredApprovingReviewCount": 1
      }
    }
  ],
  "bypassActors": [
    {
      "bypassMode": "always",
      "user": {
        "id": "act_01k2ja2000e0080000000000x0"
      }
    }
  ]
}'

Response

200 returns the updated Ruleset. Nested rule and bypass-actor rows receive new server-assigned ids after the replace.

{
  "id": "rs_01k2ja2000e0080000000000t7",
  "name": "require-review",
  "description": "Require an approving review before merging to main.",
  "enforcement": "active",
  "kind": "merge_branch",
  "includedRefNames": ["refs/heads/main"],
  "rules": [
    {
      "id": "rsr_01k2ja2000e0080000000000v8",
      "ruleType": "pull_request",
      "parameters": {
        "requiredApprovingReviewCount": 1
      }
    }
  ],
  "bypassActors": [
    {
      "id": "rsba_01k2ja2000e0080000000000w9",
      "bypassMode": "always",
      "user": {
        "id": "act_01k2ja2000e0080000000000x0"
      }
    }
  ]
}

Confirm with Get Ruleset. Base URL: https://api.cursor.com/v1/origin.