# Restrict a folder

> Page: https://docs.plotwork.dev/api/put-orgs-org-folder-rules. Index of every page: https://docs.plotwork.dev/llms.txt

Makes or replaces the rule for a folder and everything inside it.

`PUT /orgs/{org}/folder-rules`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Restrict a folder. |
| What does it take? | A JSON body of type [`SetFolderRuleBody`](https://docs.plotwork.dev/api/schemas.md#setfolderrulebody). |
| What does it return? | Status 204 with no body. |
| What can go wrong? | `400` the body is not valid, or the rule cannot be stored (orgs.rule_invalid; details.reason is bad_folder, unknown_role, or not_a_member); `401` not signed in; `403` only the owner may (orgs.forbidden), a limit is reached (orgs.rule_limit_reached), or the request came from an origin that may not make changes; `404` no such organisation, or the caller is not a member of it; `429` too many requests; `503` organisations are not set up on this server. Every failure uses the one error envelope. |

## What it does

Makes or replaces the rule for a folder and everything inside it. Only the owner, the roles named, and the people named may use it. Empty roles and users lets in the owner alone. Only the owner may write a rule.

## Path parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `org` | `string` | yes | The organisation's id or its slug. |

## Request body

The body has the type [`SetFolderRuleBody`](https://docs.plotwork.dev/api/schemas.md#setfolderrulebody).

| Field | Type | Required | Description |
|---|---|---|---|
| `folder` | `string` | yes | The folder the rule restricts, with every folder inside it: names from the outermost in, joined with a slash, with no slash at either end. at least 1 character; at most 405 characters. |
| `roles` | `string[]` | yes | Any of admin, member, reader, key. `owner` is not a choice. An empty list, with no people, lets in the owner alone. |
| `users` | `string[]` | yes | Account ids of current members, at most 100. A person who leaves is taken out of every rule. |

## Responses

| Status | Meaning | Body |
|---|---|---|
| 204 | The rule is in place. | none |
| 400 | The body is not valid, or the rule cannot be stored (orgs.rule_invalid; details.reason is bad_folder, unknown_role, or not_a_member). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 401 | Not signed in. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 403 | Only the owner may (orgs.forbidden), a limit is reached (orgs.rule_limit_reached), or the request came from an origin that may not make changes. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 404 | No such organisation, or the caller is not a member of it. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 429 | Too many requests. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | Organisations are not set up on this server. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |