diff --git a/api/swagger.yml b/api/swagger.yml
index fbe956545ca..17799a4f4cf 100644
--- a/api/swagger.yml
+++ b/api/swagger.yml
@@ -2323,6 +2323,130 @@ paths:
         default:
           $ref: "#/components/responses/ServerError"
 
+  /repositories/{repository}/settings/gc_rules:
+    parameters:
+      - in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+    get:
+      tags:
+        - repositories
+      operationId: getGCRules
+      summary: get repository GC rules
+      responses:
+        200:
+          description: repository GC rules
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GarbageCollectionRules"
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+    put:
+      tags:
+        - repositories
+      operationId: setGCRules
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/GarbageCollectionRules"
+      responses:
+        204:
+          description: set garbage collection rules successfully
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+    delete:
+      tags:
+        - repositories
+      operationId: deleteGCRules
+      responses:
+        204:
+          description: deleted garbage collection rules successfully
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+
+  /repositories/{repository}/settings/branch_protection:
+    parameters:
+      - in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+    get:
+      tags:
+        - repositories
+      operationId: getBranchProtectionRules
+      summary: get branch protection rules
+      responses:
+        200:
+          description: branch protection rules
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/BranchProtectionRule"
+          headers:
+            ETag:
+              schema:
+                type: string
+                description: ETag of the branch protection rules
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+
+    put:
+      parameters:
+        - in: header
+          name: If-Match
+          schema:
+            type: string
+          description: if provided, the branch protection rules will be updated only if the current ETag match the provided value
+          allowEmptyValue: true
+      tags:
+        - repositories
+      operationId: setBranchProtectionRules
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: "#/components/schemas/BranchProtectionRule"
+      responses:
+        204:
+          description: branch protection rule created successfully
+        400:
+          $ref: "#/components/responses/BadRequest"
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        412:
+          $ref: "#/components/responses/PreconditionFailed"
+        default:
+          $ref: "#/components/responses/ServerError"
+
   /otf/diffs:
     get:
       tags:
@@ -4060,7 +4184,7 @@ paths:
     get:
       tags:
         - internal
-      operationId: getGarbageCollectionRules
+      operationId: internalGetGarbageCollectionRules
       responses:
         200:
           description: gc rule list
@@ -4078,7 +4202,7 @@ paths:
     post:
       tags:
         - internal
-      operationId: set garbage collection rules
+      operationId: internalSetGarbageCollectionRules
       requestBody:
         required: true
         content:
@@ -4097,7 +4221,7 @@ paths:
     delete:
       tags:
         - internal
-      operationId: delete garbage collection rules
+      operationId: internalDeleteGarbageCollectionRules
       responses:
         204:
           description: deleted garbage collection rules successfully
@@ -4200,7 +4324,7 @@ paths:
     get:
       tags:
         - internal
-      operationId: getBranchProtectionRules
+      operationId: internalGetBranchProtectionRules
       summary: get branch protection rules
       responses:
         200:
@@ -4221,7 +4345,7 @@ paths:
     post:
       tags:
         - internal
-      operationId: createBranchProtectionRule
+      operationId: internalCreateBranchProtectionRule
       requestBody:
         required: true
         content:
@@ -4240,7 +4364,7 @@ paths:
     delete:
       tags:
         - internal
-      operationId: deleteBranchProtectionRule
+      operationId: internalDeleteBranchProtectionRule
       requestBody:
         required: true
         content:
diff --git a/clients/java/README.md b/clients/java/README.md
index a4a61afe70c..ce81cb67f5f 100644
--- a/clients/java/README.md
+++ b/clients/java/README.md
@@ -188,18 +188,18 @@ Class | Method | HTTP request | Description
 *ImportApi* | [**importCancel**](docs/ImportApi.md#importCancel) | **DELETE** /repositories/{repository}/branches/{branch}/import | cancel ongoing import
 *ImportApi* | [**importStart**](docs/ImportApi.md#importStart) | **POST** /repositories/{repository}/branches/{branch}/import | import data from object store
 *ImportApi* | [**importStatus**](docs/ImportApi.md#importStatus) | **GET** /repositories/{repository}/branches/{branch}/import | get import status
-*InternalApi* | [**createBranchProtectionRule**](docs/InternalApi.md#createBranchProtectionRule) | **POST** /repositories/{repository}/branch_protection | 
 *InternalApi* | [**createBranchProtectionRulePreflight**](docs/InternalApi.md#createBranchProtectionRulePreflight) | **GET** /repositories/{repository}/branch_protection/set_allowed | 
 *InternalApi* | [**createSymlinkFile**](docs/InternalApi.md#createSymlinkFile) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
-*InternalApi* | [**deleteBranchProtectionRule**](docs/InternalApi.md#deleteBranchProtectionRule) | **DELETE** /repositories/{repository}/branch_protection | 
-*InternalApi* | [**deleteGarbageCollectionRules**](docs/InternalApi.md#deleteGarbageCollectionRules) | **DELETE** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**getAuthCapabilities**](docs/InternalApi.md#getAuthCapabilities) | **GET** /auth/capabilities | list authentication capabilities supported
-*InternalApi* | [**getBranchProtectionRules**](docs/InternalApi.md#getBranchProtectionRules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
 *InternalApi* | [**getGarbageCollectionConfig**](docs/InternalApi.md#getGarbageCollectionConfig) | **GET** /config/garbage-collection | 
-*InternalApi* | [**getGarbageCollectionRules**](docs/InternalApi.md#getGarbageCollectionRules) | **GET** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**getSetupState**](docs/InternalApi.md#getSetupState) | **GET** /setup_lakefs | check if the lakeFS installation is already set up
+*InternalApi* | [**internalCreateBranchProtectionRule**](docs/InternalApi.md#internalCreateBranchProtectionRule) | **POST** /repositories/{repository}/branch_protection | 
+*InternalApi* | [**internalDeleteBranchProtectionRule**](docs/InternalApi.md#internalDeleteBranchProtectionRule) | **DELETE** /repositories/{repository}/branch_protection | 
+*InternalApi* | [**internalDeleteGarbageCollectionRules**](docs/InternalApi.md#internalDeleteGarbageCollectionRules) | **DELETE** /repositories/{repository}/gc/rules | 
+*InternalApi* | [**internalGetBranchProtectionRules**](docs/InternalApi.md#internalGetBranchProtectionRules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
+*InternalApi* | [**internalGetGarbageCollectionRules**](docs/InternalApi.md#internalGetGarbageCollectionRules) | **GET** /repositories/{repository}/gc/rules | 
+*InternalApi* | [**internalSetGarbageCollectionRules**](docs/InternalApi.md#internalSetGarbageCollectionRules) | **POST** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**postStatsEvents**](docs/InternalApi.md#postStatsEvents) | **POST** /statistics | post stats events, this endpoint is meant for internal use only
-*InternalApi* | [**setGarbageCollectionRules**](docs/InternalApi.md#setGarbageCollectionRules) | **POST** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**setGarbageCollectionRulesPreflight**](docs/InternalApi.md#setGarbageCollectionRulesPreflight) | **GET** /repositories/{repository}/gc/rules/set_allowed | 
 *InternalApi* | [**setup**](docs/InternalApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 *InternalApi* | [**setupCommPrefs**](docs/InternalApi.md#setupCommPrefs) | **POST** /setup_comm_prefs | setup communications preferences
@@ -223,10 +223,15 @@ Class | Method | HTTP request | Description
 *RefsApi* | [**mergeIntoBranch**](docs/RefsApi.md#mergeIntoBranch) | **POST** /repositories/{repository}/refs/{sourceRef}/merge/{destinationBranch} | merge references
 *RefsApi* | [**restoreRefs**](docs/RefsApi.md#restoreRefs) | **PUT** /repositories/{repository}/refs/restore | Restore repository refs (tags, commits, branches) from object store
 *RepositoriesApi* | [**createRepository**](docs/RepositoriesApi.md#createRepository) | **POST** /repositories | create repository
+*RepositoriesApi* | [**deleteGCRules**](docs/RepositoriesApi.md#deleteGCRules) | **DELETE** /repositories/{repository}/settings/gc_rules | 
 *RepositoriesApi* | [**deleteRepository**](docs/RepositoriesApi.md#deleteRepository) | **DELETE** /repositories/{repository} | delete repository
+*RepositoriesApi* | [**getBranchProtectionRules**](docs/RepositoriesApi.md#getBranchProtectionRules) | **GET** /repositories/{repository}/settings/branch_protection | get branch protection rules
+*RepositoriesApi* | [**getGCRules**](docs/RepositoriesApi.md#getGCRules) | **GET** /repositories/{repository}/settings/gc_rules | get repository GC rules
 *RepositoriesApi* | [**getRepository**](docs/RepositoriesApi.md#getRepository) | **GET** /repositories/{repository} | get repository
 *RepositoriesApi* | [**getRepositoryMetadata**](docs/RepositoriesApi.md#getRepositoryMetadata) | **GET** /repositories/{repository}/metadata | get repository metadata
 *RepositoriesApi* | [**listRepositories**](docs/RepositoriesApi.md#listRepositories) | **GET** /repositories | list repositories
+*RepositoriesApi* | [**setBranchProtectionRules**](docs/RepositoriesApi.md#setBranchProtectionRules) | **PUT** /repositories/{repository}/settings/branch_protection | 
+*RepositoriesApi* | [**setGCRules**](docs/RepositoriesApi.md#setGCRules) | **PUT** /repositories/{repository}/settings/gc_rules | 
 *RetentionApi* | [**prepareGarbageCollectionCommits**](docs/RetentionApi.md#prepareGarbageCollectionCommits) | **POST** /repositories/{repository}/gc/prepare_commits | save lists of active commits for garbage collection
 *RetentionApi* | [**prepareGarbageCollectionUncommitted**](docs/RetentionApi.md#prepareGarbageCollectionUncommitted) | **POST** /repositories/{repository}/gc/prepare_uncommited | save repository uncommitted metadata for garbage collection
 *StagingApi* | [**getPhysicalAddress**](docs/StagingApi.md#getPhysicalAddress) | **GET** /repositories/{repository}/branches/{branch}/staging/backing | get a physical address and a return token to write object to underlying storage
diff --git a/clients/java/api/openapi.yaml b/clients/java/api/openapi.yaml
index dd523ef755c..758a4c95fe6 100644
--- a/clients/java/api/openapi.yaml
+++ b/clients/java/api/openapi.yaml
@@ -1778,6 +1778,234 @@ paths:
       tags:
       - repositories
       x-accepts: application/json
+  /repositories/{repository}/settings/gc_rules:
+    delete:
+      operationId: deleteGCRules
+      parameters:
+      - explode: false
+        in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+        style: simple
+      responses:
+        "204":
+          description: deleted garbage collection rules successfully
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Resource Not Found
+        default:
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Internal Server Error
+      tags:
+      - repositories
+      x-accepts: application/json
+    get:
+      operationId: getGCRules
+      parameters:
+      - explode: false
+        in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+        style: simple
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GarbageCollectionRules'
+          description: repository GC rules
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Resource Not Found
+        default:
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Internal Server Error
+      summary: get repository GC rules
+      tags:
+      - repositories
+      x-accepts: application/json
+    put:
+      operationId: setGCRules
+      parameters:
+      - explode: false
+        in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+        style: simple
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GarbageCollectionRules'
+        required: true
+      responses:
+        "204":
+          description: set garbage collection rules successfully
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Resource Not Found
+        default:
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Internal Server Error
+      tags:
+      - repositories
+      x-contentType: application/json
+      x-accepts: application/json
+  /repositories/{repository}/settings/branch_protection:
+    get:
+      operationId: getBranchProtectionRules
+      parameters:
+      - explode: false
+        in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+        style: simple
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: '#/components/schemas/BranchProtectionRule'
+                type: array
+          description: branch protection rules
+          headers:
+            ETag:
+              explode: false
+              schema:
+                description: ETag of the branch protection rules
+                type: string
+              style: simple
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Resource Not Found
+        default:
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Internal Server Error
+      summary: get branch protection rules
+      tags:
+      - repositories
+      x-accepts: application/json
+    put:
+      operationId: setBranchProtectionRules
+      parameters:
+      - explode: false
+        in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+        style: simple
+      - description: if provided, the branch protection rules will be updated only
+          if the current ETag match the provided value
+        explode: false
+        in: header
+        name: If-Match
+        required: false
+        schema:
+          type: string
+        style: simple
+      requestBody:
+        content:
+          application/json:
+            schema:
+              items:
+                $ref: '#/components/schemas/BranchProtectionRule'
+              type: array
+        required: true
+      responses:
+        "204":
+          description: branch protection rule created successfully
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Unauthorized
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Resource Not Found
+        "412":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Precondition Failed
+        default:
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+          description: Internal Server Error
+      tags:
+      - repositories
+      x-contentType: application/json
+      x-accepts: application/json
   /otf/diffs:
     get:
       operationId: getOtfDiffs
@@ -4807,7 +5035,7 @@ paths:
       x-accepts: application/json
   /repositories/{repository}/gc/rules:
     delete:
-      operationId: delete garbage collection rules
+      operationId: internalDeleteGarbageCollectionRules
       parameters:
       - explode: false
         in: path
@@ -4841,7 +5069,7 @@ paths:
       - internal
       x-accepts: application/json
     get:
-      operationId: getGarbageCollectionRules
+      operationId: internalGetGarbageCollectionRules
       parameters:
       - explode: false
         in: path
@@ -4879,7 +5107,7 @@ paths:
       - internal
       x-accepts: application/json
     post:
-      operationId: set garbage collection rules
+      operationId: internalSetGarbageCollectionRules
       parameters:
       - explode: false
         in: path
@@ -5055,7 +5283,7 @@ paths:
       x-accepts: application/json
   /repositories/{repository}/branch_protection:
     delete:
-      operationId: deleteBranchProtectionRule
+      operationId: internalDeleteBranchProtectionRule
       parameters:
       - explode: false
         in: path
@@ -5102,7 +5330,7 @@ paths:
       x-contentType: application/json
       x-accepts: application/json
     get:
-      operationId: getBranchProtectionRules
+      operationId: internalGetBranchProtectionRules
       parameters:
       - explode: false
         in: path
@@ -5143,7 +5371,7 @@ paths:
       - internal
       x-accepts: application/json
     post:
-      operationId: createBranchProtectionRule
+      operationId: internalCreateBranchProtectionRule
       parameters:
       - explode: false
         in: path
diff --git a/clients/java/docs/InternalApi.md b/clients/java/docs/InternalApi.md
index 39bf08a3143..fd9065706fe 100644
--- a/clients/java/docs/InternalApi.md
+++ b/clients/java/docs/InternalApi.md
@@ -4,27 +4,27 @@ All URIs are relative to *http://localhost/api/v1*
 
 Method | HTTP request | Description
 ------------- | ------------- | -------------
-[**createBranchProtectionRule**](InternalApi.md#createBranchProtectionRule) | **POST** /repositories/{repository}/branch_protection | 
 [**createBranchProtectionRulePreflight**](InternalApi.md#createBranchProtectionRulePreflight) | **GET** /repositories/{repository}/branch_protection/set_allowed | 
 [**createSymlinkFile**](InternalApi.md#createSymlinkFile) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
-[**deleteBranchProtectionRule**](InternalApi.md#deleteBranchProtectionRule) | **DELETE** /repositories/{repository}/branch_protection | 
-[**deleteGarbageCollectionRules**](InternalApi.md#deleteGarbageCollectionRules) | **DELETE** /repositories/{repository}/gc/rules | 
 [**getAuthCapabilities**](InternalApi.md#getAuthCapabilities) | **GET** /auth/capabilities | list authentication capabilities supported
-[**getBranchProtectionRules**](InternalApi.md#getBranchProtectionRules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
 [**getGarbageCollectionConfig**](InternalApi.md#getGarbageCollectionConfig) | **GET** /config/garbage-collection | 
-[**getGarbageCollectionRules**](InternalApi.md#getGarbageCollectionRules) | **GET** /repositories/{repository}/gc/rules | 
 [**getSetupState**](InternalApi.md#getSetupState) | **GET** /setup_lakefs | check if the lakeFS installation is already set up
+[**internalCreateBranchProtectionRule**](InternalApi.md#internalCreateBranchProtectionRule) | **POST** /repositories/{repository}/branch_protection | 
+[**internalDeleteBranchProtectionRule**](InternalApi.md#internalDeleteBranchProtectionRule) | **DELETE** /repositories/{repository}/branch_protection | 
+[**internalDeleteGarbageCollectionRules**](InternalApi.md#internalDeleteGarbageCollectionRules) | **DELETE** /repositories/{repository}/gc/rules | 
+[**internalGetBranchProtectionRules**](InternalApi.md#internalGetBranchProtectionRules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
+[**internalGetGarbageCollectionRules**](InternalApi.md#internalGetGarbageCollectionRules) | **GET** /repositories/{repository}/gc/rules | 
+[**internalSetGarbageCollectionRules**](InternalApi.md#internalSetGarbageCollectionRules) | **POST** /repositories/{repository}/gc/rules | 
 [**postStatsEvents**](InternalApi.md#postStatsEvents) | **POST** /statistics | post stats events, this endpoint is meant for internal use only
-[**setGarbageCollectionRules**](InternalApi.md#setGarbageCollectionRules) | **POST** /repositories/{repository}/gc/rules | 
 [**setGarbageCollectionRulesPreflight**](InternalApi.md#setGarbageCollectionRulesPreflight) | **GET** /repositories/{repository}/gc/rules/set_allowed | 
 [**setup**](InternalApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 [**setupCommPrefs**](InternalApi.md#setupCommPrefs) | **POST** /setup_comm_prefs | setup communications preferences
 [**uploadObjectPreflight**](InternalApi.md#uploadObjectPreflight) | **GET** /repositories/{repository}/branches/{branch}/objects/stage_allowed | 
 
 
-<a name="createBranchProtectionRule"></a>
-# **createBranchProtectionRule**
-> createBranchProtectionRule(repository, branchProtectionRule)
+<a name="createBranchProtectionRulePreflight"></a>
+# **createBranchProtectionRulePreflight**
+> createBranchProtectionRulePreflight(repository)
 
 
 
@@ -72,11 +72,10 @@ public class Example {
 
     InternalApi apiInstance = new InternalApi(defaultClient);
     String repository = "repository_example"; // String | 
-    BranchProtectionRule branchProtectionRule = new BranchProtectionRule(); // BranchProtectionRule | 
     try {
-      apiInstance.createBranchProtectionRule(repository, branchProtectionRule);
+      apiInstance.createBranchProtectionRulePreflight(repository);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#createBranchProtectionRule");
+      System.err.println("Exception when calling InternalApi#createBranchProtectionRulePreflight");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -91,7 +90,6 @@ public class Example {
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **String**|  |
- **branchProtectionRule** | [**BranchProtectionRule**](BranchProtectionRule.md)|  |
 
 ### Return type
 
@@ -103,22 +101,23 @@ null (empty response body)
 
 ### HTTP request headers
 
- - **Content-Type**: application/json
+ - **Content-Type**: Not defined
  - **Accept**: application/json
 
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | branch protection rule created successfully |  -  |
+**204** | User has permissions to create a branch protection rule in this repository |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
+**409** | Resource Conflicts With Target |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="createBranchProtectionRulePreflight"></a>
-# **createBranchProtectionRulePreflight**
-> createBranchProtectionRulePreflight(repository)
-
+<a name="createSymlinkFile"></a>
+# **createSymlinkFile**
+> StorageURI createSymlinkFile(repository, branch, location)
 
+creates symlink files corresponding to the given directory
 
 ### Example
 ```java
@@ -164,10 +163,13 @@ public class Example {
 
     InternalApi apiInstance = new InternalApi(defaultClient);
     String repository = "repository_example"; // String | 
+    String branch = "branch_example"; // String | 
+    String location = "location_example"; // String | path to the table data
     try {
-      apiInstance.createBranchProtectionRulePreflight(repository);
+      StorageURI result = apiInstance.createSymlinkFile(repository, branch, location);
+      System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#createBranchProtectionRulePreflight");
+      System.err.println("Exception when calling InternalApi#createSymlinkFile");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -182,10 +184,12 @@ public class Example {
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **String**|  |
+ **branch** | **String**|  |
+ **location** | **String**| path to the table data | [optional]
 
 ### Return type
 
-null (empty response body)
+[**StorageURI**](StorageURI.md)
 
 ### Authorization
 
@@ -199,17 +203,16 @@ null (empty response body)
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | User has permissions to create a branch protection rule in this repository |  -  |
+**201** | location created |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
-**409** | Resource Conflicts With Target |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="createSymlinkFile"></a>
-# **createSymlinkFile**
-> StorageURI createSymlinkFile(repository, branch, location)
+<a name="getAuthCapabilities"></a>
+# **getAuthCapabilities**
+> AuthCapabilities getAuthCapabilities()
 
-creates symlink files corresponding to the given directory
+list authentication capabilities supported
 
 ### Example
 ```java
@@ -217,7 +220,6 @@ creates symlink files corresponding to the given directory
 import io.lakefs.clients.api.ApiClient;
 import io.lakefs.clients.api.ApiException;
 import io.lakefs.clients.api.Configuration;
-import io.lakefs.clients.api.auth.*;
 import io.lakefs.clients.api.models.*;
 import io.lakefs.clients.api.InternalApi;
 
@@ -225,43 +227,13 @@ public class Example {
   public static void main(String[] args) {
     ApiClient defaultClient = Configuration.getDefaultApiClient();
     defaultClient.setBasePath("http://localhost/api/v1");
-    
-    // Configure HTTP basic authorization: basic_auth
-    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
-    basic_auth.setUsername("YOUR USERNAME");
-    basic_auth.setPassword("YOUR PASSWORD");
-
-    // Configure API key authorization: cookie_auth
-    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
-    cookie_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //cookie_auth.setApiKeyPrefix("Token");
-
-    // Configure HTTP bearer authorization: jwt_token
-    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
-    jwt_token.setBearerToken("BEARER TOKEN");
-
-    // Configure API key authorization: oidc_auth
-    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
-    oidc_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //oidc_auth.setApiKeyPrefix("Token");
-
-    // Configure API key authorization: saml_auth
-    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
-    saml_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
-    String repository = "repository_example"; // String | 
-    String branch = "branch_example"; // String | 
-    String location = "location_example"; // String | path to the table data
     try {
-      StorageURI result = apiInstance.createSymlinkFile(repository, branch, location);
+      AuthCapabilities result = apiInstance.getAuthCapabilities();
       System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#createSymlinkFile");
+      System.err.println("Exception when calling InternalApi#getAuthCapabilities");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -272,20 +244,15 @@ public class Example {
 ```
 
 ### Parameters
-
-Name | Type | Description  | Notes
-------------- | ------------- | ------------- | -------------
- **repository** | **String**|  |
- **branch** | **String**|  |
- **location** | **String**| path to the table data | [optional]
+This endpoint does not need any parameter.
 
 ### Return type
 
-[**StorageURI**](StorageURI.md)
+[**AuthCapabilities**](AuthCapabilities.md)
 
 ### Authorization
 
-[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+No authorization required
 
 ### HTTP request headers
 
@@ -295,16 +262,16 @@ Name | Type | Description  | Notes
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**201** | location created |  -  |
-**401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
+**200** | auth capabilities |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="deleteBranchProtectionRule"></a>
-# **deleteBranchProtectionRule**
-> deleteBranchProtectionRule(repository, inlineObject1)
+<a name="getGarbageCollectionConfig"></a>
+# **getGarbageCollectionConfig**
+> GarbageCollectionConfig getGarbageCollectionConfig()
+
 
 
+get information of gc settings
 
 ### Example
 ```java
@@ -349,12 +316,11 @@ public class Example {
     //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
-    String repository = "repository_example"; // String | 
-    InlineObject1 inlineObject1 = new InlineObject1(); // InlineObject1 | 
     try {
-      apiInstance.deleteBranchProtectionRule(repository, inlineObject1);
+      GarbageCollectionConfig result = apiInstance.getGarbageCollectionConfig();
+      System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#deleteBranchProtectionRule");
+      System.err.println("Exception when calling InternalApi#getGarbageCollectionConfig");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -365,15 +331,11 @@ public class Example {
 ```
 
 ### Parameters
-
-Name | Type | Description  | Notes
-------------- | ------------- | ------------- | -------------
- **repository** | **String**|  |
- **inlineObject1** | [**InlineObject1**](InlineObject1.md)|  |
+This endpoint does not need any parameter.
 
 ### Return type
 
-null (empty response body)
+[**GarbageCollectionConfig**](GarbageCollectionConfig.md)
 
 ### Authorization
 
@@ -381,22 +343,20 @@ null (empty response body)
 
 ### HTTP request headers
 
- - **Content-Type**: application/json
+ - **Content-Type**: Not defined
  - **Accept**: application/json
 
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | branch protection rule deleted successfully |  -  |
+**200** | lakeFS garbage collection config |  -  |
 **401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
-**0** | Internal Server Error |  -  |
-
-<a name="deleteGarbageCollectionRules"></a>
-# **deleteGarbageCollectionRules**
-> deleteGarbageCollectionRules(repository)
 
+<a name="getSetupState"></a>
+# **getSetupState**
+> SetupState getSetupState()
 
+check if the lakeFS installation is already set up
 
 ### Example
 ```java
@@ -404,7 +364,6 @@ null (empty response body)
 import io.lakefs.clients.api.ApiClient;
 import io.lakefs.clients.api.ApiException;
 import io.lakefs.clients.api.Configuration;
-import io.lakefs.clients.api.auth.*;
 import io.lakefs.clients.api.models.*;
 import io.lakefs.clients.api.InternalApi;
 
@@ -412,40 +371,13 @@ public class Example {
   public static void main(String[] args) {
     ApiClient defaultClient = Configuration.getDefaultApiClient();
     defaultClient.setBasePath("http://localhost/api/v1");
-    
-    // Configure HTTP basic authorization: basic_auth
-    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
-    basic_auth.setUsername("YOUR USERNAME");
-    basic_auth.setPassword("YOUR PASSWORD");
-
-    // Configure API key authorization: cookie_auth
-    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
-    cookie_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //cookie_auth.setApiKeyPrefix("Token");
-
-    // Configure HTTP bearer authorization: jwt_token
-    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
-    jwt_token.setBearerToken("BEARER TOKEN");
-
-    // Configure API key authorization: oidc_auth
-    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
-    oidc_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //oidc_auth.setApiKeyPrefix("Token");
-
-    // Configure API key authorization: saml_auth
-    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
-    saml_auth.setApiKey("YOUR API KEY");
-    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
-    //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
-    String repository = "repository_example"; // String | 
     try {
-      apiInstance.deleteGarbageCollectionRules(repository);
+      SetupState result = apiInstance.getSetupState();
+      System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#deleteGarbageCollectionRules");
+      System.err.println("Exception when calling InternalApi#getSetupState");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -456,18 +388,15 @@ public class Example {
 ```
 
 ### Parameters
-
-Name | Type | Description  | Notes
-------------- | ------------- | ------------- | -------------
- **repository** | **String**|  |
+This endpoint does not need any parameter.
 
 ### Return type
 
-null (empty response body)
+[**SetupState**](SetupState.md)
 
 ### Authorization
 
-[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+No authorization required
 
 ### HTTP request headers
 
@@ -477,16 +406,14 @@ null (empty response body)
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | deleted garbage collection rules successfully |  -  |
-**401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
+**200** | lakeFS setup state |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="getAuthCapabilities"></a>
-# **getAuthCapabilities**
-> AuthCapabilities getAuthCapabilities()
+<a name="internalCreateBranchProtectionRule"></a>
+# **internalCreateBranchProtectionRule**
+> internalCreateBranchProtectionRule(repository, branchProtectionRule)
+
 
-list authentication capabilities supported
 
 ### Example
 ```java
@@ -494,6 +421,7 @@ list authentication capabilities supported
 import io.lakefs.clients.api.ApiClient;
 import io.lakefs.clients.api.ApiException;
 import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
 import io.lakefs.clients.api.models.*;
 import io.lakefs.clients.api.InternalApi;
 
@@ -501,13 +429,41 @@ public class Example {
   public static void main(String[] args) {
     ApiClient defaultClient = Configuration.getDefaultApiClient();
     defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    BranchProtectionRule branchProtectionRule = new BranchProtectionRule(); // BranchProtectionRule | 
     try {
-      AuthCapabilities result = apiInstance.getAuthCapabilities();
-      System.out.println(result);
+      apiInstance.internalCreateBranchProtectionRule(repository, branchProtectionRule);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#getAuthCapabilities");
+      System.err.println("Exception when calling InternalApi#internalCreateBranchProtectionRule");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -518,32 +474,38 @@ public class Example {
 ```
 
 ### Parameters
-This endpoint does not need any parameter.
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+ **branchProtectionRule** | [**BranchProtectionRule**](BranchProtectionRule.md)|  |
 
 ### Return type
 
-[**AuthCapabilities**](AuthCapabilities.md)
+null (empty response body)
 
 ### Authorization
 
-No authorization required
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
 
 ### HTTP request headers
 
- - **Content-Type**: Not defined
+ - **Content-Type**: application/json
  - **Accept**: application/json
 
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | auth capabilities |  -  |
+**204** | branch protection rule created successfully |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="getBranchProtectionRules"></a>
-# **getBranchProtectionRules**
-> List&lt;BranchProtectionRule&gt; getBranchProtectionRules(repository)
+<a name="internalDeleteBranchProtectionRule"></a>
+# **internalDeleteBranchProtectionRule**
+> internalDeleteBranchProtectionRule(repository, inlineObject1)
+
 
-get branch protection rules
 
 ### Example
 ```java
@@ -589,11 +551,11 @@ public class Example {
 
     InternalApi apiInstance = new InternalApi(defaultClient);
     String repository = "repository_example"; // String | 
+    InlineObject1 inlineObject1 = new InlineObject1(); // InlineObject1 | 
     try {
-      List<BranchProtectionRule> result = apiInstance.getBranchProtectionRules(repository);
-      System.out.println(result);
+      apiInstance.internalDeleteBranchProtectionRule(repository, inlineObject1);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#getBranchProtectionRules");
+      System.err.println("Exception when calling InternalApi#internalDeleteBranchProtectionRule");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -608,10 +570,11 @@ public class Example {
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **String**|  |
+ **inlineObject1** | [**InlineObject1**](InlineObject1.md)|  |
 
 ### Return type
 
-[**List&lt;BranchProtectionRule&gt;**](BranchProtectionRule.md)
+null (empty response body)
 
 ### Authorization
 
@@ -619,24 +582,22 @@ Name | Type | Description  | Notes
 
 ### HTTP request headers
 
- - **Content-Type**: Not defined
+ - **Content-Type**: application/json
  - **Accept**: application/json
 
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | branch protection rules |  -  |
+**204** | branch protection rule deleted successfully |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="getGarbageCollectionConfig"></a>
-# **getGarbageCollectionConfig**
-> GarbageCollectionConfig getGarbageCollectionConfig()
-
+<a name="internalDeleteGarbageCollectionRules"></a>
+# **internalDeleteGarbageCollectionRules**
+> internalDeleteGarbageCollectionRules(repository)
 
 
-get information of gc settings
 
 ### Example
 ```java
@@ -681,11 +642,11 @@ public class Example {
     //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
+    String repository = "repository_example"; // String | 
     try {
-      GarbageCollectionConfig result = apiInstance.getGarbageCollectionConfig();
-      System.out.println(result);
+      apiInstance.internalDeleteGarbageCollectionRules(repository);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#getGarbageCollectionConfig");
+      System.err.println("Exception when calling InternalApi#internalDeleteGarbageCollectionRules");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -696,11 +657,14 @@ public class Example {
 ```
 
 ### Parameters
-This endpoint does not need any parameter.
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
 
 ### Return type
 
-[**GarbageCollectionConfig**](GarbageCollectionConfig.md)
+null (empty response body)
 
 ### Authorization
 
@@ -714,14 +678,16 @@ This endpoint does not need any parameter.
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | lakeFS garbage collection config |  -  |
+**204** | deleted garbage collection rules successfully |  -  |
 **401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
 
-<a name="getGarbageCollectionRules"></a>
-# **getGarbageCollectionRules**
-> GarbageCollectionRules getGarbageCollectionRules(repository)
-
+<a name="internalGetBranchProtectionRules"></a>
+# **internalGetBranchProtectionRules**
+> List&lt;BranchProtectionRule&gt; internalGetBranchProtectionRules(repository)
 
+get branch protection rules
 
 ### Example
 ```java
@@ -768,10 +734,10 @@ public class Example {
     InternalApi apiInstance = new InternalApi(defaultClient);
     String repository = "repository_example"; // String | 
     try {
-      GarbageCollectionRules result = apiInstance.getGarbageCollectionRules(repository);
+      List<BranchProtectionRule> result = apiInstance.internalGetBranchProtectionRules(repository);
       System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#getGarbageCollectionRules");
+      System.err.println("Exception when calling InternalApi#internalGetBranchProtectionRules");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -789,7 +755,7 @@ Name | Type | Description  | Notes
 
 ### Return type
 
-[**GarbageCollectionRules**](GarbageCollectionRules.md)
+[**List&lt;BranchProtectionRule&gt;**](BranchProtectionRule.md)
 
 ### Authorization
 
@@ -803,16 +769,16 @@ Name | Type | Description  | Notes
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | gc rule list |  -  |
+**200** | branch protection rules |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="getSetupState"></a>
-# **getSetupState**
-> SetupState getSetupState()
+<a name="internalGetGarbageCollectionRules"></a>
+# **internalGetGarbageCollectionRules**
+> GarbageCollectionRules internalGetGarbageCollectionRules(repository)
+
 
-check if the lakeFS installation is already set up
 
 ### Example
 ```java
@@ -820,6 +786,7 @@ check if the lakeFS installation is already set up
 import io.lakefs.clients.api.ApiClient;
 import io.lakefs.clients.api.ApiException;
 import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
 import io.lakefs.clients.api.models.*;
 import io.lakefs.clients.api.InternalApi;
 
@@ -827,13 +794,41 @@ public class Example {
   public static void main(String[] args) {
     ApiClient defaultClient = Configuration.getDefaultApiClient();
     defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
+    String repository = "repository_example"; // String | 
     try {
-      SetupState result = apiInstance.getSetupState();
+      GarbageCollectionRules result = apiInstance.internalGetGarbageCollectionRules(repository);
       System.out.println(result);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#getSetupState");
+      System.err.println("Exception when calling InternalApi#internalGetGarbageCollectionRules");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -844,15 +839,18 @@ public class Example {
 ```
 
 ### Parameters
-This endpoint does not need any parameter.
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
 
 ### Return type
 
-[**SetupState**](SetupState.md)
+[**GarbageCollectionRules**](GarbageCollectionRules.md)
 
 ### Authorization
 
-No authorization required
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
 
 ### HTTP request headers
 
@@ -862,14 +860,16 @@ No authorization required
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | lakeFS setup state |  -  |
+**200** | gc rule list |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="postStatsEvents"></a>
-# **postStatsEvents**
-> postStatsEvents(statsEventsList)
+<a name="internalSetGarbageCollectionRules"></a>
+# **internalSetGarbageCollectionRules**
+> internalSetGarbageCollectionRules(repository, garbageCollectionRules)
+
 
-post stats events, this endpoint is meant for internal use only
 
 ### Example
 ```java
@@ -914,11 +914,12 @@ public class Example {
     //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
-    StatsEventsList statsEventsList = new StatsEventsList(); // StatsEventsList | 
+    String repository = "repository_example"; // String | 
+    GarbageCollectionRules garbageCollectionRules = new GarbageCollectionRules(); // GarbageCollectionRules | 
     try {
-      apiInstance.postStatsEvents(statsEventsList);
+      apiInstance.internalSetGarbageCollectionRules(repository, garbageCollectionRules);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#postStatsEvents");
+      System.err.println("Exception when calling InternalApi#internalSetGarbageCollectionRules");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -932,7 +933,8 @@ public class Example {
 
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
- **statsEventsList** | [**StatsEventsList**](StatsEventsList.md)|  |
+ **repository** | **String**|  |
+ **garbageCollectionRules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
 
 ### Return type
 
@@ -950,16 +952,16 @@ null (empty response body)
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | reported successfully |  -  |
-**400** | Bad Request |  -  |
+**204** | set garbage collection rules successfully |  -  |
 **401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
-<a name="setGarbageCollectionRules"></a>
-# **setGarbageCollectionRules**
-> setGarbageCollectionRules(repository, garbageCollectionRules)
-
+<a name="postStatsEvents"></a>
+# **postStatsEvents**
+> postStatsEvents(statsEventsList)
 
+post stats events, this endpoint is meant for internal use only
 
 ### Example
 ```java
@@ -1004,12 +1006,11 @@ public class Example {
     //saml_auth.setApiKeyPrefix("Token");
 
     InternalApi apiInstance = new InternalApi(defaultClient);
-    String repository = "repository_example"; // String | 
-    GarbageCollectionRules garbageCollectionRules = new GarbageCollectionRules(); // GarbageCollectionRules | 
+    StatsEventsList statsEventsList = new StatsEventsList(); // StatsEventsList | 
     try {
-      apiInstance.setGarbageCollectionRules(repository, garbageCollectionRules);
+      apiInstance.postStatsEvents(statsEventsList);
     } catch (ApiException e) {
-      System.err.println("Exception when calling InternalApi#setGarbageCollectionRules");
+      System.err.println("Exception when calling InternalApi#postStatsEvents");
       System.err.println("Status code: " + e.getCode());
       System.err.println("Reason: " + e.getResponseBody());
       System.err.println("Response headers: " + e.getResponseHeaders());
@@ -1023,8 +1024,7 @@ public class Example {
 
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
- **repository** | **String**|  |
- **garbageCollectionRules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
+ **statsEventsList** | [**StatsEventsList**](StatsEventsList.md)|  |
 
 ### Return type
 
@@ -1042,9 +1042,9 @@ null (empty response body)
 ### HTTP response details
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | set garbage collection rules successfully |  -  |
+**204** | reported successfully |  -  |
+**400** | Bad Request |  -  |
 **401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 <a name="setGarbageCollectionRulesPreflight"></a>
diff --git a/clients/java/docs/RepositoriesApi.md b/clients/java/docs/RepositoriesApi.md
index cb4c5ca4b90..aee158c9972 100644
--- a/clients/java/docs/RepositoriesApi.md
+++ b/clients/java/docs/RepositoriesApi.md
@@ -5,10 +5,15 @@ All URIs are relative to *http://localhost/api/v1*
 Method | HTTP request | Description
 ------------- | ------------- | -------------
 [**createRepository**](RepositoriesApi.md#createRepository) | **POST** /repositories | create repository
+[**deleteGCRules**](RepositoriesApi.md#deleteGCRules) | **DELETE** /repositories/{repository}/settings/gc_rules | 
 [**deleteRepository**](RepositoriesApi.md#deleteRepository) | **DELETE** /repositories/{repository} | delete repository
+[**getBranchProtectionRules**](RepositoriesApi.md#getBranchProtectionRules) | **GET** /repositories/{repository}/settings/branch_protection | get branch protection rules
+[**getGCRules**](RepositoriesApi.md#getGCRules) | **GET** /repositories/{repository}/settings/gc_rules | get repository GC rules
 [**getRepository**](RepositoriesApi.md#getRepository) | **GET** /repositories/{repository} | get repository
 [**getRepositoryMetadata**](RepositoriesApi.md#getRepositoryMetadata) | **GET** /repositories/{repository}/metadata | get repository metadata
 [**listRepositories**](RepositoriesApi.md#listRepositories) | **GET** /repositories | list repositories
+[**setBranchProtectionRules**](RepositoriesApi.md#setBranchProtectionRules) | **PUT** /repositories/{repository}/settings/branch_protection | 
+[**setGCRules**](RepositoriesApi.md#setGCRules) | **PUT** /repositories/{repository}/settings/gc_rules | 
 
 
 <a name="createRepository"></a>
@@ -105,6 +110,96 @@ Name | Type | Description  | Notes
 **409** | Resource Conflicts With Target |  -  |
 **0** | Internal Server Error |  -  |
 
+<a name="deleteGCRules"></a>
+# **deleteGCRules**
+> deleteGCRules(repository)
+
+
+
+### Example
+```java
+// Import classes:
+import io.lakefs.clients.api.ApiClient;
+import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
+import io.lakefs.clients.api.models.*;
+import io.lakefs.clients.api.RepositoriesApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = Configuration.getDefaultApiClient();
+    defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
+
+    RepositoriesApi apiInstance = new RepositoriesApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    try {
+      apiInstance.deleteGCRules(repository);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling RepositoriesApi#deleteGCRules");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+
+### Return type
+
+null (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+### HTTP response details
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | deleted garbage collection rules successfully |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
 <a name="deleteRepository"></a>
 # **deleteRepository**
 > deleteRepository(repository)
@@ -195,6 +290,188 @@ null (empty response body)
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
+<a name="getBranchProtectionRules"></a>
+# **getBranchProtectionRules**
+> List&lt;BranchProtectionRule&gt; getBranchProtectionRules(repository)
+
+get branch protection rules
+
+### Example
+```java
+// Import classes:
+import io.lakefs.clients.api.ApiClient;
+import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
+import io.lakefs.clients.api.models.*;
+import io.lakefs.clients.api.RepositoriesApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = Configuration.getDefaultApiClient();
+    defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
+
+    RepositoriesApi apiInstance = new RepositoriesApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    try {
+      List<BranchProtectionRule> result = apiInstance.getBranchProtectionRules(repository);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling RepositoriesApi#getBranchProtectionRules");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+
+### Return type
+
+[**List&lt;BranchProtectionRule&gt;**](BranchProtectionRule.md)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+### HTTP response details
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | branch protection rules |  * ETag -  <br>  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
+<a name="getGCRules"></a>
+# **getGCRules**
+> GarbageCollectionRules getGCRules(repository)
+
+get repository GC rules
+
+### Example
+```java
+// Import classes:
+import io.lakefs.clients.api.ApiClient;
+import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
+import io.lakefs.clients.api.models.*;
+import io.lakefs.clients.api.RepositoriesApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = Configuration.getDefaultApiClient();
+    defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
+
+    RepositoriesApi apiInstance = new RepositoriesApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    try {
+      GarbageCollectionRules result = apiInstance.getGCRules(repository);
+      System.out.println(result);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling RepositoriesApi#getGCRules");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+
+### Return type
+
+[**GarbageCollectionRules**](GarbageCollectionRules.md)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+### HTTP response details
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | repository GC rules |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
 <a name="getRepository"></a>
 # **getRepository**
 > Repository getRepository(repository)
@@ -471,3 +748,191 @@ Name | Type | Description  | Notes
 **401** | Unauthorized |  -  |
 **0** | Internal Server Error |  -  |
 
+<a name="setBranchProtectionRules"></a>
+# **setBranchProtectionRules**
+> setBranchProtectionRules(repository, branchProtectionRule, ifMatch)
+
+
+
+### Example
+```java
+// Import classes:
+import io.lakefs.clients.api.ApiClient;
+import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
+import io.lakefs.clients.api.models.*;
+import io.lakefs.clients.api.RepositoriesApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = Configuration.getDefaultApiClient();
+    defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
+
+    RepositoriesApi apiInstance = new RepositoriesApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    List<BranchProtectionRule> branchProtectionRule = Arrays.asList(); // List<BranchProtectionRule> | 
+    String ifMatch = "ifMatch_example"; // String | if provided, the branch protection rules will be updated only if the current ETag match the provided value
+    try {
+      apiInstance.setBranchProtectionRules(repository, branchProtectionRule, ifMatch);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling RepositoriesApi#setBranchProtectionRules");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+ **branchProtectionRule** | [**List&lt;BranchProtectionRule&gt;**](BranchProtectionRule.md)|  |
+ **ifMatch** | **String**| if provided, the branch protection rules will be updated only if the current ETag match the provided value | [optional]
+
+### Return type
+
+null (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+### HTTP response details
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | branch protection rule created successfully |  -  |
+**400** | Bad Request |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**412** | Precondition Failed |  -  |
+**0** | Internal Server Error |  -  |
+
+<a name="setGCRules"></a>
+# **setGCRules**
+> setGCRules(repository, garbageCollectionRules)
+
+
+
+### Example
+```java
+// Import classes:
+import io.lakefs.clients.api.ApiClient;
+import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.Configuration;
+import io.lakefs.clients.api.auth.*;
+import io.lakefs.clients.api.models.*;
+import io.lakefs.clients.api.RepositoriesApi;
+
+public class Example {
+  public static void main(String[] args) {
+    ApiClient defaultClient = Configuration.getDefaultApiClient();
+    defaultClient.setBasePath("http://localhost/api/v1");
+    
+    // Configure HTTP basic authorization: basic_auth
+    HttpBasicAuth basic_auth = (HttpBasicAuth) defaultClient.getAuthentication("basic_auth");
+    basic_auth.setUsername("YOUR USERNAME");
+    basic_auth.setPassword("YOUR PASSWORD");
+
+    // Configure API key authorization: cookie_auth
+    ApiKeyAuth cookie_auth = (ApiKeyAuth) defaultClient.getAuthentication("cookie_auth");
+    cookie_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //cookie_auth.setApiKeyPrefix("Token");
+
+    // Configure HTTP bearer authorization: jwt_token
+    HttpBearerAuth jwt_token = (HttpBearerAuth) defaultClient.getAuthentication("jwt_token");
+    jwt_token.setBearerToken("BEARER TOKEN");
+
+    // Configure API key authorization: oidc_auth
+    ApiKeyAuth oidc_auth = (ApiKeyAuth) defaultClient.getAuthentication("oidc_auth");
+    oidc_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //oidc_auth.setApiKeyPrefix("Token");
+
+    // Configure API key authorization: saml_auth
+    ApiKeyAuth saml_auth = (ApiKeyAuth) defaultClient.getAuthentication("saml_auth");
+    saml_auth.setApiKey("YOUR API KEY");
+    // Uncomment the following line to set a prefix for the API key, e.g. "Token" (defaults to null)
+    //saml_auth.setApiKeyPrefix("Token");
+
+    RepositoriesApi apiInstance = new RepositoriesApi(defaultClient);
+    String repository = "repository_example"; // String | 
+    GarbageCollectionRules garbageCollectionRules = new GarbageCollectionRules(); // GarbageCollectionRules | 
+    try {
+      apiInstance.setGCRules(repository, garbageCollectionRules);
+    } catch (ApiException e) {
+      System.err.println("Exception when calling RepositoriesApi#setGCRules");
+      System.err.println("Status code: " + e.getCode());
+      System.err.println("Reason: " + e.getResponseBody());
+      System.err.println("Response headers: " + e.getResponseHeaders());
+      e.printStackTrace();
+    }
+  }
+}
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **String**|  |
+ **garbageCollectionRules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
+
+### Return type
+
+null (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+### HTTP response details
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | set garbage collection rules successfully |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/InternalApi.java b/clients/java/src/main/java/io/lakefs/clients/api/InternalApi.java
index 2bdc65d08e0..d56e8d28785 100644
--- a/clients/java/src/main/java/io/lakefs/clients/api/InternalApi.java
+++ b/clients/java/src/main/java/io/lakefs/clients/api/InternalApi.java
@@ -65,135 +65,6 @@ public void setApiClient(ApiClient apiClient) {
         this.localVarApiClient = apiClient;
     }
 
-    /**
-     * Build call for createBranchProtectionRule
-     * @param repository  (required)
-     * @param branchProtectionRule  (required)
-     * @param _callback Callback for upload/download progress
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     * @http.response.details
-     <table summary="Response Details" border="1">
-        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
-     </table>
-     */
-    public okhttp3.Call createBranchProtectionRuleCall(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback _callback) throws ApiException {
-        Object localVarPostBody = branchProtectionRule;
-
-        // create path and map variables
-        String localVarPath = "/repositories/{repository}/branch_protection"
-            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        Map<String, String> localVarCookieParams = new HashMap<String, String>();
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) {
-            localVarHeaderParams.put("Accept", localVarAccept);
-        }
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
-    }
-
-    @SuppressWarnings("rawtypes")
-    private okhttp3.Call createBranchProtectionRuleValidateBeforeCall(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback _callback) throws ApiException {
-        
-        // verify the required parameter 'repository' is set
-        if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling createBranchProtectionRule(Async)");
-        }
-        
-        // verify the required parameter 'branchProtectionRule' is set
-        if (branchProtectionRule == null) {
-            throw new ApiException("Missing the required parameter 'branchProtectionRule' when calling createBranchProtectionRule(Async)");
-        }
-        
-
-        okhttp3.Call localVarCall = createBranchProtectionRuleCall(repository, branchProtectionRule, _callback);
-        return localVarCall;
-
-    }
-
-    /**
-     * 
-     * 
-     * @param repository  (required)
-     * @param branchProtectionRule  (required)
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     * @http.response.details
-     <table summary="Response Details" border="1">
-        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
-     </table>
-     */
-    public void createBranchProtectionRule(String repository, BranchProtectionRule branchProtectionRule) throws ApiException {
-        createBranchProtectionRuleWithHttpInfo(repository, branchProtectionRule);
-    }
-
-    /**
-     * 
-     * 
-     * @param repository  (required)
-     * @param branchProtectionRule  (required)
-     * @return ApiResponse&lt;Void&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     * @http.response.details
-     <table summary="Response Details" border="1">
-        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
-     </table>
-     */
-    public ApiResponse<Void> createBranchProtectionRuleWithHttpInfo(String repository, BranchProtectionRule branchProtectionRule) throws ApiException {
-        okhttp3.Call localVarCall = createBranchProtectionRuleValidateBeforeCall(repository, branchProtectionRule, null);
-        return localVarApiClient.execute(localVarCall);
-    }
-
-    /**
-     *  (asynchronously)
-     * 
-     * @param repository  (required)
-     * @param branchProtectionRule  (required)
-     * @param _callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     * @http.response.details
-     <table summary="Response Details" border="1">
-        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
-     </table>
-     */
-    public okhttp3.Call createBranchProtectionRuleAsync(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback<Void> _callback) throws ApiException {
-
-        okhttp3.Call localVarCall = createBranchProtectionRuleValidateBeforeCall(repository, branchProtectionRule, _callback);
-        localVarApiClient.executeAsync(localVarCall, _callback);
-        return localVarCall;
-    }
     /**
      * Build call for createBranchProtectionRulePreflight
      * @param repository  (required)
@@ -461,27 +332,22 @@ public okhttp3.Call createSymlinkFileAsync(String repository, String branch, Str
         return localVarCall;
     }
     /**
-     * Build call for deleteBranchProtectionRule
-     * @param repository  (required)
-     * @param inlineObject1  (required)
+     * Build call for getAuthCapabilities
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteBranchProtectionRuleCall(String repository, InlineObject1 inlineObject1, final ApiCallback _callback) throws ApiException {
-        Object localVarPostBody = inlineObject1;
+    public okhttp3.Call getAuthCapabilitiesCall(final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/repositories/{repository}/branch_protection"
-            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+        String localVarPath = "/auth/capabilities";
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -498,118 +364,96 @@ public okhttp3.Call deleteBranchProtectionRuleCall(String repository, InlineObje
         }
 
         final String[] localVarContentTypes = {
-            "application/json"
+            
         };
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
-        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        String[] localVarAuthNames = new String[] {  };
+        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call deleteBranchProtectionRuleValidateBeforeCall(String repository, InlineObject1 inlineObject1, final ApiCallback _callback) throws ApiException {
-        
-        // verify the required parameter 'repository' is set
-        if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling deleteBranchProtectionRule(Async)");
-        }
-        
-        // verify the required parameter 'inlineObject1' is set
-        if (inlineObject1 == null) {
-            throw new ApiException("Missing the required parameter 'inlineObject1' when calling deleteBranchProtectionRule(Async)");
-        }
+    private okhttp3.Call getAuthCapabilitiesValidateBeforeCall(final ApiCallback _callback) throws ApiException {
         
 
-        okhttp3.Call localVarCall = deleteBranchProtectionRuleCall(repository, inlineObject1, _callback);
+        okhttp3.Call localVarCall = getAuthCapabilitiesCall(_callback);
         return localVarCall;
 
     }
 
     /**
+     * list authentication capabilities supported
      * 
-     * 
-     * @param repository  (required)
-     * @param inlineObject1  (required)
+     * @return AuthCapabilities
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public void deleteBranchProtectionRule(String repository, InlineObject1 inlineObject1) throws ApiException {
-        deleteBranchProtectionRuleWithHttpInfo(repository, inlineObject1);
+    public AuthCapabilities getAuthCapabilities() throws ApiException {
+        ApiResponse<AuthCapabilities> localVarResp = getAuthCapabilitiesWithHttpInfo();
+        return localVarResp.getData();
     }
 
     /**
+     * list authentication capabilities supported
      * 
-     * 
-     * @param repository  (required)
-     * @param inlineObject1  (required)
-     * @return ApiResponse&lt;Void&gt;
+     * @return ApiResponse&lt;AuthCapabilities&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Void> deleteBranchProtectionRuleWithHttpInfo(String repository, InlineObject1 inlineObject1) throws ApiException {
-        okhttp3.Call localVarCall = deleteBranchProtectionRuleValidateBeforeCall(repository, inlineObject1, null);
-        return localVarApiClient.execute(localVarCall);
+    public ApiResponse<AuthCapabilities> getAuthCapabilitiesWithHttpInfo() throws ApiException {
+        okhttp3.Call localVarCall = getAuthCapabilitiesValidateBeforeCall(null);
+        Type localVarReturnType = new TypeToken<AuthCapabilities>(){}.getType();
+        return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
-     *  (asynchronously)
+     * list authentication capabilities supported (asynchronously)
      * 
-     * @param repository  (required)
-     * @param inlineObject1  (required)
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
-        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteBranchProtectionRuleAsync(String repository, InlineObject1 inlineObject1, final ApiCallback<Void> _callback) throws ApiException {
+    public okhttp3.Call getAuthCapabilitiesAsync(final ApiCallback<AuthCapabilities> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = deleteBranchProtectionRuleValidateBeforeCall(repository, inlineObject1, _callback);
-        localVarApiClient.executeAsync(localVarCall, _callback);
+        okhttp3.Call localVarCall = getAuthCapabilitiesValidateBeforeCall(_callback);
+        Type localVarReturnType = new TypeToken<AuthCapabilities>(){}.getType();
+        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
-     * Build call for deleteGarbageCollectionRules
-     * @param repository  (required)
+     * Build call for getGarbageCollectionConfig
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteGarbageCollectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call getGarbageCollectionConfigCall(final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/repositories/{repository}/gc/rules"
-            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+        String localVarPath = "/config/garbage-collection";
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -632,100 +476,90 @@ public okhttp3.Call deleteGarbageCollectionRulesCall(String repository, final Ap
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call deleteGarbageCollectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
-        
-        // verify the required parameter 'repository' is set
-        if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling deleteGarbageCollectionRules(Async)");
-        }
+    private okhttp3.Call getGarbageCollectionConfigValidateBeforeCall(final ApiCallback _callback) throws ApiException {
         
 
-        okhttp3.Call localVarCall = deleteGarbageCollectionRulesCall(repository, _callback);
+        okhttp3.Call localVarCall = getGarbageCollectionConfigCall(_callback);
         return localVarCall;
 
     }
 
     /**
      * 
-     * 
-     * @param repository  (required)
+     * get information of gc settings
+     * @return GarbageCollectionConfig
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public void deleteGarbageCollectionRules(String repository) throws ApiException {
-        deleteGarbageCollectionRulesWithHttpInfo(repository);
+    public GarbageCollectionConfig getGarbageCollectionConfig() throws ApiException {
+        ApiResponse<GarbageCollectionConfig> localVarResp = getGarbageCollectionConfigWithHttpInfo();
+        return localVarResp.getData();
     }
 
     /**
      * 
-     * 
-     * @param repository  (required)
-     * @return ApiResponse&lt;Void&gt;
+     * get information of gc settings
+     * @return ApiResponse&lt;GarbageCollectionConfig&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Void> deleteGarbageCollectionRulesWithHttpInfo(String repository) throws ApiException {
-        okhttp3.Call localVarCall = deleteGarbageCollectionRulesValidateBeforeCall(repository, null);
-        return localVarApiClient.execute(localVarCall);
+    public ApiResponse<GarbageCollectionConfig> getGarbageCollectionConfigWithHttpInfo() throws ApiException {
+        okhttp3.Call localVarCall = getGarbageCollectionConfigValidateBeforeCall(null);
+        Type localVarReturnType = new TypeToken<GarbageCollectionConfig>(){}.getType();
+        return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
      *  (asynchronously)
-     * 
-     * @param repository  (required)
+     * get information of gc settings
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
-        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
-        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteGarbageCollectionRulesAsync(String repository, final ApiCallback<Void> _callback) throws ApiException {
+    public okhttp3.Call getGarbageCollectionConfigAsync(final ApiCallback<GarbageCollectionConfig> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = deleteGarbageCollectionRulesValidateBeforeCall(repository, _callback);
-        localVarApiClient.executeAsync(localVarCall, _callback);
+        okhttp3.Call localVarCall = getGarbageCollectionConfigValidateBeforeCall(_callback);
+        Type localVarReturnType = new TypeToken<GarbageCollectionConfig>(){}.getType();
+        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
-     * Build call for getAuthCapabilities
+     * Build call for getSetupState
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getAuthCapabilitiesCall(final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call getSetupStateCall(final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/auth/capabilities";
+        String localVarPath = "/setup_lakefs";
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -752,51 +586,51 @@ public okhttp3.Call getAuthCapabilitiesCall(final ApiCallback _callback) throws
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getAuthCapabilitiesValidateBeforeCall(final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call getSetupStateValidateBeforeCall(final ApiCallback _callback) throws ApiException {
         
 
-        okhttp3.Call localVarCall = getAuthCapabilitiesCall(_callback);
+        okhttp3.Call localVarCall = getSetupStateCall(_callback);
         return localVarCall;
 
     }
 
     /**
-     * list authentication capabilities supported
+     * check if the lakeFS installation is already set up
      * 
-     * @return AuthCapabilities
+     * @return SetupState
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public AuthCapabilities getAuthCapabilities() throws ApiException {
-        ApiResponse<AuthCapabilities> localVarResp = getAuthCapabilitiesWithHttpInfo();
+    public SetupState getSetupState() throws ApiException {
+        ApiResponse<SetupState> localVarResp = getSetupStateWithHttpInfo();
         return localVarResp.getData();
     }
 
     /**
-     * list authentication capabilities supported
+     * check if the lakeFS installation is already set up
      * 
-     * @return ApiResponse&lt;AuthCapabilities&gt;
+     * @return ApiResponse&lt;SetupState&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<AuthCapabilities> getAuthCapabilitiesWithHttpInfo() throws ApiException {
-        okhttp3.Call localVarCall = getAuthCapabilitiesValidateBeforeCall(null);
-        Type localVarReturnType = new TypeToken<AuthCapabilities>(){}.getType();
+    public ApiResponse<SetupState> getSetupStateWithHttpInfo() throws ApiException {
+        okhttp3.Call localVarCall = getSetupStateValidateBeforeCall(null);
+        Type localVarReturnType = new TypeToken<SetupState>(){}.getType();
         return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
-     * list authentication capabilities supported (asynchronously)
+     * check if the lakeFS installation is already set up (asynchronously)
      * 
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
@@ -804,34 +638,35 @@ public ApiResponse<AuthCapabilities> getAuthCapabilitiesWithHttpInfo() throws Ap
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> auth capabilities </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getAuthCapabilitiesAsync(final ApiCallback<AuthCapabilities> _callback) throws ApiException {
+    public okhttp3.Call getSetupStateAsync(final ApiCallback<SetupState> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getAuthCapabilitiesValidateBeforeCall(_callback);
-        Type localVarReturnType = new TypeToken<AuthCapabilities>(){}.getType();
+        okhttp3.Call localVarCall = getSetupStateValidateBeforeCall(_callback);
+        Type localVarReturnType = new TypeToken<SetupState>(){}.getType();
         localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
-     * Build call for getBranchProtectionRules
+     * Build call for internalCreateBranchProtectionRule
      * @param repository  (required)
+     * @param branchProtectionRule  (required)
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getBranchProtectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
-        Object localVarPostBody = null;
+    public okhttp3.Call internalCreateBranchProtectionRuleCall(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = branchProtectionRule;
 
         // create path and map variables
         String localVarPath = "/repositories/{repository}/branch_protection"
@@ -852,110 +687,119 @@ public okhttp3.Call getBranchProtectionRulesCall(String repository, final ApiCal
         }
 
         final String[] localVarContentTypes = {
-            
+            "application/json"
         };
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getBranchProtectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalCreateBranchProtectionRuleValidateBeforeCall(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback _callback) throws ApiException {
         
         // verify the required parameter 'repository' is set
         if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling getBranchProtectionRules(Async)");
+            throw new ApiException("Missing the required parameter 'repository' when calling internalCreateBranchProtectionRule(Async)");
+        }
+        
+        // verify the required parameter 'branchProtectionRule' is set
+        if (branchProtectionRule == null) {
+            throw new ApiException("Missing the required parameter 'branchProtectionRule' when calling internalCreateBranchProtectionRule(Async)");
         }
         
 
-        okhttp3.Call localVarCall = getBranchProtectionRulesCall(repository, _callback);
+        okhttp3.Call localVarCall = internalCreateBranchProtectionRuleCall(repository, branchProtectionRule, _callback);
         return localVarCall;
 
     }
 
     /**
-     * get branch protection rules
+     * 
      * 
      * @param repository  (required)
-     * @return List&lt;BranchProtectionRule&gt;
+     * @param branchProtectionRule  (required)
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public List<BranchProtectionRule> getBranchProtectionRules(String repository) throws ApiException {
-        ApiResponse<List<BranchProtectionRule>> localVarResp = getBranchProtectionRulesWithHttpInfo(repository);
-        return localVarResp.getData();
+    public void internalCreateBranchProtectionRule(String repository, BranchProtectionRule branchProtectionRule) throws ApiException {
+        internalCreateBranchProtectionRuleWithHttpInfo(repository, branchProtectionRule);
     }
 
     /**
-     * get branch protection rules
+     * 
      * 
      * @param repository  (required)
-     * @return ApiResponse&lt;List&lt;BranchProtectionRule&gt;&gt;
+     * @param branchProtectionRule  (required)
+     * @return ApiResponse&lt;Void&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<List<BranchProtectionRule>> getBranchProtectionRulesWithHttpInfo(String repository) throws ApiException {
-        okhttp3.Call localVarCall = getBranchProtectionRulesValidateBeforeCall(repository, null);
-        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
-        return localVarApiClient.execute(localVarCall, localVarReturnType);
+    public ApiResponse<Void> internalCreateBranchProtectionRuleWithHttpInfo(String repository, BranchProtectionRule branchProtectionRule) throws ApiException {
+        okhttp3.Call localVarCall = internalCreateBranchProtectionRuleValidateBeforeCall(repository, branchProtectionRule, null);
+        return localVarApiClient.execute(localVarCall);
     }
 
     /**
-     * get branch protection rules (asynchronously)
+     *  (asynchronously)
      * 
      * @param repository  (required)
+     * @param branchProtectionRule  (required)
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getBranchProtectionRulesAsync(String repository, final ApiCallback<List<BranchProtectionRule>> _callback) throws ApiException {
+    public okhttp3.Call internalCreateBranchProtectionRuleAsync(String repository, BranchProtectionRule branchProtectionRule, final ApiCallback<Void> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getBranchProtectionRulesValidateBeforeCall(repository, _callback);
-        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
-        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
+        okhttp3.Call localVarCall = internalCreateBranchProtectionRuleValidateBeforeCall(repository, branchProtectionRule, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
         return localVarCall;
     }
     /**
-     * Build call for getGarbageCollectionConfig
+     * Build call for internalDeleteBranchProtectionRule
+     * @param repository  (required)
+     * @param inlineObject1  (required)
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getGarbageCollectionConfigCall(final ApiCallback _callback) throws ApiException {
-        Object localVarPostBody = null;
+    public okhttp3.Call internalDeleteBranchProtectionRuleCall(String repository, InlineObject1 inlineObject1, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = inlineObject1;
 
         // create path and map variables
-        String localVarPath = "/config/garbage-collection";
+        String localVarPath = "/repositories/{repository}/branch_protection"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -972,81 +816,99 @@ public okhttp3.Call getGarbageCollectionConfigCall(final ApiCallback _callback)
         }
 
         final String[] localVarContentTypes = {
-            
+            "application/json"
         };
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getGarbageCollectionConfigValidateBeforeCall(final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalDeleteBranchProtectionRuleValidateBeforeCall(String repository, InlineObject1 inlineObject1, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling internalDeleteBranchProtectionRule(Async)");
+        }
+        
+        // verify the required parameter 'inlineObject1' is set
+        if (inlineObject1 == null) {
+            throw new ApiException("Missing the required parameter 'inlineObject1' when calling internalDeleteBranchProtectionRule(Async)");
+        }
         
 
-        okhttp3.Call localVarCall = getGarbageCollectionConfigCall(_callback);
+        okhttp3.Call localVarCall = internalDeleteBranchProtectionRuleCall(repository, inlineObject1, _callback);
         return localVarCall;
 
     }
 
     /**
      * 
-     * get information of gc settings
-     * @return GarbageCollectionConfig
+     * 
+     * @param repository  (required)
+     * @param inlineObject1  (required)
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public GarbageCollectionConfig getGarbageCollectionConfig() throws ApiException {
-        ApiResponse<GarbageCollectionConfig> localVarResp = getGarbageCollectionConfigWithHttpInfo();
-        return localVarResp.getData();
+    public void internalDeleteBranchProtectionRule(String repository, InlineObject1 inlineObject1) throws ApiException {
+        internalDeleteBranchProtectionRuleWithHttpInfo(repository, inlineObject1);
     }
 
     /**
      * 
-     * get information of gc settings
-     * @return ApiResponse&lt;GarbageCollectionConfig&gt;
+     * 
+     * @param repository  (required)
+     * @param inlineObject1  (required)
+     * @return ApiResponse&lt;Void&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<GarbageCollectionConfig> getGarbageCollectionConfigWithHttpInfo() throws ApiException {
-        okhttp3.Call localVarCall = getGarbageCollectionConfigValidateBeforeCall(null);
-        Type localVarReturnType = new TypeToken<GarbageCollectionConfig>(){}.getType();
-        return localVarApiClient.execute(localVarCall, localVarReturnType);
+    public ApiResponse<Void> internalDeleteBranchProtectionRuleWithHttpInfo(String repository, InlineObject1 inlineObject1) throws ApiException {
+        okhttp3.Call localVarCall = internalDeleteBranchProtectionRuleValidateBeforeCall(repository, inlineObject1, null);
+        return localVarApiClient.execute(localVarCall);
     }
 
     /**
      *  (asynchronously)
-     * get information of gc settings
+     * 
+     * @param repository  (required)
+     * @param inlineObject1  (required)
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS garbage collection config </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> branch protection rule deleted successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getGarbageCollectionConfigAsync(final ApiCallback<GarbageCollectionConfig> _callback) throws ApiException {
+    public okhttp3.Call internalDeleteBranchProtectionRuleAsync(String repository, InlineObject1 inlineObject1, final ApiCallback<Void> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getGarbageCollectionConfigValidateBeforeCall(_callback);
-        Type localVarReturnType = new TypeToken<GarbageCollectionConfig>(){}.getType();
-        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
+        okhttp3.Call localVarCall = internalDeleteBranchProtectionRuleValidateBeforeCall(repository, inlineObject1, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
         return localVarCall;
     }
     /**
-     * Build call for getGarbageCollectionRules
+     * Build call for internalDeleteGarbageCollectionRules
      * @param repository  (required)
      * @param _callback Callback for upload/download progress
      * @return Call to execute
@@ -1054,13 +916,13 @@ public okhttp3.Call getGarbageCollectionConfigAsync(final ApiCallback<GarbageCol
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getGarbageCollectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call internalDeleteGarbageCollectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
@@ -1088,19 +950,19 @@ public okhttp3.Call getGarbageCollectionRulesCall(String repository, final ApiCa
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getGarbageCollectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalDeleteGarbageCollectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
         
         // verify the required parameter 'repository' is set
         if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling getGarbageCollectionRules(Async)");
+            throw new ApiException("Missing the required parameter 'repository' when calling internalDeleteGarbageCollectionRules(Async)");
         }
         
 
-        okhttp3.Call localVarCall = getGarbageCollectionRulesCall(repository, _callback);
+        okhttp3.Call localVarCall = internalDeleteGarbageCollectionRulesCall(repository, _callback);
         return localVarCall;
 
     }
@@ -1109,41 +971,38 @@ private okhttp3.Call getGarbageCollectionRulesValidateBeforeCall(String reposito
      * 
      * 
      * @param repository  (required)
-     * @return GarbageCollectionRules
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public GarbageCollectionRules getGarbageCollectionRules(String repository) throws ApiException {
-        ApiResponse<GarbageCollectionRules> localVarResp = getGarbageCollectionRulesWithHttpInfo(repository);
-        return localVarResp.getData();
+    public void internalDeleteGarbageCollectionRules(String repository) throws ApiException {
+        internalDeleteGarbageCollectionRulesWithHttpInfo(repository);
     }
 
     /**
      * 
      * 
      * @param repository  (required)
-     * @return ApiResponse&lt;GarbageCollectionRules&gt;
+     * @return ApiResponse&lt;Void&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<GarbageCollectionRules> getGarbageCollectionRulesWithHttpInfo(String repository) throws ApiException {
-        okhttp3.Call localVarCall = getGarbageCollectionRulesValidateBeforeCall(repository, null);
-        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
-        return localVarApiClient.execute(localVarCall, localVarReturnType);
+    public ApiResponse<Void> internalDeleteGarbageCollectionRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = internalDeleteGarbageCollectionRulesValidateBeforeCall(repository, null);
+        return localVarApiClient.execute(localVarCall);
     }
 
     /**
@@ -1156,36 +1015,39 @@ public ApiResponse<GarbageCollectionRules> getGarbageCollectionRulesWithHttpInfo
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getGarbageCollectionRulesAsync(String repository, final ApiCallback<GarbageCollectionRules> _callback) throws ApiException {
+    public okhttp3.Call internalDeleteGarbageCollectionRulesAsync(String repository, final ApiCallback<Void> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getGarbageCollectionRulesValidateBeforeCall(repository, _callback);
-        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
-        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
+        okhttp3.Call localVarCall = internalDeleteGarbageCollectionRulesValidateBeforeCall(repository, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
         return localVarCall;
     }
     /**
-     * Build call for getSetupState
+     * Build call for internalGetBranchProtectionRules
+     * @param repository  (required)
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getSetupStateCall(final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call internalGetBranchProtectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/setup_lakefs";
+        String localVarPath = "/repositories/{repository}/branch_protection"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -1207,94 +1069,109 @@ public okhttp3.Call getSetupStateCall(final ApiCallback _callback) throws ApiExc
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
-        String[] localVarAuthNames = new String[] {  };
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
         return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call getSetupStateValidateBeforeCall(final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalGetBranchProtectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling internalGetBranchProtectionRules(Async)");
+        }
         
 
-        okhttp3.Call localVarCall = getSetupStateCall(_callback);
+        okhttp3.Call localVarCall = internalGetBranchProtectionRulesCall(repository, _callback);
         return localVarCall;
 
     }
 
     /**
-     * check if the lakeFS installation is already set up
+     * get branch protection rules
      * 
-     * @return SetupState
+     * @param repository  (required)
+     * @return List&lt;BranchProtectionRule&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public SetupState getSetupState() throws ApiException {
-        ApiResponse<SetupState> localVarResp = getSetupStateWithHttpInfo();
+    public List<BranchProtectionRule> internalGetBranchProtectionRules(String repository) throws ApiException {
+        ApiResponse<List<BranchProtectionRule>> localVarResp = internalGetBranchProtectionRulesWithHttpInfo(repository);
         return localVarResp.getData();
     }
 
     /**
-     * check if the lakeFS installation is already set up
+     * get branch protection rules
      * 
-     * @return ApiResponse&lt;SetupState&gt;
+     * @param repository  (required)
+     * @return ApiResponse&lt;List&lt;BranchProtectionRule&gt;&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<SetupState> getSetupStateWithHttpInfo() throws ApiException {
-        okhttp3.Call localVarCall = getSetupStateValidateBeforeCall(null);
-        Type localVarReturnType = new TypeToken<SetupState>(){}.getType();
+    public ApiResponse<List<BranchProtectionRule>> internalGetBranchProtectionRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = internalGetBranchProtectionRulesValidateBeforeCall(repository, null);
+        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
         return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
-     * check if the lakeFS installation is already set up (asynchronously)
+     * get branch protection rules (asynchronously)
      * 
+     * @param repository  (required)
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 200 </td><td> lakeFS setup state </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call getSetupStateAsync(final ApiCallback<SetupState> _callback) throws ApiException {
+    public okhttp3.Call internalGetBranchProtectionRulesAsync(String repository, final ApiCallback<List<BranchProtectionRule>> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = getSetupStateValidateBeforeCall(_callback);
-        Type localVarReturnType = new TypeToken<SetupState>(){}.getType();
+        okhttp3.Call localVarCall = internalGetBranchProtectionRulesValidateBeforeCall(repository, _callback);
+        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
         localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
-     * Build call for postStatsEvents
-     * @param statsEventsList  (required)
+     * Build call for internalGetGarbageCollectionRules
+     * @param repository  (required)
      * @param _callback Callback for upload/download progress
      * @return Call to execute
      * @throws ApiException If fail to serialize the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
-        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call postStatsEventsCall(StatsEventsList statsEventsList, final ApiCallback _callback) throws ApiException {
-        Object localVarPostBody = statsEventsList;
+    public okhttp3.Call internalGetGarbageCollectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/statistics";
+        String localVarPath = "/repositories/{repository}/gc/rules"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
         List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
@@ -1311,91 +1188,95 @@ public okhttp3.Call postStatsEventsCall(StatsEventsList statsEventsList, final A
         }
 
         final String[] localVarContentTypes = {
-            "application/json"
+            
         };
         final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call postStatsEventsValidateBeforeCall(StatsEventsList statsEventsList, final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalGetGarbageCollectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
         
-        // verify the required parameter 'statsEventsList' is set
-        if (statsEventsList == null) {
-            throw new ApiException("Missing the required parameter 'statsEventsList' when calling postStatsEvents(Async)");
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling internalGetGarbageCollectionRules(Async)");
         }
         
 
-        okhttp3.Call localVarCall = postStatsEventsCall(statsEventsList, _callback);
+        okhttp3.Call localVarCall = internalGetGarbageCollectionRulesCall(repository, _callback);
         return localVarCall;
 
     }
 
     /**
-     * post stats events, this endpoint is meant for internal use only
      * 
-     * @param statsEventsList  (required)
+     * 
+     * @param repository  (required)
+     * @return GarbageCollectionRules
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
-        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public void postStatsEvents(StatsEventsList statsEventsList) throws ApiException {
-        postStatsEventsWithHttpInfo(statsEventsList);
+    public GarbageCollectionRules internalGetGarbageCollectionRules(String repository) throws ApiException {
+        ApiResponse<GarbageCollectionRules> localVarResp = internalGetGarbageCollectionRulesWithHttpInfo(repository);
+        return localVarResp.getData();
     }
 
     /**
-     * post stats events, this endpoint is meant for internal use only
      * 
-     * @param statsEventsList  (required)
-     * @return ApiResponse&lt;Void&gt;
+     * 
+     * @param repository  (required)
+     * @return ApiResponse&lt;GarbageCollectionRules&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
-        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Void> postStatsEventsWithHttpInfo(StatsEventsList statsEventsList) throws ApiException {
-        okhttp3.Call localVarCall = postStatsEventsValidateBeforeCall(statsEventsList, null);
-        return localVarApiClient.execute(localVarCall);
+    public ApiResponse<GarbageCollectionRules> internalGetGarbageCollectionRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = internalGetGarbageCollectionRulesValidateBeforeCall(repository, null);
+        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
+        return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
-     * post stats events, this endpoint is meant for internal use only (asynchronously)
+     *  (asynchronously)
      * 
-     * @param statsEventsList  (required)
+     * @param repository  (required)
      * @param _callback The callback to be executed when the API call finishes
      * @return The request call
      * @throws ApiException If fail to process the API call, e.g. serializing the request body object
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
-        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> gc rule list </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call postStatsEventsAsync(StatsEventsList statsEventsList, final ApiCallback<Void> _callback) throws ApiException {
+    public okhttp3.Call internalGetGarbageCollectionRulesAsync(String repository, final ApiCallback<GarbageCollectionRules> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = postStatsEventsValidateBeforeCall(statsEventsList, _callback);
-        localVarApiClient.executeAsync(localVarCall, _callback);
+        okhttp3.Call localVarCall = internalGetGarbageCollectionRulesValidateBeforeCall(repository, _callback);
+        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
+        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
-     * Build call for setGarbageCollectionRules
+     * Build call for internalSetGarbageCollectionRules
      * @param repository  (required)
      * @param garbageCollectionRules  (required)
      * @param _callback Callback for upload/download progress
@@ -1410,7 +1291,7 @@ public okhttp3.Call postStatsEventsAsync(StatsEventsList statsEventsList, final
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call setGarbageCollectionRulesCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call internalSetGarbageCollectionRulesCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = garbageCollectionRules;
 
         // create path and map variables
@@ -1442,20 +1323,20 @@ public okhttp3.Call setGarbageCollectionRulesCall(String repository, GarbageColl
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call setGarbageCollectionRulesValidateBeforeCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call internalSetGarbageCollectionRulesValidateBeforeCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
         
         // verify the required parameter 'repository' is set
         if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling setGarbageCollectionRules(Async)");
+            throw new ApiException("Missing the required parameter 'repository' when calling internalSetGarbageCollectionRules(Async)");
         }
         
         // verify the required parameter 'garbageCollectionRules' is set
         if (garbageCollectionRules == null) {
-            throw new ApiException("Missing the required parameter 'garbageCollectionRules' when calling setGarbageCollectionRules(Async)");
+            throw new ApiException("Missing the required parameter 'garbageCollectionRules' when calling internalSetGarbageCollectionRules(Async)");
         }
         
 
-        okhttp3.Call localVarCall = setGarbageCollectionRulesCall(repository, garbageCollectionRules, _callback);
+        okhttp3.Call localVarCall = internalSetGarbageCollectionRulesCall(repository, garbageCollectionRules, _callback);
         return localVarCall;
 
     }
@@ -1475,8 +1356,8 @@ private okhttp3.Call setGarbageCollectionRulesValidateBeforeCall(String reposito
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public void setGarbageCollectionRules(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
-        setGarbageCollectionRulesWithHttpInfo(repository, garbageCollectionRules);
+    public void internalSetGarbageCollectionRules(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
+        internalSetGarbageCollectionRulesWithHttpInfo(repository, garbageCollectionRules);
     }
 
     /**
@@ -1495,8 +1376,8 @@ public void setGarbageCollectionRules(String repository, GarbageCollectionRules
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Void> setGarbageCollectionRulesWithHttpInfo(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
-        okhttp3.Call localVarCall = setGarbageCollectionRulesValidateBeforeCall(repository, garbageCollectionRules, null);
+    public ApiResponse<Void> internalSetGarbageCollectionRulesWithHttpInfo(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
+        okhttp3.Call localVarCall = internalSetGarbageCollectionRulesValidateBeforeCall(repository, garbageCollectionRules, null);
         return localVarApiClient.execute(localVarCall);
     }
 
@@ -1517,9 +1398,128 @@ public ApiResponse<Void> setGarbageCollectionRulesWithHttpInfo(String repository
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call setGarbageCollectionRulesAsync(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback<Void> _callback) throws ApiException {
+    public okhttp3.Call internalSetGarbageCollectionRulesAsync(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = internalSetGarbageCollectionRulesValidateBeforeCall(repository, garbageCollectionRules, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
+        return localVarCall;
+    }
+    /**
+     * Build call for postStatsEvents
+     * @param statsEventsList  (required)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call postStatsEventsCall(StatsEventsList statsEventsList, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = statsEventsList;
 
-        okhttp3.Call localVarCall = setGarbageCollectionRulesValidateBeforeCall(repository, garbageCollectionRules, _callback);
+        // create path and map variables
+        String localVarPath = "/statistics";
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            "application/json"
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call postStatsEventsValidateBeforeCall(StatsEventsList statsEventsList, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'statsEventsList' is set
+        if (statsEventsList == null) {
+            throw new ApiException("Missing the required parameter 'statsEventsList' when calling postStatsEvents(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = postStatsEventsCall(statsEventsList, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * post stats events, this endpoint is meant for internal use only
+     * 
+     * @param statsEventsList  (required)
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public void postStatsEvents(StatsEventsList statsEventsList) throws ApiException {
+        postStatsEventsWithHttpInfo(statsEventsList);
+    }
+
+    /**
+     * post stats events, this endpoint is meant for internal use only
+     * 
+     * @param statsEventsList  (required)
+     * @return ApiResponse&lt;Void&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<Void> postStatsEventsWithHttpInfo(StatsEventsList statsEventsList) throws ApiException {
+        okhttp3.Call localVarCall = postStatsEventsValidateBeforeCall(statsEventsList, null);
+        return localVarApiClient.execute(localVarCall);
+    }
+
+    /**
+     * post stats events, this endpoint is meant for internal use only (asynchronously)
+     * 
+     * @param statsEventsList  (required)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> reported successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call postStatsEventsAsync(StatsEventsList statsEventsList, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = postStatsEventsValidateBeforeCall(statsEventsList, _callback);
         localVarApiClient.executeAsync(localVarCall, _callback);
         return localVarCall;
     }
diff --git a/clients/java/src/main/java/io/lakefs/clients/api/RepositoriesApi.java b/clients/java/src/main/java/io/lakefs/clients/api/RepositoriesApi.java
index 01890f954e3..ee6b2a7d999 100644
--- a/clients/java/src/main/java/io/lakefs/clients/api/RepositoriesApi.java
+++ b/clients/java/src/main/java/io/lakefs/clients/api/RepositoriesApi.java
@@ -27,7 +27,9 @@
 import java.io.IOException;
 
 
+import io.lakefs.clients.api.model.BranchProtectionRule;
 import io.lakefs.clients.api.model.Error;
+import io.lakefs.clients.api.model.GarbageCollectionRules;
 import io.lakefs.clients.api.model.Repository;
 import io.lakefs.clients.api.model.RepositoryCreation;
 import io.lakefs.clients.api.model.RepositoryList;
@@ -192,6 +194,126 @@ public okhttp3.Call createRepositoryAsync(RepositoryCreation repositoryCreation,
         localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
+    /**
+     * Build call for deleteGCRules
+     * @param repository  (required)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call deleteGCRulesCall(String repository, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = null;
+
+        // create path and map variables
+        String localVarPath = "/repositories/{repository}/settings/gc_rules"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call deleteGCRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling deleteGCRules(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = deleteGCRulesCall(repository, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public void deleteGCRules(String repository) throws ApiException {
+        deleteGCRulesWithHttpInfo(repository);
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @return ApiResponse&lt;Void&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<Void> deleteGCRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = deleteGCRulesValidateBeforeCall(repository, null);
+        return localVarApiClient.execute(localVarCall);
+    }
+
+    /**
+     *  (asynchronously)
+     * 
+     * @param repository  (required)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> deleted garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call deleteGCRulesAsync(String repository, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = deleteGCRulesValidateBeforeCall(repository, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
+        return localVarCall;
+    }
     /**
      * Build call for deleteRepository
      * @param repository  (required)
@@ -201,17 +323,261 @@ public okhttp3.Call createRepositoryAsync(RepositoryCreation repositoryCreation,
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call deleteRepositoryCall(String repository, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = null;
+
+        // create path and map variables
+        String localVarPath = "/repositories/{repository}"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call deleteRepositoryValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling deleteRepository(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = deleteRepositoryCall(repository, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * delete repository
+     * 
+     * @param repository  (required)
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public void deleteRepository(String repository) throws ApiException {
+        deleteRepositoryWithHttpInfo(repository);
+    }
+
+    /**
+     * delete repository
+     * 
+     * @param repository  (required)
+     * @return ApiResponse&lt;Void&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<Void> deleteRepositoryWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = deleteRepositoryValidateBeforeCall(repository, null);
+        return localVarApiClient.execute(localVarCall);
+    }
+
+    /**
+     * delete repository (asynchronously)
+     * 
+     * @param repository  (required)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call deleteRepositoryAsync(String repository, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = deleteRepositoryValidateBeforeCall(repository, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
+        return localVarCall;
+    }
+    /**
+     * Build call for getBranchProtectionRules
+     * @param repository  (required)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  * ETag -  <br>  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call getBranchProtectionRulesCall(String repository, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = null;
+
+        // create path and map variables
+        String localVarPath = "/repositories/{repository}/settings/branch_protection"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call getBranchProtectionRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling getBranchProtectionRules(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = getBranchProtectionRulesCall(repository, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * get branch protection rules
+     * 
+     * @param repository  (required)
+     * @return List&lt;BranchProtectionRule&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  * ETag -  <br>  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public List<BranchProtectionRule> getBranchProtectionRules(String repository) throws ApiException {
+        ApiResponse<List<BranchProtectionRule>> localVarResp = getBranchProtectionRulesWithHttpInfo(repository);
+        return localVarResp.getData();
+    }
+
+    /**
+     * get branch protection rules
+     * 
+     * @param repository  (required)
+     * @return ApiResponse&lt;List&lt;BranchProtectionRule&gt;&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  * ETag -  <br>  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<List<BranchProtectionRule>> getBranchProtectionRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = getBranchProtectionRulesValidateBeforeCall(repository, null);
+        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
+        return localVarApiClient.execute(localVarCall, localVarReturnType);
+    }
+
+    /**
+     * get branch protection rules (asynchronously)
+     * 
+     * @param repository  (required)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 200 </td><td> branch protection rules </td><td>  * ETag -  <br>  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call getBranchProtectionRulesAsync(String repository, final ApiCallback<List<BranchProtectionRule>> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = getBranchProtectionRulesValidateBeforeCall(repository, _callback);
+        Type localVarReturnType = new TypeToken<List<BranchProtectionRule>>(){}.getType();
+        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
+        return localVarCall;
+    }
+    /**
+     * Build call for getGCRules
+     * @param repository  (required)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 200 </td><td> repository GC rules </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteRepositoryCall(String repository, final ApiCallback _callback) throws ApiException {
+    public okhttp3.Call getGCRulesCall(String repository, final ApiCallback _callback) throws ApiException {
         Object localVarPostBody = null;
 
         // create path and map variables
-        String localVarPath = "/repositories/{repository}"
+        String localVarPath = "/repositories/{repository}/settings/gc_rules"
             .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
 
         List<Pair> localVarQueryParams = new ArrayList<Pair>();
@@ -235,63 +601,66 @@ public okhttp3.Call deleteRepositoryCall(String repository, final ApiCallback _c
         localVarHeaderParams.put("Content-Type", localVarContentType);
 
         String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
-        return localVarApiClient.buildCall(localVarPath, "DELETE", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+        return localVarApiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
     }
 
     @SuppressWarnings("rawtypes")
-    private okhttp3.Call deleteRepositoryValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
+    private okhttp3.Call getGCRulesValidateBeforeCall(String repository, final ApiCallback _callback) throws ApiException {
         
         // verify the required parameter 'repository' is set
         if (repository == null) {
-            throw new ApiException("Missing the required parameter 'repository' when calling deleteRepository(Async)");
+            throw new ApiException("Missing the required parameter 'repository' when calling getGCRules(Async)");
         }
         
 
-        okhttp3.Call localVarCall = deleteRepositoryCall(repository, _callback);
+        okhttp3.Call localVarCall = getGCRulesCall(repository, _callback);
         return localVarCall;
 
     }
 
     /**
-     * delete repository
+     * get repository GC rules
      * 
      * @param repository  (required)
+     * @return GarbageCollectionRules
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> repository GC rules </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public void deleteRepository(String repository) throws ApiException {
-        deleteRepositoryWithHttpInfo(repository);
+    public GarbageCollectionRules getGCRules(String repository) throws ApiException {
+        ApiResponse<GarbageCollectionRules> localVarResp = getGCRulesWithHttpInfo(repository);
+        return localVarResp.getData();
     }
 
     /**
-     * delete repository
+     * get repository GC rules
      * 
      * @param repository  (required)
-     * @return ApiResponse&lt;Void&gt;
+     * @return ApiResponse&lt;GarbageCollectionRules&gt;
      * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> repository GC rules </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public ApiResponse<Void> deleteRepositoryWithHttpInfo(String repository) throws ApiException {
-        okhttp3.Call localVarCall = deleteRepositoryValidateBeforeCall(repository, null);
-        return localVarApiClient.execute(localVarCall);
+    public ApiResponse<GarbageCollectionRules> getGCRulesWithHttpInfo(String repository) throws ApiException {
+        okhttp3.Call localVarCall = getGCRulesValidateBeforeCall(repository, null);
+        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
+        return localVarApiClient.execute(localVarCall, localVarReturnType);
     }
 
     /**
-     * delete repository (asynchronously)
+     * get repository GC rules (asynchronously)
      * 
      * @param repository  (required)
      * @param _callback The callback to be executed when the API call finishes
@@ -300,16 +669,17 @@ public ApiResponse<Void> deleteRepositoryWithHttpInfo(String repository) throws
      * @http.response.details
      <table summary="Response Details" border="1">
         <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
-        <tr><td> 204 </td><td> repository deleted successfully </td><td>  -  </td></tr>
+        <tr><td> 200 </td><td> repository GC rules </td><td>  -  </td></tr>
         <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
         <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
         <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
      </table>
      */
-    public okhttp3.Call deleteRepositoryAsync(String repository, final ApiCallback<Void> _callback) throws ApiException {
+    public okhttp3.Call getGCRulesAsync(String repository, final ApiCallback<GarbageCollectionRules> _callback) throws ApiException {
 
-        okhttp3.Call localVarCall = deleteRepositoryValidateBeforeCall(repository, _callback);
-        localVarApiClient.executeAsync(localVarCall, _callback);
+        okhttp3.Call localVarCall = getGCRulesValidateBeforeCall(repository, _callback);
+        Type localVarReturnType = new TypeToken<GarbageCollectionRules>(){}.getType();
+        localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
     /**
@@ -694,4 +1064,278 @@ public okhttp3.Call listRepositoriesAsync(String prefix, String after, Integer a
         localVarApiClient.executeAsync(localVarCall, localVarReturnType, _callback);
         return localVarCall;
     }
+    /**
+     * Build call for setBranchProtectionRules
+     * @param repository  (required)
+     * @param branchProtectionRule  (required)
+     * @param ifMatch if provided, the branch protection rules will be updated only if the current ETag match the provided value (optional)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 412 </td><td> Precondition Failed </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call setBranchProtectionRulesCall(String repository, List<BranchProtectionRule> branchProtectionRule, String ifMatch, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = branchProtectionRule;
+
+        // create path and map variables
+        String localVarPath = "/repositories/{repository}/settings/branch_protection"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        if (ifMatch != null) {
+            localVarHeaderParams.put("If-Match", localVarApiClient.parameterToString(ifMatch));
+        }
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            "application/json"
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "PUT", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call setBranchProtectionRulesValidateBeforeCall(String repository, List<BranchProtectionRule> branchProtectionRule, String ifMatch, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling setBranchProtectionRules(Async)");
+        }
+        
+        // verify the required parameter 'branchProtectionRule' is set
+        if (branchProtectionRule == null) {
+            throw new ApiException("Missing the required parameter 'branchProtectionRule' when calling setBranchProtectionRules(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = setBranchProtectionRulesCall(repository, branchProtectionRule, ifMatch, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @param branchProtectionRule  (required)
+     * @param ifMatch if provided, the branch protection rules will be updated only if the current ETag match the provided value (optional)
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 412 </td><td> Precondition Failed </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public void setBranchProtectionRules(String repository, List<BranchProtectionRule> branchProtectionRule, String ifMatch) throws ApiException {
+        setBranchProtectionRulesWithHttpInfo(repository, branchProtectionRule, ifMatch);
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @param branchProtectionRule  (required)
+     * @param ifMatch if provided, the branch protection rules will be updated only if the current ETag match the provided value (optional)
+     * @return ApiResponse&lt;Void&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 412 </td><td> Precondition Failed </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<Void> setBranchProtectionRulesWithHttpInfo(String repository, List<BranchProtectionRule> branchProtectionRule, String ifMatch) throws ApiException {
+        okhttp3.Call localVarCall = setBranchProtectionRulesValidateBeforeCall(repository, branchProtectionRule, ifMatch, null);
+        return localVarApiClient.execute(localVarCall);
+    }
+
+    /**
+     *  (asynchronously)
+     * 
+     * @param repository  (required)
+     * @param branchProtectionRule  (required)
+     * @param ifMatch if provided, the branch protection rules will be updated only if the current ETag match the provided value (optional)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> branch protection rule created successfully </td><td>  -  </td></tr>
+        <tr><td> 400 </td><td> Bad Request </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 412 </td><td> Precondition Failed </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call setBranchProtectionRulesAsync(String repository, List<BranchProtectionRule> branchProtectionRule, String ifMatch, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = setBranchProtectionRulesValidateBeforeCall(repository, branchProtectionRule, ifMatch, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
+        return localVarCall;
+    }
+    /**
+     * Build call for setGCRules
+     * @param repository  (required)
+     * @param garbageCollectionRules  (required)
+     * @param _callback Callback for upload/download progress
+     * @return Call to execute
+     * @throws ApiException If fail to serialize the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> set garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call setGCRulesCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
+        Object localVarPostBody = garbageCollectionRules;
+
+        // create path and map variables
+        String localVarPath = "/repositories/{repository}/settings/gc_rules"
+            .replaceAll("\\{" + "repository" + "\\}", localVarApiClient.escapeString(repository.toString()));
+
+        List<Pair> localVarQueryParams = new ArrayList<Pair>();
+        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
+        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
+        Map<String, String> localVarCookieParams = new HashMap<String, String>();
+        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
+
+        final String[] localVarAccepts = {
+            "application/json"
+        };
+        final String localVarAccept = localVarApiClient.selectHeaderAccept(localVarAccepts);
+        if (localVarAccept != null) {
+            localVarHeaderParams.put("Accept", localVarAccept);
+        }
+
+        final String[] localVarContentTypes = {
+            "application/json"
+        };
+        final String localVarContentType = localVarApiClient.selectHeaderContentType(localVarContentTypes);
+        localVarHeaderParams.put("Content-Type", localVarContentType);
+
+        String[] localVarAuthNames = new String[] { "basic_auth", "cookie_auth", "jwt_token", "oidc_auth", "saml_auth" };
+        return localVarApiClient.buildCall(localVarPath, "PUT", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarCookieParams, localVarFormParams, localVarAuthNames, _callback);
+    }
+
+    @SuppressWarnings("rawtypes")
+    private okhttp3.Call setGCRulesValidateBeforeCall(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback _callback) throws ApiException {
+        
+        // verify the required parameter 'repository' is set
+        if (repository == null) {
+            throw new ApiException("Missing the required parameter 'repository' when calling setGCRules(Async)");
+        }
+        
+        // verify the required parameter 'garbageCollectionRules' is set
+        if (garbageCollectionRules == null) {
+            throw new ApiException("Missing the required parameter 'garbageCollectionRules' when calling setGCRules(Async)");
+        }
+        
+
+        okhttp3.Call localVarCall = setGCRulesCall(repository, garbageCollectionRules, _callback);
+        return localVarCall;
+
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @param garbageCollectionRules  (required)
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> set garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public void setGCRules(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
+        setGCRulesWithHttpInfo(repository, garbageCollectionRules);
+    }
+
+    /**
+     * 
+     * 
+     * @param repository  (required)
+     * @param garbageCollectionRules  (required)
+     * @return ApiResponse&lt;Void&gt;
+     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> set garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public ApiResponse<Void> setGCRulesWithHttpInfo(String repository, GarbageCollectionRules garbageCollectionRules) throws ApiException {
+        okhttp3.Call localVarCall = setGCRulesValidateBeforeCall(repository, garbageCollectionRules, null);
+        return localVarApiClient.execute(localVarCall);
+    }
+
+    /**
+     *  (asynchronously)
+     * 
+     * @param repository  (required)
+     * @param garbageCollectionRules  (required)
+     * @param _callback The callback to be executed when the API call finishes
+     * @return The request call
+     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
+     * @http.response.details
+     <table summary="Response Details" border="1">
+        <tr><td> Status Code </td><td> Description </td><td> Response Headers </td></tr>
+        <tr><td> 204 </td><td> set garbage collection rules successfully </td><td>  -  </td></tr>
+        <tr><td> 401 </td><td> Unauthorized </td><td>  -  </td></tr>
+        <tr><td> 404 </td><td> Resource Not Found </td><td>  -  </td></tr>
+        <tr><td> 0 </td><td> Internal Server Error </td><td>  -  </td></tr>
+     </table>
+     */
+    public okhttp3.Call setGCRulesAsync(String repository, GarbageCollectionRules garbageCollectionRules, final ApiCallback<Void> _callback) throws ApiException {
+
+        okhttp3.Call localVarCall = setGCRulesValidateBeforeCall(repository, garbageCollectionRules, _callback);
+        localVarApiClient.executeAsync(localVarCall, _callback);
+        return localVarCall;
+    }
 }
diff --git a/clients/java/src/test/java/io/lakefs/clients/api/InternalApiTest.java b/clients/java/src/test/java/io/lakefs/clients/api/InternalApiTest.java
index 9415b780af3..103f46e78d5 100644
--- a/clients/java/src/test/java/io/lakefs/clients/api/InternalApiTest.java
+++ b/clients/java/src/test/java/io/lakefs/clients/api/InternalApiTest.java
@@ -43,22 +43,6 @@ public class InternalApiTest {
     private final InternalApi api = new InternalApi();
 
     
-    /**
-     * 
-     *
-     * 
-     *
-     * @throws ApiException
-     *          if the Api call fails
-     */
-    @Test
-    public void createBranchProtectionRuleTest() throws ApiException {
-        String repository = null;
-        BranchProtectionRule branchProtectionRule = null;
-                api.createBranchProtectionRule(repository, branchProtectionRule);
-        // TODO: test validations
-    }
-    
     /**
      * 
      *
@@ -92,7 +76,7 @@ public void createSymlinkFileTest() throws ApiException {
     }
     
     /**
-     * 
+     * list authentication capabilities supported
      *
      * 
      *
@@ -100,30 +84,27 @@ public void createSymlinkFileTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void deleteBranchProtectionRuleTest() throws ApiException {
-        String repository = null;
-        InlineObject1 inlineObject1 = null;
-                api.deleteBranchProtectionRule(repository, inlineObject1);
+    public void getAuthCapabilitiesTest() throws ApiException {
+                AuthCapabilities response = api.getAuthCapabilities();
         // TODO: test validations
     }
     
     /**
      * 
      *
-     * 
+     * get information of gc settings
      *
      * @throws ApiException
      *          if the Api call fails
      */
     @Test
-    public void deleteGarbageCollectionRulesTest() throws ApiException {
-        String repository = null;
-                api.deleteGarbageCollectionRules(repository);
+    public void getGarbageCollectionConfigTest() throws ApiException {
+                GarbageCollectionConfig response = api.getGarbageCollectionConfig();
         // TODO: test validations
     }
     
     /**
-     * list authentication capabilities supported
+     * check if the lakeFS installation is already set up
      *
      * 
      *
@@ -131,13 +112,13 @@ public void deleteGarbageCollectionRulesTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void getAuthCapabilitiesTest() throws ApiException {
-                AuthCapabilities response = api.getAuthCapabilities();
+    public void getSetupStateTest() throws ApiException {
+                SetupState response = api.getSetupState();
         // TODO: test validations
     }
     
     /**
-     * get branch protection rules
+     * 
      *
      * 
      *
@@ -145,23 +126,26 @@ public void getAuthCapabilitiesTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void getBranchProtectionRulesTest() throws ApiException {
+    public void internalCreateBranchProtectionRuleTest() throws ApiException {
         String repository = null;
-                List<BranchProtectionRule> response = api.getBranchProtectionRules(repository);
+        BranchProtectionRule branchProtectionRule = null;
+                api.internalCreateBranchProtectionRule(repository, branchProtectionRule);
         // TODO: test validations
     }
     
     /**
      * 
      *
-     * get information of gc settings
+     * 
      *
      * @throws ApiException
      *          if the Api call fails
      */
     @Test
-    public void getGarbageCollectionConfigTest() throws ApiException {
-                GarbageCollectionConfig response = api.getGarbageCollectionConfig();
+    public void internalDeleteBranchProtectionRuleTest() throws ApiException {
+        String repository = null;
+        InlineObject1 inlineObject1 = null;
+                api.internalDeleteBranchProtectionRule(repository, inlineObject1);
         // TODO: test validations
     }
     
@@ -174,14 +158,14 @@ public void getGarbageCollectionConfigTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void getGarbageCollectionRulesTest() throws ApiException {
+    public void internalDeleteGarbageCollectionRulesTest() throws ApiException {
         String repository = null;
-                GarbageCollectionRules response = api.getGarbageCollectionRules(repository);
+                api.internalDeleteGarbageCollectionRules(repository);
         // TODO: test validations
     }
     
     /**
-     * check if the lakeFS installation is already set up
+     * get branch protection rules
      *
      * 
      *
@@ -189,13 +173,14 @@ public void getGarbageCollectionRulesTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void getSetupStateTest() throws ApiException {
-                SetupState response = api.getSetupState();
+    public void internalGetBranchProtectionRulesTest() throws ApiException {
+        String repository = null;
+                List<BranchProtectionRule> response = api.internalGetBranchProtectionRules(repository);
         // TODO: test validations
     }
     
     /**
-     * post stats events, this endpoint is meant for internal use only
+     * 
      *
      * 
      *
@@ -203,9 +188,9 @@ public void getSetupStateTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void postStatsEventsTest() throws ApiException {
-        StatsEventsList statsEventsList = null;
-                api.postStatsEvents(statsEventsList);
+    public void internalGetGarbageCollectionRulesTest() throws ApiException {
+        String repository = null;
+                GarbageCollectionRules response = api.internalGetGarbageCollectionRules(repository);
         // TODO: test validations
     }
     
@@ -218,10 +203,25 @@ public void postStatsEventsTest() throws ApiException {
      *          if the Api call fails
      */
     @Test
-    public void setGarbageCollectionRulesTest() throws ApiException {
+    public void internalSetGarbageCollectionRulesTest() throws ApiException {
         String repository = null;
         GarbageCollectionRules garbageCollectionRules = null;
-                api.setGarbageCollectionRules(repository, garbageCollectionRules);
+                api.internalSetGarbageCollectionRules(repository, garbageCollectionRules);
+        // TODO: test validations
+    }
+    
+    /**
+     * post stats events, this endpoint is meant for internal use only
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void postStatsEventsTest() throws ApiException {
+        StatsEventsList statsEventsList = null;
+                api.postStatsEvents(statsEventsList);
         // TODO: test validations
     }
     
diff --git a/clients/java/src/test/java/io/lakefs/clients/api/RepositoriesApiTest.java b/clients/java/src/test/java/io/lakefs/clients/api/RepositoriesApiTest.java
index a0ed05c71ed..24852b35f0d 100644
--- a/clients/java/src/test/java/io/lakefs/clients/api/RepositoriesApiTest.java
+++ b/clients/java/src/test/java/io/lakefs/clients/api/RepositoriesApiTest.java
@@ -14,7 +14,9 @@
 package io.lakefs.clients.api;
 
 import io.lakefs.clients.api.ApiException;
+import io.lakefs.clients.api.model.BranchProtectionRule;
 import io.lakefs.clients.api.model.Error;
+import io.lakefs.clients.api.model.GarbageCollectionRules;
 import io.lakefs.clients.api.model.Repository;
 import io.lakefs.clients.api.model.RepositoryCreation;
 import io.lakefs.clients.api.model.RepositoryList;
@@ -51,6 +53,21 @@ public void createRepositoryTest() throws ApiException {
         // TODO: test validations
     }
     
+    /**
+     * 
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void deleteGCRulesTest() throws ApiException {
+        String repository = null;
+                api.deleteGCRules(repository);
+        // TODO: test validations
+    }
+    
     /**
      * delete repository
      *
@@ -66,6 +83,36 @@ public void deleteRepositoryTest() throws ApiException {
         // TODO: test validations
     }
     
+    /**
+     * get branch protection rules
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void getBranchProtectionRulesTest() throws ApiException {
+        String repository = null;
+                List<BranchProtectionRule> response = api.getBranchProtectionRules(repository);
+        // TODO: test validations
+    }
+    
+    /**
+     * get repository GC rules
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void getGCRulesTest() throws ApiException {
+        String repository = null;
+                GarbageCollectionRules response = api.getGCRules(repository);
+        // TODO: test validations
+    }
+    
     /**
      * get repository
      *
@@ -113,4 +160,37 @@ public void listRepositoriesTest() throws ApiException {
         // TODO: test validations
     }
     
+    /**
+     * 
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void setBranchProtectionRulesTest() throws ApiException {
+        String repository = null;
+        List<BranchProtectionRule> branchProtectionRule = null;
+        String ifMatch = null;
+                api.setBranchProtectionRules(repository, branchProtectionRule, ifMatch);
+        // TODO: test validations
+    }
+    
+    /**
+     * 
+     *
+     * 
+     *
+     * @throws ApiException
+     *          if the Api call fails
+     */
+    @Test
+    public void setGCRulesTest() throws ApiException {
+        String repository = null;
+        GarbageCollectionRules garbageCollectionRules = null;
+                api.setGCRules(repository, garbageCollectionRules);
+        // TODO: test validations
+    }
+    
 }
diff --git a/clients/python/README.md b/clients/python/README.md
index a423d3e7e85..0773237d760 100644
--- a/clients/python/README.md
+++ b/clients/python/README.md
@@ -169,18 +169,18 @@ Class | Method | HTTP request | Description
 *ImportApi* | [**import_cancel**](docs/ImportApi.md#import_cancel) | **DELETE** /repositories/{repository}/branches/{branch}/import | cancel ongoing import
 *ImportApi* | [**import_start**](docs/ImportApi.md#import_start) | **POST** /repositories/{repository}/branches/{branch}/import | import data from object store
 *ImportApi* | [**import_status**](docs/ImportApi.md#import_status) | **GET** /repositories/{repository}/branches/{branch}/import | get import status
-*InternalApi* | [**create_branch_protection_rule**](docs/InternalApi.md#create_branch_protection_rule) | **POST** /repositories/{repository}/branch_protection | 
 *InternalApi* | [**create_branch_protection_rule_preflight**](docs/InternalApi.md#create_branch_protection_rule_preflight) | **GET** /repositories/{repository}/branch_protection/set_allowed | 
 *InternalApi* | [**create_symlink_file**](docs/InternalApi.md#create_symlink_file) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
-*InternalApi* | [**delete_branch_protection_rule**](docs/InternalApi.md#delete_branch_protection_rule) | **DELETE** /repositories/{repository}/branch_protection | 
-*InternalApi* | [**delete_garbage_collection_rules**](docs/InternalApi.md#delete_garbage_collection_rules) | **DELETE** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**get_auth_capabilities**](docs/InternalApi.md#get_auth_capabilities) | **GET** /auth/capabilities | list authentication capabilities supported
-*InternalApi* | [**get_branch_protection_rules**](docs/InternalApi.md#get_branch_protection_rules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
 *InternalApi* | [**get_garbage_collection_config**](docs/InternalApi.md#get_garbage_collection_config) | **GET** /config/garbage-collection | 
-*InternalApi* | [**get_garbage_collection_rules**](docs/InternalApi.md#get_garbage_collection_rules) | **GET** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**get_setup_state**](docs/InternalApi.md#get_setup_state) | **GET** /setup_lakefs | check if the lakeFS installation is already set up
+*InternalApi* | [**internal_create_branch_protection_rule**](docs/InternalApi.md#internal_create_branch_protection_rule) | **POST** /repositories/{repository}/branch_protection | 
+*InternalApi* | [**internal_delete_branch_protection_rule**](docs/InternalApi.md#internal_delete_branch_protection_rule) | **DELETE** /repositories/{repository}/branch_protection | 
+*InternalApi* | [**internal_delete_garbage_collection_rules**](docs/InternalApi.md#internal_delete_garbage_collection_rules) | **DELETE** /repositories/{repository}/gc/rules | 
+*InternalApi* | [**internal_get_branch_protection_rules**](docs/InternalApi.md#internal_get_branch_protection_rules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
+*InternalApi* | [**internal_get_garbage_collection_rules**](docs/InternalApi.md#internal_get_garbage_collection_rules) | **GET** /repositories/{repository}/gc/rules | 
+*InternalApi* | [**internal_set_garbage_collection_rules**](docs/InternalApi.md#internal_set_garbage_collection_rules) | **POST** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**post_stats_events**](docs/InternalApi.md#post_stats_events) | **POST** /statistics | post stats events, this endpoint is meant for internal use only
-*InternalApi* | [**set_garbage_collection_rules**](docs/InternalApi.md#set_garbage_collection_rules) | **POST** /repositories/{repository}/gc/rules | 
 *InternalApi* | [**set_garbage_collection_rules_preflight**](docs/InternalApi.md#set_garbage_collection_rules_preflight) | **GET** /repositories/{repository}/gc/rules/set_allowed | 
 *InternalApi* | [**setup**](docs/InternalApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 *InternalApi* | [**setup_comm_prefs**](docs/InternalApi.md#setup_comm_prefs) | **POST** /setup_comm_prefs | setup communications preferences
@@ -204,10 +204,15 @@ Class | Method | HTTP request | Description
 *RefsApi* | [**merge_into_branch**](docs/RefsApi.md#merge_into_branch) | **POST** /repositories/{repository}/refs/{sourceRef}/merge/{destinationBranch} | merge references
 *RefsApi* | [**restore_refs**](docs/RefsApi.md#restore_refs) | **PUT** /repositories/{repository}/refs/restore | Restore repository refs (tags, commits, branches) from object store
 *RepositoriesApi* | [**create_repository**](docs/RepositoriesApi.md#create_repository) | **POST** /repositories | create repository
+*RepositoriesApi* | [**delete_gc_rules**](docs/RepositoriesApi.md#delete_gc_rules) | **DELETE** /repositories/{repository}/settings/gc_rules | 
 *RepositoriesApi* | [**delete_repository**](docs/RepositoriesApi.md#delete_repository) | **DELETE** /repositories/{repository} | delete repository
+*RepositoriesApi* | [**get_branch_protection_rules**](docs/RepositoriesApi.md#get_branch_protection_rules) | **GET** /repositories/{repository}/settings/branch_protection | get branch protection rules
+*RepositoriesApi* | [**get_gc_rules**](docs/RepositoriesApi.md#get_gc_rules) | **GET** /repositories/{repository}/settings/gc_rules | get repository GC rules
 *RepositoriesApi* | [**get_repository**](docs/RepositoriesApi.md#get_repository) | **GET** /repositories/{repository} | get repository
 *RepositoriesApi* | [**get_repository_metadata**](docs/RepositoriesApi.md#get_repository_metadata) | **GET** /repositories/{repository}/metadata | get repository metadata
 *RepositoriesApi* | [**list_repositories**](docs/RepositoriesApi.md#list_repositories) | **GET** /repositories | list repositories
+*RepositoriesApi* | [**set_branch_protection_rules**](docs/RepositoriesApi.md#set_branch_protection_rules) | **PUT** /repositories/{repository}/settings/branch_protection | 
+*RepositoriesApi* | [**set_gc_rules**](docs/RepositoriesApi.md#set_gc_rules) | **PUT** /repositories/{repository}/settings/gc_rules | 
 *RetentionApi* | [**prepare_garbage_collection_commits**](docs/RetentionApi.md#prepare_garbage_collection_commits) | **POST** /repositories/{repository}/gc/prepare_commits | save lists of active commits for garbage collection
 *RetentionApi* | [**prepare_garbage_collection_uncommitted**](docs/RetentionApi.md#prepare_garbage_collection_uncommitted) | **POST** /repositories/{repository}/gc/prepare_uncommited | save repository uncommitted metadata for garbage collection
 *StagingApi* | [**get_physical_address**](docs/StagingApi.md#get_physical_address) | **GET** /repositories/{repository}/branches/{branch}/staging/backing | get a physical address and a return token to write object to underlying storage
diff --git a/clients/python/docs/InternalApi.md b/clients/python/docs/InternalApi.md
index 216bcd5944e..e5b0a683665 100644
--- a/clients/python/docs/InternalApi.md
+++ b/clients/python/docs/InternalApi.md
@@ -4,26 +4,26 @@ All URIs are relative to *http://localhost/api/v1*
 
 Method | HTTP request | Description
 ------------- | ------------- | -------------
-[**create_branch_protection_rule**](InternalApi.md#create_branch_protection_rule) | **POST** /repositories/{repository}/branch_protection | 
 [**create_branch_protection_rule_preflight**](InternalApi.md#create_branch_protection_rule_preflight) | **GET** /repositories/{repository}/branch_protection/set_allowed | 
 [**create_symlink_file**](InternalApi.md#create_symlink_file) | **POST** /repositories/{repository}/refs/{branch}/symlink | creates symlink files corresponding to the given directory
-[**delete_branch_protection_rule**](InternalApi.md#delete_branch_protection_rule) | **DELETE** /repositories/{repository}/branch_protection | 
-[**delete_garbage_collection_rules**](InternalApi.md#delete_garbage_collection_rules) | **DELETE** /repositories/{repository}/gc/rules | 
 [**get_auth_capabilities**](InternalApi.md#get_auth_capabilities) | **GET** /auth/capabilities | list authentication capabilities supported
-[**get_branch_protection_rules**](InternalApi.md#get_branch_protection_rules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
 [**get_garbage_collection_config**](InternalApi.md#get_garbage_collection_config) | **GET** /config/garbage-collection | 
-[**get_garbage_collection_rules**](InternalApi.md#get_garbage_collection_rules) | **GET** /repositories/{repository}/gc/rules | 
 [**get_setup_state**](InternalApi.md#get_setup_state) | **GET** /setup_lakefs | check if the lakeFS installation is already set up
+[**internal_create_branch_protection_rule**](InternalApi.md#internal_create_branch_protection_rule) | **POST** /repositories/{repository}/branch_protection | 
+[**internal_delete_branch_protection_rule**](InternalApi.md#internal_delete_branch_protection_rule) | **DELETE** /repositories/{repository}/branch_protection | 
+[**internal_delete_garbage_collection_rules**](InternalApi.md#internal_delete_garbage_collection_rules) | **DELETE** /repositories/{repository}/gc/rules | 
+[**internal_get_branch_protection_rules**](InternalApi.md#internal_get_branch_protection_rules) | **GET** /repositories/{repository}/branch_protection | get branch protection rules
+[**internal_get_garbage_collection_rules**](InternalApi.md#internal_get_garbage_collection_rules) | **GET** /repositories/{repository}/gc/rules | 
+[**internal_set_garbage_collection_rules**](InternalApi.md#internal_set_garbage_collection_rules) | **POST** /repositories/{repository}/gc/rules | 
 [**post_stats_events**](InternalApi.md#post_stats_events) | **POST** /statistics | post stats events, this endpoint is meant for internal use only
-[**set_garbage_collection_rules**](InternalApi.md#set_garbage_collection_rules) | **POST** /repositories/{repository}/gc/rules | 
 [**set_garbage_collection_rules_preflight**](InternalApi.md#set_garbage_collection_rules_preflight) | **GET** /repositories/{repository}/gc/rules/set_allowed | 
 [**setup**](InternalApi.md#setup) | **POST** /setup_lakefs | setup lakeFS and create a first user
 [**setup_comm_prefs**](InternalApi.md#setup_comm_prefs) | **POST** /setup_comm_prefs | setup communications preferences
 [**upload_object_preflight**](InternalApi.md#upload_object_preflight) | **GET** /repositories/{repository}/branches/{branch}/objects/stage_allowed | 
 
 
-# **create_branch_protection_rule**
-> create_branch_protection_rule(repository, branch_protection_rule)
+# **create_branch_protection_rule_preflight**
+> create_branch_protection_rule_preflight(repository)
 
 
 
@@ -40,7 +40,6 @@ import time
 import lakefs_client
 from lakefs_client.api import internal_api
 from lakefs_client.model.error import Error
-from lakefs_client.model.branch_protection_rule import BranchProtectionRule
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -87,15 +86,12 @@ with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
     repository = "repository_example" # str | 
-    branch_protection_rule = BranchProtectionRule(
-        pattern="stable_*",
-    ) # BranchProtectionRule | 
 
     # example passing only required values which don't have defaults set
     try:
-        api_instance.create_branch_protection_rule(repository, branch_protection_rule)
+        api_instance.create_branch_protection_rule_preflight(repository)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->create_branch_protection_rule: %s\n" % e)
+        print("Exception when calling InternalApi->create_branch_protection_rule_preflight: %s\n" % e)
 ```
 
 
@@ -104,7 +100,6 @@ with lakefs_client.ApiClient(configuration) as api_client:
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **str**|  |
- **branch_protection_rule** | [**BranchProtectionRule**](BranchProtectionRule.md)|  |
 
 ### Return type
 
@@ -116,7 +111,7 @@ void (empty response body)
 
 ### HTTP request headers
 
- - **Content-Type**: application/json
+ - **Content-Type**: Not defined
  - **Accept**: application/json
 
 
@@ -124,17 +119,18 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | branch protection rule created successfully |  -  |
+**204** | User has permissions to create a branch protection rule in this repository |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
+**409** | Resource Conflicts With Target |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **create_branch_protection_rule_preflight**
-> create_branch_protection_rule_preflight(repository)
-
+# **create_symlink_file**
+> StorageURI create_symlink_file(repository, branch)
 
+creates symlink files corresponding to the given directory
 
 ### Example
 
@@ -149,6 +145,7 @@ import time
 import lakefs_client
 from lakefs_client.api import internal_api
 from lakefs_client.model.error import Error
+from lakefs_client.model.storage_uri import StorageURI
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -195,12 +192,25 @@ with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
     repository = "repository_example" # str | 
+    branch = "branch_example" # str | 
+    location = "location_example" # str | path to the table data (optional)
 
     # example passing only required values which don't have defaults set
     try:
-        api_instance.create_branch_protection_rule_preflight(repository)
+        # creates symlink files corresponding to the given directory
+        api_response = api_instance.create_symlink_file(repository, branch)
+        pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->create_branch_protection_rule_preflight: %s\n" % e)
+        print("Exception when calling InternalApi->create_symlink_file: %s\n" % e)
+
+    # example passing only required values which don't have defaults set
+    # and optional values
+    try:
+        # creates symlink files corresponding to the given directory
+        api_response = api_instance.create_symlink_file(repository, branch, location=location)
+        pprint(api_response)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling InternalApi->create_symlink_file: %s\n" % e)
 ```
 
 
@@ -209,10 +219,12 @@ with lakefs_client.ApiClient(configuration) as api_client:
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **str**|  |
+ **branch** | **str**|  |
+ **location** | **str**| path to the table data | [optional]
 
 ### Return type
 
-void (empty response body)
+[**StorageURI**](StorageURI.md)
 
 ### Authorization
 
@@ -228,18 +240,82 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | User has permissions to create a branch protection rule in this repository |  -  |
+**201** | location created |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
-**409** | Resource Conflicts With Target |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **create_symlink_file**
-> StorageURI create_symlink_file(repository, branch)
+# **get_auth_capabilities**
+> AuthCapabilities get_auth_capabilities()
 
-creates symlink files corresponding to the given directory
+list authentication capabilities supported
+
+### Example
+
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import internal_api
+from lakefs_client.model.error import Error
+from lakefs_client.model.auth_capabilities import AuthCapabilities
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient() as api_client:
+    # Create an instance of the API class
+    api_instance = internal_api.InternalApi(api_client)
+
+    # example, this endpoint has no required or optional parameters
+    try:
+        # list authentication capabilities supported
+        api_response = api_instance.get_auth_capabilities()
+        pprint(api_response)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling InternalApi->get_auth_capabilities: %s\n" % e)
+```
+
+
+### Parameters
+This endpoint does not need any parameter.
+
+### Return type
+
+[**AuthCapabilities**](AuthCapabilities.md)
+
+### Authorization
+
+No authorization required
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | auth capabilities |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
+# **get_garbage_collection_config**
+> GarbageCollectionConfig get_garbage_collection_config()
+
+
+
+get information of gc settings
 
 ### Example
 
@@ -253,8 +329,8 @@ creates symlink files corresponding to the given directory
 import time
 import lakefs_client
 from lakefs_client.api import internal_api
+from lakefs_client.model.garbage_collection_config import GarbageCollectionConfig
 from lakefs_client.model.error import Error
-from lakefs_client.model.storage_uri import StorageURI
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -300,44 +376,89 @@ configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
 with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
-    repository = "repository_example" # str | 
-    branch = "branch_example" # str | 
-    location = "location_example" # str | path to the table data (optional)
 
-    # example passing only required values which don't have defaults set
+    # example, this endpoint has no required or optional parameters
     try:
-        # creates symlink files corresponding to the given directory
-        api_response = api_instance.create_symlink_file(repository, branch)
+        api_response = api_instance.get_garbage_collection_config()
         pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->create_symlink_file: %s\n" % e)
+        print("Exception when calling InternalApi->get_garbage_collection_config: %s\n" % e)
+```
 
-    # example passing only required values which don't have defaults set
-    # and optional values
+
+### Parameters
+This endpoint does not need any parameter.
+
+### Return type
+
+[**GarbageCollectionConfig**](GarbageCollectionConfig.md)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | lakeFS garbage collection config |  -  |
+**401** | Unauthorized |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
+# **get_setup_state**
+> SetupState get_setup_state()
+
+check if the lakeFS installation is already set up
+
+### Example
+
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import internal_api
+from lakefs_client.model.error import Error
+from lakefs_client.model.setup_state import SetupState
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient() as api_client:
+    # Create an instance of the API class
+    api_instance = internal_api.InternalApi(api_client)
+
+    # example, this endpoint has no required or optional parameters
     try:
-        # creates symlink files corresponding to the given directory
-        api_response = api_instance.create_symlink_file(repository, branch, location=location)
+        # check if the lakeFS installation is already set up
+        api_response = api_instance.get_setup_state()
         pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->create_symlink_file: %s\n" % e)
+        print("Exception when calling InternalApi->get_setup_state: %s\n" % e)
 ```
 
 
 ### Parameters
-
-Name | Type | Description  | Notes
-------------- | ------------- | ------------- | -------------
- **repository** | **str**|  |
- **branch** | **str**|  |
- **location** | **str**| path to the table data | [optional]
+This endpoint does not need any parameter.
 
 ### Return type
 
-[**StorageURI**](StorageURI.md)
+[**SetupState**](SetupState.md)
 
 ### Authorization
 
-[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+No authorization required
 
 ### HTTP request headers
 
@@ -349,15 +470,13 @@ Name | Type | Description  | Notes
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**201** | location created |  -  |
-**401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
+**200** | lakeFS setup state |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **delete_branch_protection_rule**
-> delete_branch_protection_rule(repository, inline_object1)
+# **internal_create_branch_protection_rule**
+> internal_create_branch_protection_rule(repository, branch_protection_rule)
 
 
 
@@ -374,7 +493,7 @@ import time
 import lakefs_client
 from lakefs_client.api import internal_api
 from lakefs_client.model.error import Error
-from lakefs_client.model.inline_object1 import InlineObject1
+from lakefs_client.model.branch_protection_rule import BranchProtectionRule
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -421,15 +540,15 @@ with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
     repository = "repository_example" # str | 
-    inline_object1 = InlineObject1(
-        pattern="pattern_example",
-    ) # InlineObject1 | 
+    branch_protection_rule = BranchProtectionRule(
+        pattern="stable_*",
+    ) # BranchProtectionRule | 
 
     # example passing only required values which don't have defaults set
     try:
-        api_instance.delete_branch_protection_rule(repository, inline_object1)
+        api_instance.internal_create_branch_protection_rule(repository, branch_protection_rule)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->delete_branch_protection_rule: %s\n" % e)
+        print("Exception when calling InternalApi->internal_create_branch_protection_rule: %s\n" % e)
 ```
 
 
@@ -438,7 +557,7 @@ with lakefs_client.ApiClient(configuration) as api_client:
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **str**|  |
- **inline_object1** | [**InlineObject1**](InlineObject1.md)|  |
+ **branch_protection_rule** | [**BranchProtectionRule**](BranchProtectionRule.md)|  |
 
 ### Return type
 
@@ -458,15 +577,15 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | branch protection rule deleted successfully |  -  |
+**204** | branch protection rule created successfully |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **delete_garbage_collection_rules**
-> delete_garbage_collection_rules(repository)
+# **internal_delete_branch_protection_rule**
+> internal_delete_branch_protection_rule(repository, inline_object1)
 
 
 
@@ -483,6 +602,7 @@ import time
 import lakefs_client
 from lakefs_client.api import internal_api
 from lakefs_client.model.error import Error
+from lakefs_client.model.inline_object1 import InlineObject1
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -529,12 +649,15 @@ with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
     repository = "repository_example" # str | 
+    inline_object1 = InlineObject1(
+        pattern="pattern_example",
+    ) # InlineObject1 | 
 
     # example passing only required values which don't have defaults set
     try:
-        api_instance.delete_garbage_collection_rules(repository)
+        api_instance.internal_delete_branch_protection_rule(repository, inline_object1)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->delete_garbage_collection_rules: %s\n" % e)
+        print("Exception when calling InternalApi->internal_delete_branch_protection_rule: %s\n" % e)
 ```
 
 
@@ -543,6 +666,7 @@ with lakefs_client.ApiClient(configuration) as api_client:
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
  **repository** | **str**|  |
+ **inline_object1** | [**InlineObject1**](InlineObject1.md)|  |
 
 ### Return type
 
@@ -554,7 +678,7 @@ void (empty response body)
 
 ### HTTP request headers
 
- - **Content-Type**: Not defined
+ - **Content-Type**: application/json
  - **Accept**: application/json
 
 
@@ -562,80 +686,17 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | deleted garbage collection rules successfully |  -  |
+**204** | branch protection rule deleted successfully |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **get_auth_capabilities**
-> AuthCapabilities get_auth_capabilities()
-
-list authentication capabilities supported
-
-### Example
-
-
-```python
-import time
-import lakefs_client
-from lakefs_client.api import internal_api
-from lakefs_client.model.error import Error
-from lakefs_client.model.auth_capabilities import AuthCapabilities
-from pprint import pprint
-# Defining the host is optional and defaults to http://localhost/api/v1
-# See configuration.py for a list of all supported configuration parameters.
-configuration = lakefs_client.Configuration(
-    host = "http://localhost/api/v1"
-)
-
-
-# Enter a context with an instance of the API client
-with lakefs_client.ApiClient() as api_client:
-    # Create an instance of the API class
-    api_instance = internal_api.InternalApi(api_client)
-
-    # example, this endpoint has no required or optional parameters
-    try:
-        # list authentication capabilities supported
-        api_response = api_instance.get_auth_capabilities()
-        pprint(api_response)
-    except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->get_auth_capabilities: %s\n" % e)
-```
-
-
-### Parameters
-This endpoint does not need any parameter.
-
-### Return type
-
-[**AuthCapabilities**](AuthCapabilities.md)
-
-### Authorization
-
-No authorization required
-
-### HTTP request headers
-
- - **Content-Type**: Not defined
- - **Accept**: application/json
-
-
-### HTTP response details
-
-| Status code | Description | Response headers |
-|-------------|-------------|------------------|
-**200** | auth capabilities |  -  |
-**0** | Internal Server Error |  -  |
-
-[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+# **internal_delete_garbage_collection_rules**
+> internal_delete_garbage_collection_rules(repository)
 
-# **get_branch_protection_rules**
-> [BranchProtectionRule] get_branch_protection_rules(repository)
 
-get branch protection rules
 
 ### Example
 
@@ -650,7 +711,6 @@ import time
 import lakefs_client
 from lakefs_client.api import internal_api
 from lakefs_client.model.error import Error
-from lakefs_client.model.branch_protection_rule import BranchProtectionRule
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -700,11 +760,9 @@ with lakefs_client.ApiClient(configuration) as api_client:
 
     # example passing only required values which don't have defaults set
     try:
-        # get branch protection rules
-        api_response = api_instance.get_branch_protection_rules(repository)
-        pprint(api_response)
+        api_instance.internal_delete_garbage_collection_rules(repository)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->get_branch_protection_rules: %s\n" % e)
+        print("Exception when calling InternalApi->internal_delete_garbage_collection_rules: %s\n" % e)
 ```
 
 
@@ -716,7 +774,7 @@ Name | Type | Description  | Notes
 
 ### Return type
 
-[**[BranchProtectionRule]**](BranchProtectionRule.md)
+void (empty response body)
 
 ### Authorization
 
@@ -732,19 +790,17 @@ Name | Type | Description  | Notes
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | branch protection rules |  -  |
+**204** | deleted garbage collection rules successfully |  -  |
 **401** | Unauthorized |  -  |
 **404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **get_garbage_collection_config**
-> GarbageCollectionConfig get_garbage_collection_config()
-
-
+# **internal_get_branch_protection_rules**
+> [BranchProtectionRule] internal_get_branch_protection_rules(repository)
 
-get information of gc settings
+get branch protection rules
 
 ### Example
 
@@ -758,8 +814,8 @@ get information of gc settings
 import time
 import lakefs_client
 from lakefs_client.api import internal_api
-from lakefs_client.model.garbage_collection_config import GarbageCollectionConfig
 from lakefs_client.model.error import Error
+from lakefs_client.model.branch_protection_rule import BranchProtectionRule
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -805,22 +861,27 @@ configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
 with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
+    repository = "repository_example" # str | 
 
-    # example, this endpoint has no required or optional parameters
+    # example passing only required values which don't have defaults set
     try:
-        api_response = api_instance.get_garbage_collection_config()
+        # get branch protection rules
+        api_response = api_instance.internal_get_branch_protection_rules(repository)
         pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->get_garbage_collection_config: %s\n" % e)
+        print("Exception when calling InternalApi->internal_get_branch_protection_rules: %s\n" % e)
 ```
 
 
 ### Parameters
-This endpoint does not need any parameter.
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
 
 ### Return type
 
-[**GarbageCollectionConfig**](GarbageCollectionConfig.md)
+[**[BranchProtectionRule]**](BranchProtectionRule.md)
 
 ### Authorization
 
@@ -836,13 +897,15 @@ This endpoint does not need any parameter.
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**200** | lakeFS garbage collection config |  -  |
+**200** | branch protection rules |  -  |
 **401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **get_garbage_collection_rules**
-> GarbageCollectionRules get_garbage_collection_rules(repository)
+# **internal_get_garbage_collection_rules**
+> GarbageCollectionRules internal_get_garbage_collection_rules(repository)
 
 
 
@@ -909,10 +972,10 @@ with lakefs_client.ApiClient(configuration) as api_client:
 
     # example passing only required values which don't have defaults set
     try:
-        api_response = api_instance.get_garbage_collection_rules(repository)
+        api_response = api_instance.internal_get_garbage_collection_rules(repository)
         pprint(api_response)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->get_garbage_collection_rules: %s\n" % e)
+        print("Exception when calling InternalApi->internal_get_garbage_collection_rules: %s\n" % e)
 ```
 
 
@@ -947,74 +1010,11 @@ Name | Type | Description  | Notes
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **get_setup_state**
-> SetupState get_setup_state()
+# **internal_set_garbage_collection_rules**
+> internal_set_garbage_collection_rules(repository, garbage_collection_rules)
 
-check if the lakeFS installation is already set up
-
-### Example
 
 
-```python
-import time
-import lakefs_client
-from lakefs_client.api import internal_api
-from lakefs_client.model.error import Error
-from lakefs_client.model.setup_state import SetupState
-from pprint import pprint
-# Defining the host is optional and defaults to http://localhost/api/v1
-# See configuration.py for a list of all supported configuration parameters.
-configuration = lakefs_client.Configuration(
-    host = "http://localhost/api/v1"
-)
-
-
-# Enter a context with an instance of the API client
-with lakefs_client.ApiClient() as api_client:
-    # Create an instance of the API class
-    api_instance = internal_api.InternalApi(api_client)
-
-    # example, this endpoint has no required or optional parameters
-    try:
-        # check if the lakeFS installation is already set up
-        api_response = api_instance.get_setup_state()
-        pprint(api_response)
-    except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->get_setup_state: %s\n" % e)
-```
-
-
-### Parameters
-This endpoint does not need any parameter.
-
-### Return type
-
-[**SetupState**](SetupState.md)
-
-### Authorization
-
-No authorization required
-
-### HTTP request headers
-
- - **Content-Type**: Not defined
- - **Accept**: application/json
-
-
-### HTTP response details
-
-| Status code | Description | Response headers |
-|-------------|-------------|------------------|
-**200** | lakeFS setup state |  -  |
-**0** | Internal Server Error |  -  |
-
-[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
-
-# **post_stats_events**
-> post_stats_events(stats_events_list)
-
-post stats events, this endpoint is meant for internal use only
-
 ### Example
 
 * Basic Authentication (basic_auth):
@@ -1027,8 +1027,8 @@ post stats events, this endpoint is meant for internal use only
 import time
 import lakefs_client
 from lakefs_client.api import internal_api
+from lakefs_client.model.garbage_collection_rules import GarbageCollectionRules
 from lakefs_client.model.error import Error
-from lakefs_client.model.stats_events_list import StatsEventsList
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -1074,22 +1074,22 @@ configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
 with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
-    stats_events_list = StatsEventsList(
-        events=[
-            StatsEvent(
-                _class="_class_example",
-                name="name_example",
-                count=1,
+    repository = "repository_example" # str | 
+    garbage_collection_rules = GarbageCollectionRules(
+        default_retention_days=1,
+        branches=[
+            GarbageCollectionRule(
+                branch_id="branch_id_example",
+                retention_days=1,
             ),
         ],
-    ) # StatsEventsList | 
+    ) # GarbageCollectionRules | 
 
     # example passing only required values which don't have defaults set
     try:
-        # post stats events, this endpoint is meant for internal use only
-        api_instance.post_stats_events(stats_events_list)
+        api_instance.internal_set_garbage_collection_rules(repository, garbage_collection_rules)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->post_stats_events: %s\n" % e)
+        print("Exception when calling InternalApi->internal_set_garbage_collection_rules: %s\n" % e)
 ```
 
 
@@ -1097,7 +1097,8 @@ with lakefs_client.ApiClient(configuration) as api_client:
 
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
- **stats_events_list** | [**StatsEventsList**](StatsEventsList.md)|  |
+ **repository** | **str**|  |
+ **garbage_collection_rules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
 
 ### Return type
 
@@ -1117,17 +1118,17 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | reported successfully |  -  |
-**400** | Bad Request |  -  |
+**204** | set garbage collection rules successfully |  -  |
 **401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
-# **set_garbage_collection_rules**
-> set_garbage_collection_rules(repository, garbage_collection_rules)
-
+# **post_stats_events**
+> post_stats_events(stats_events_list)
 
+post stats events, this endpoint is meant for internal use only
 
 ### Example
 
@@ -1141,8 +1142,8 @@ void (empty response body)
 import time
 import lakefs_client
 from lakefs_client.api import internal_api
-from lakefs_client.model.garbage_collection_rules import GarbageCollectionRules
 from lakefs_client.model.error import Error
+from lakefs_client.model.stats_events_list import StatsEventsList
 from pprint import pprint
 # Defining the host is optional and defaults to http://localhost/api/v1
 # See configuration.py for a list of all supported configuration parameters.
@@ -1188,22 +1189,22 @@ configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
 with lakefs_client.ApiClient(configuration) as api_client:
     # Create an instance of the API class
     api_instance = internal_api.InternalApi(api_client)
-    repository = "repository_example" # str | 
-    garbage_collection_rules = GarbageCollectionRules(
-        default_retention_days=1,
-        branches=[
-            GarbageCollectionRule(
-                branch_id="branch_id_example",
-                retention_days=1,
+    stats_events_list = StatsEventsList(
+        events=[
+            StatsEvent(
+                _class="_class_example",
+                name="name_example",
+                count=1,
             ),
         ],
-    ) # GarbageCollectionRules | 
+    ) # StatsEventsList | 
 
     # example passing only required values which don't have defaults set
     try:
-        api_instance.set_garbage_collection_rules(repository, garbage_collection_rules)
+        # post stats events, this endpoint is meant for internal use only
+        api_instance.post_stats_events(stats_events_list)
     except lakefs_client.ApiException as e:
-        print("Exception when calling InternalApi->set_garbage_collection_rules: %s\n" % e)
+        print("Exception when calling InternalApi->post_stats_events: %s\n" % e)
 ```
 
 
@@ -1211,8 +1212,7 @@ with lakefs_client.ApiClient(configuration) as api_client:
 
 Name | Type | Description  | Notes
 ------------- | ------------- | ------------- | -------------
- **repository** | **str**|  |
- **garbage_collection_rules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
+ **stats_events_list** | [**StatsEventsList**](StatsEventsList.md)|  |
 
 ### Return type
 
@@ -1232,9 +1232,9 @@ void (empty response body)
 
 | Status code | Description | Response headers |
 |-------------|-------------|------------------|
-**204** | set garbage collection rules successfully |  -  |
+**204** | reported successfully |  -  |
+**400** | Bad Request |  -  |
 **401** | Unauthorized |  -  |
-**404** | Resource Not Found |  -  |
 **0** | Internal Server Error |  -  |
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
diff --git a/clients/python/docs/RepositoriesApi.md b/clients/python/docs/RepositoriesApi.md
index 09e03d25f67..c2b149d1436 100644
--- a/clients/python/docs/RepositoriesApi.md
+++ b/clients/python/docs/RepositoriesApi.md
@@ -5,10 +5,15 @@ All URIs are relative to *http://localhost/api/v1*
 Method | HTTP request | Description
 ------------- | ------------- | -------------
 [**create_repository**](RepositoriesApi.md#create_repository) | **POST** /repositories | create repository
+[**delete_gc_rules**](RepositoriesApi.md#delete_gc_rules) | **DELETE** /repositories/{repository}/settings/gc_rules | 
 [**delete_repository**](RepositoriesApi.md#delete_repository) | **DELETE** /repositories/{repository} | delete repository
+[**get_branch_protection_rules**](RepositoriesApi.md#get_branch_protection_rules) | **GET** /repositories/{repository}/settings/branch_protection | get branch protection rules
+[**get_gc_rules**](RepositoriesApi.md#get_gc_rules) | **GET** /repositories/{repository}/settings/gc_rules | get repository GC rules
 [**get_repository**](RepositoriesApi.md#get_repository) | **GET** /repositories/{repository} | get repository
 [**get_repository_metadata**](RepositoriesApi.md#get_repository_metadata) | **GET** /repositories/{repository}/metadata | get repository metadata
 [**list_repositories**](RepositoriesApi.md#list_repositories) | **GET** /repositories | list repositories
+[**set_branch_protection_rules**](RepositoriesApi.md#set_branch_protection_rules) | **PUT** /repositories/{repository}/settings/branch_protection | 
+[**set_gc_rules**](RepositoriesApi.md#set_gc_rules) | **PUT** /repositories/{repository}/settings/gc_rules | 
 
 
 # **create_repository**
@@ -136,6 +141,110 @@ Name | Type | Description  | Notes
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
+# **delete_gc_rules**
+> delete_gc_rules(repository)
+
+
+
+### Example
+
+* Basic Authentication (basic_auth):
+* Api Key Authentication (cookie_auth):
+* Bearer (JWT) Authentication (jwt_token):
+* Api Key Authentication (oidc_auth):
+* Api Key Authentication (saml_auth):
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import repositories_api
+from lakefs_client.model.error import Error
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure HTTP basic authorization: basic_auth
+configuration = lakefs_client.Configuration(
+    username = 'YOUR_USERNAME',
+    password = 'YOUR_PASSWORD'
+)
+
+# Configure API key authorization: cookie_auth
+configuration.api_key['cookie_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['cookie_auth'] = 'Bearer'
+
+# Configure Bearer authorization (JWT): jwt_token
+configuration = lakefs_client.Configuration(
+    access_token = 'YOUR_BEARER_TOKEN'
+)
+
+# Configure API key authorization: oidc_auth
+configuration.api_key['oidc_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['oidc_auth'] = 'Bearer'
+
+# Configure API key authorization: saml_auth
+configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['saml_auth'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = repositories_api.RepositoriesApi(api_client)
+    repository = "repository_example" # str | 
+
+    # example passing only required values which don't have defaults set
+    try:
+        api_instance.delete_gc_rules(repository)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->delete_gc_rules: %s\n" % e)
+```
+
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | deleted garbage collection rules successfully |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
 # **delete_repository**
 > delete_repository(repository)
 
@@ -241,6 +350,220 @@ void (empty response body)
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
+# **get_branch_protection_rules**
+> [BranchProtectionRule] get_branch_protection_rules(repository)
+
+get branch protection rules
+
+### Example
+
+* Basic Authentication (basic_auth):
+* Api Key Authentication (cookie_auth):
+* Bearer (JWT) Authentication (jwt_token):
+* Api Key Authentication (oidc_auth):
+* Api Key Authentication (saml_auth):
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import repositories_api
+from lakefs_client.model.error import Error
+from lakefs_client.model.branch_protection_rule import BranchProtectionRule
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure HTTP basic authorization: basic_auth
+configuration = lakefs_client.Configuration(
+    username = 'YOUR_USERNAME',
+    password = 'YOUR_PASSWORD'
+)
+
+# Configure API key authorization: cookie_auth
+configuration.api_key['cookie_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['cookie_auth'] = 'Bearer'
+
+# Configure Bearer authorization (JWT): jwt_token
+configuration = lakefs_client.Configuration(
+    access_token = 'YOUR_BEARER_TOKEN'
+)
+
+# Configure API key authorization: oidc_auth
+configuration.api_key['oidc_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['oidc_auth'] = 'Bearer'
+
+# Configure API key authorization: saml_auth
+configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['saml_auth'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = repositories_api.RepositoriesApi(api_client)
+    repository = "repository_example" # str | 
+
+    # example passing only required values which don't have defaults set
+    try:
+        # get branch protection rules
+        api_response = api_instance.get_branch_protection_rules(repository)
+        pprint(api_response)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->get_branch_protection_rules: %s\n" % e)
+```
+
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
+
+### Return type
+
+[**[BranchProtectionRule]**](BranchProtectionRule.md)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | branch protection rules |  * ETag -  <br>  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
+# **get_gc_rules**
+> GarbageCollectionRules get_gc_rules(repository)
+
+get repository GC rules
+
+### Example
+
+* Basic Authentication (basic_auth):
+* Api Key Authentication (cookie_auth):
+* Bearer (JWT) Authentication (jwt_token):
+* Api Key Authentication (oidc_auth):
+* Api Key Authentication (saml_auth):
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import repositories_api
+from lakefs_client.model.garbage_collection_rules import GarbageCollectionRules
+from lakefs_client.model.error import Error
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure HTTP basic authorization: basic_auth
+configuration = lakefs_client.Configuration(
+    username = 'YOUR_USERNAME',
+    password = 'YOUR_PASSWORD'
+)
+
+# Configure API key authorization: cookie_auth
+configuration.api_key['cookie_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['cookie_auth'] = 'Bearer'
+
+# Configure Bearer authorization (JWT): jwt_token
+configuration = lakefs_client.Configuration(
+    access_token = 'YOUR_BEARER_TOKEN'
+)
+
+# Configure API key authorization: oidc_auth
+configuration.api_key['oidc_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['oidc_auth'] = 'Bearer'
+
+# Configure API key authorization: saml_auth
+configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['saml_auth'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = repositories_api.RepositoriesApi(api_client)
+    repository = "repository_example" # str | 
+
+    # example passing only required values which don't have defaults set
+    try:
+        # get repository GC rules
+        api_response = api_instance.get_gc_rules(repository)
+        pprint(api_response)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->get_gc_rules: %s\n" % e)
+```
+
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
+
+### Return type
+
+[**GarbageCollectionRules**](GarbageCollectionRules.md)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: Not defined
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**200** | repository GC rules |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
 # **get_repository**
 > Repository get_repository(repository)
 
@@ -566,3 +889,240 @@ Name | Type | Description  | Notes
 
 [[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
 
+# **set_branch_protection_rules**
+> set_branch_protection_rules(repository, branch_protection_rule)
+
+
+
+### Example
+
+* Basic Authentication (basic_auth):
+* Api Key Authentication (cookie_auth):
+* Bearer (JWT) Authentication (jwt_token):
+* Api Key Authentication (oidc_auth):
+* Api Key Authentication (saml_auth):
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import repositories_api
+from lakefs_client.model.error import Error
+from lakefs_client.model.branch_protection_rule import BranchProtectionRule
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure HTTP basic authorization: basic_auth
+configuration = lakefs_client.Configuration(
+    username = 'YOUR_USERNAME',
+    password = 'YOUR_PASSWORD'
+)
+
+# Configure API key authorization: cookie_auth
+configuration.api_key['cookie_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['cookie_auth'] = 'Bearer'
+
+# Configure Bearer authorization (JWT): jwt_token
+configuration = lakefs_client.Configuration(
+    access_token = 'YOUR_BEARER_TOKEN'
+)
+
+# Configure API key authorization: oidc_auth
+configuration.api_key['oidc_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['oidc_auth'] = 'Bearer'
+
+# Configure API key authorization: saml_auth
+configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['saml_auth'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = repositories_api.RepositoriesApi(api_client)
+    repository = "repository_example" # str | 
+    branch_protection_rule = [
+        BranchProtectionRule(
+            pattern="stable_*",
+        ),
+    ] # [BranchProtectionRule] | 
+    if_match = "If-Match_example" # str | if provided, the branch protection rules will be updated only if the current ETag match the provided value (optional)
+
+    # example passing only required values which don't have defaults set
+    try:
+        api_instance.set_branch_protection_rules(repository, branch_protection_rule)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->set_branch_protection_rules: %s\n" % e)
+
+    # example passing only required values which don't have defaults set
+    # and optional values
+    try:
+        api_instance.set_branch_protection_rules(repository, branch_protection_rule, if_match=if_match)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->set_branch_protection_rules: %s\n" % e)
+```
+
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
+ **branch_protection_rule** | [**[BranchProtectionRule]**](BranchProtectionRule.md)|  |
+ **if_match** | **str**| if provided, the branch protection rules will be updated only if the current ETag match the provided value | [optional]
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | branch protection rule created successfully |  -  |
+**400** | Bad Request |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**412** | Precondition Failed |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
+# **set_gc_rules**
+> set_gc_rules(repository, garbage_collection_rules)
+
+
+
+### Example
+
+* Basic Authentication (basic_auth):
+* Api Key Authentication (cookie_auth):
+* Bearer (JWT) Authentication (jwt_token):
+* Api Key Authentication (oidc_auth):
+* Api Key Authentication (saml_auth):
+
+```python
+import time
+import lakefs_client
+from lakefs_client.api import repositories_api
+from lakefs_client.model.garbage_collection_rules import GarbageCollectionRules
+from lakefs_client.model.error import Error
+from pprint import pprint
+# Defining the host is optional and defaults to http://localhost/api/v1
+# See configuration.py for a list of all supported configuration parameters.
+configuration = lakefs_client.Configuration(
+    host = "http://localhost/api/v1"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure HTTP basic authorization: basic_auth
+configuration = lakefs_client.Configuration(
+    username = 'YOUR_USERNAME',
+    password = 'YOUR_PASSWORD'
+)
+
+# Configure API key authorization: cookie_auth
+configuration.api_key['cookie_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['cookie_auth'] = 'Bearer'
+
+# Configure Bearer authorization (JWT): jwt_token
+configuration = lakefs_client.Configuration(
+    access_token = 'YOUR_BEARER_TOKEN'
+)
+
+# Configure API key authorization: oidc_auth
+configuration.api_key['oidc_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['oidc_auth'] = 'Bearer'
+
+# Configure API key authorization: saml_auth
+configuration.api_key['saml_auth'] = 'YOUR_API_KEY'
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['saml_auth'] = 'Bearer'
+
+# Enter a context with an instance of the API client
+with lakefs_client.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = repositories_api.RepositoriesApi(api_client)
+    repository = "repository_example" # str | 
+    garbage_collection_rules = GarbageCollectionRules(
+        default_retention_days=1,
+        branches=[
+            GarbageCollectionRule(
+                branch_id="branch_id_example",
+                retention_days=1,
+            ),
+        ],
+    ) # GarbageCollectionRules | 
+
+    # example passing only required values which don't have defaults set
+    try:
+        api_instance.set_gc_rules(repository, garbage_collection_rules)
+    except lakefs_client.ApiException as e:
+        print("Exception when calling RepositoriesApi->set_gc_rules: %s\n" % e)
+```
+
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **repository** | **str**|  |
+ **garbage_collection_rules** | [**GarbageCollectionRules**](GarbageCollectionRules.md)|  |
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+[basic_auth](../README.md#basic_auth), [cookie_auth](../README.md#cookie_auth), [jwt_token](../README.md#jwt_token), [oidc_auth](../README.md#oidc_auth), [saml_auth](../README.md#saml_auth)
+
+### HTTP request headers
+
+ - **Content-Type**: application/json
+ - **Accept**: application/json
+
+
+### HTTP response details
+
+| Status code | Description | Response headers |
+|-------------|-------------|------------------|
+**204** | set garbage collection rules successfully |  -  |
+**401** | Unauthorized |  -  |
+**404** | Resource Not Found |  -  |
+**0** | Internal Server Error |  -  |
+
+[[Back to top]](#) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to Model list]](../README.md#documentation-for-models) [[Back to README]](../README.md)
+
diff --git a/clients/python/lakefs_client/api/internal_api.py b/clients/python/lakefs_client/api/internal_api.py
index 42ef3a6f0a0..2696f385e98 100644
--- a/clients/python/lakefs_client/api/internal_api.py
+++ b/clients/python/lakefs_client/api/internal_api.py
@@ -47,7 +47,7 @@ def __init__(self, api_client=None):
         if api_client is None:
             api_client = ApiClient()
         self.api_client = api_client
-        self.create_branch_protection_rule_endpoint = _Endpoint(
+        self.create_branch_protection_rule_preflight_endpoint = _Endpoint(
             settings={
                 'response_type': None,
                 'auth': [
@@ -57,19 +57,17 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/repositories/{repository}/branch_protection',
-                'operation_id': 'create_branch_protection_rule',
-                'http_method': 'POST',
+                'endpoint_path': '/repositories/{repository}/branch_protection/set_allowed',
+                'operation_id': 'create_branch_protection_rule_preflight',
+                'http_method': 'GET',
                 'servers': None,
             },
             params_map={
                 'all': [
                     'repository',
-                    'branch_protection_rule',
                 ],
                 'required': [
                     'repository',
-                    'branch_protection_rule',
                 ],
                 'nullable': [
                 ],
@@ -86,15 +84,12 @@ def __init__(self, api_client=None):
                 'openapi_types': {
                     'repository':
                         (str,),
-                    'branch_protection_rule':
-                        (BranchProtectionRule,),
                 },
                 'attribute_map': {
                     'repository': 'repository',
                 },
                 'location_map': {
                     'repository': 'path',
-                    'branch_protection_rule': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -103,15 +98,13 @@ def __init__(self, api_client=None):
                 'accept': [
                     'application/json'
                 ],
-                'content_type': [
-                    'application/json'
-                ]
+                'content_type': [],
             },
             api_client=api_client
         )
-        self.create_branch_protection_rule_preflight_endpoint = _Endpoint(
+        self.create_symlink_file_endpoint = _Endpoint(
             settings={
-                'response_type': None,
+                'response_type': (StorageURI,),
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
@@ -119,17 +112,20 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/repositories/{repository}/branch_protection/set_allowed',
-                'operation_id': 'create_branch_protection_rule_preflight',
-                'http_method': 'GET',
+                'endpoint_path': '/repositories/{repository}/refs/{branch}/symlink',
+                'operation_id': 'create_symlink_file',
+                'http_method': 'POST',
                 'servers': None,
             },
             params_map={
                 'all': [
                     'repository',
+                    'branch',
+                    'location',
                 ],
                 'required': [
                     'repository',
+                    'branch',
                 ],
                 'nullable': [
                 ],
@@ -146,12 +142,20 @@ def __init__(self, api_client=None):
                 'openapi_types': {
                     'repository':
                         (str,),
+                    'branch':
+                        (str,),
+                    'location':
+                        (str,),
                 },
                 'attribute_map': {
                     'repository': 'repository',
+                    'branch': 'branch',
+                    'location': 'location',
                 },
                 'location_map': {
                     'repository': 'path',
+                    'branch': 'path',
+                    'location': 'query',
                 },
                 'collection_format_map': {
                 }
@@ -164,31 +168,19 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.create_symlink_file_endpoint = _Endpoint(
+        self.get_auth_capabilities_endpoint = _Endpoint(
             settings={
-                'response_type': (StorageURI,),
-                'auth': [
-                    'basic_auth',
-                    'cookie_auth',
-                    'jwt_token',
-                    'oidc_auth',
-                    'saml_auth'
-                ],
-                'endpoint_path': '/repositories/{repository}/refs/{branch}/symlink',
-                'operation_id': 'create_symlink_file',
-                'http_method': 'POST',
+                'response_type': (AuthCapabilities,),
+                'auth': [],
+                'endpoint_path': '/auth/capabilities',
+                'operation_id': 'get_auth_capabilities',
+                'http_method': 'GET',
                 'servers': None,
             },
             params_map={
                 'all': [
-                    'repository',
-                    'branch',
-                    'location',
-                ],
-                'required': [
-                    'repository',
-                    'branch',
                 ],
+                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -202,22 +194,10 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
-                    'repository':
-                        (str,),
-                    'branch':
-                        (str,),
-                    'location':
-                        (str,),
                 },
                 'attribute_map': {
-                    'repository': 'repository',
-                    'branch': 'branch',
-                    'location': 'location',
                 },
                 'location_map': {
-                    'repository': 'path',
-                    'branch': 'path',
-                    'location': 'query',
                 },
                 'collection_format_map': {
                 }
@@ -230,9 +210,9 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.delete_branch_protection_rule_endpoint = _Endpoint(
+        self.get_garbage_collection_config_endpoint = _Endpoint(
             settings={
-                'response_type': None,
+                'response_type': (GarbageCollectionConfig,),
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
@@ -240,20 +220,15 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/repositories/{repository}/branch_protection',
-                'operation_id': 'delete_branch_protection_rule',
-                'http_method': 'DELETE',
+                'endpoint_path': '/config/garbage-collection',
+                'operation_id': 'get_garbage_collection_config',
+                'http_method': 'GET',
                 'servers': None,
             },
             params_map={
                 'all': [
-                    'repository',
-                    'inline_object1',
-                ],
-                'required': [
-                    'repository',
-                    'inline_object1',
                 ],
+                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -267,17 +242,10 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
-                    'repository':
-                        (str,),
-                    'inline_object1':
-                        (InlineObject1,),
                 },
                 'attribute_map': {
-                    'repository': 'repository',
                 },
                 'location_map': {
-                    'repository': 'path',
-                    'inline_object1': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -286,34 +254,23 @@ def __init__(self, api_client=None):
                 'accept': [
                     'application/json'
                 ],
-                'content_type': [
-                    'application/json'
-                ]
+                'content_type': [],
             },
             api_client=api_client
         )
-        self.delete_garbage_collection_rules_endpoint = _Endpoint(
+        self.get_setup_state_endpoint = _Endpoint(
             settings={
-                'response_type': None,
-                'auth': [
-                    'basic_auth',
-                    'cookie_auth',
-                    'jwt_token',
-                    'oidc_auth',
-                    'saml_auth'
-                ],
-                'endpoint_path': '/repositories/{repository}/gc/rules',
-                'operation_id': 'delete_garbage_collection_rules',
-                'http_method': 'DELETE',
+                'response_type': (SetupState,),
+                'auth': [],
+                'endpoint_path': '/setup_lakefs',
+                'operation_id': 'get_setup_state',
+                'http_method': 'GET',
                 'servers': None,
             },
             params_map={
                 'all': [
-                    'repository',
-                ],
-                'required': [
-                    'repository',
                 ],
+                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -327,14 +284,10 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
-                    'repository':
-                        (str,),
                 },
                 'attribute_map': {
-                    'repository': 'repository',
                 },
                 'location_map': {
-                    'repository': 'path',
                 },
                 'collection_format_map': {
                 }
@@ -347,19 +300,30 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.get_auth_capabilities_endpoint = _Endpoint(
+        self.internal_create_branch_protection_rule_endpoint = _Endpoint(
             settings={
-                'response_type': (AuthCapabilities,),
-                'auth': [],
-                'endpoint_path': '/auth/capabilities',
-                'operation_id': 'get_auth_capabilities',
-                'http_method': 'GET',
+                'response_type': None,
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/branch_protection',
+                'operation_id': 'internal_create_branch_protection_rule',
+                'http_method': 'POST',
                 'servers': None,
             },
             params_map={
                 'all': [
+                    'repository',
+                    'branch_protection_rule',
+                ],
+                'required': [
+                    'repository',
+                    'branch_protection_rule',
                 ],
-                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -373,10 +337,17 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
+                    'repository':
+                        (str,),
+                    'branch_protection_rule':
+                        (BranchProtectionRule,),
                 },
                 'attribute_map': {
+                    'repository': 'repository',
                 },
                 'location_map': {
+                    'repository': 'path',
+                    'branch_protection_rule': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -385,13 +356,15 @@ def __init__(self, api_client=None):
                 'accept': [
                     'application/json'
                 ],
-                'content_type': [],
+                'content_type': [
+                    'application/json'
+                ]
             },
             api_client=api_client
         )
-        self.get_branch_protection_rules_endpoint = _Endpoint(
+        self.internal_delete_branch_protection_rule_endpoint = _Endpoint(
             settings={
-                'response_type': ([BranchProtectionRule],),
+                'response_type': None,
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
@@ -400,16 +373,18 @@ def __init__(self, api_client=None):
                     'saml_auth'
                 ],
                 'endpoint_path': '/repositories/{repository}/branch_protection',
-                'operation_id': 'get_branch_protection_rules',
-                'http_method': 'GET',
+                'operation_id': 'internal_delete_branch_protection_rule',
+                'http_method': 'DELETE',
                 'servers': None,
             },
             params_map={
                 'all': [
                     'repository',
+                    'inline_object1',
                 ],
                 'required': [
                     'repository',
+                    'inline_object1',
                 ],
                 'nullable': [
                 ],
@@ -426,12 +401,15 @@ def __init__(self, api_client=None):
                 'openapi_types': {
                     'repository':
                         (str,),
+                    'inline_object1':
+                        (InlineObject1,),
                 },
                 'attribute_map': {
                     'repository': 'repository',
                 },
                 'location_map': {
                     'repository': 'path',
+                    'inline_object1': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -440,13 +418,15 @@ def __init__(self, api_client=None):
                 'accept': [
                     'application/json'
                 ],
-                'content_type': [],
+                'content_type': [
+                    'application/json'
+                ]
             },
             api_client=api_client
         )
-        self.get_garbage_collection_config_endpoint = _Endpoint(
+        self.internal_delete_garbage_collection_rules_endpoint = _Endpoint(
             settings={
-                'response_type': (GarbageCollectionConfig,),
+                'response_type': None,
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
@@ -454,15 +434,18 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/config/garbage-collection',
-                'operation_id': 'get_garbage_collection_config',
-                'http_method': 'GET',
+                'endpoint_path': '/repositories/{repository}/gc/rules',
+                'operation_id': 'internal_delete_garbage_collection_rules',
+                'http_method': 'DELETE',
                 'servers': None,
             },
             params_map={
                 'all': [
+                    'repository',
+                ],
+                'required': [
+                    'repository',
                 ],
-                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -476,10 +459,14 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
+                    'repository':
+                        (str,),
                 },
                 'attribute_map': {
+                    'repository': 'repository',
                 },
                 'location_map': {
+                    'repository': 'path',
                 },
                 'collection_format_map': {
                 }
@@ -492,9 +479,9 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.get_garbage_collection_rules_endpoint = _Endpoint(
+        self.internal_get_branch_protection_rules_endpoint = _Endpoint(
             settings={
-                'response_type': (GarbageCollectionRules,),
+                'response_type': ([BranchProtectionRule],),
                 'auth': [
                     'basic_auth',
                     'cookie_auth',
@@ -502,8 +489,8 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/repositories/{repository}/gc/rules',
-                'operation_id': 'get_garbage_collection_rules',
+                'endpoint_path': '/repositories/{repository}/branch_protection',
+                'operation_id': 'internal_get_branch_protection_rules',
                 'http_method': 'GET',
                 'servers': None,
             },
@@ -547,19 +534,28 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.get_setup_state_endpoint = _Endpoint(
+        self.internal_get_garbage_collection_rules_endpoint = _Endpoint(
             settings={
-                'response_type': (SetupState,),
-                'auth': [],
-                'endpoint_path': '/setup_lakefs',
-                'operation_id': 'get_setup_state',
+                'response_type': (GarbageCollectionRules,),
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/gc/rules',
+                'operation_id': 'internal_get_garbage_collection_rules',
                 'http_method': 'GET',
                 'servers': None,
             },
             params_map={
                 'all': [
+                    'repository',
+                ],
+                'required': [
+                    'repository',
                 ],
-                'required': [],
                 'nullable': [
                 ],
                 'enum': [
@@ -573,10 +569,14 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
+                    'repository':
+                        (str,),
                 },
                 'attribute_map': {
+                    'repository': 'repository',
                 },
                 'location_map': {
+                    'repository': 'path',
                 },
                 'collection_format_map': {
                 }
@@ -589,7 +589,7 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.post_stats_events_endpoint = _Endpoint(
+        self.internal_set_garbage_collection_rules_endpoint = _Endpoint(
             settings={
                 'response_type': None,
                 'auth': [
@@ -599,17 +599,19 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/statistics',
-                'operation_id': 'post_stats_events',
+                'endpoint_path': '/repositories/{repository}/gc/rules',
+                'operation_id': 'internal_set_garbage_collection_rules',
                 'http_method': 'POST',
                 'servers': None,
             },
             params_map={
                 'all': [
-                    'stats_events_list',
+                    'repository',
+                    'garbage_collection_rules',
                 ],
                 'required': [
-                    'stats_events_list',
+                    'repository',
+                    'garbage_collection_rules',
                 ],
                 'nullable': [
                 ],
@@ -624,13 +626,17 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
-                    'stats_events_list':
-                        (StatsEventsList,),
+                    'repository':
+                        (str,),
+                    'garbage_collection_rules':
+                        (GarbageCollectionRules,),
                 },
                 'attribute_map': {
+                    'repository': 'repository',
                 },
                 'location_map': {
-                    'stats_events_list': 'body',
+                    'repository': 'path',
+                    'garbage_collection_rules': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -645,7 +651,7 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
-        self.set_garbage_collection_rules_endpoint = _Endpoint(
+        self.post_stats_events_endpoint = _Endpoint(
             settings={
                 'response_type': None,
                 'auth': [
@@ -655,19 +661,17 @@ def __init__(self, api_client=None):
                     'oidc_auth',
                     'saml_auth'
                 ],
-                'endpoint_path': '/repositories/{repository}/gc/rules',
-                'operation_id': 'set_garbage_collection_rules',
+                'endpoint_path': '/statistics',
+                'operation_id': 'post_stats_events',
                 'http_method': 'POST',
                 'servers': None,
             },
             params_map={
                 'all': [
-                    'repository',
-                    'garbage_collection_rules',
+                    'stats_events_list',
                 ],
                 'required': [
-                    'repository',
-                    'garbage_collection_rules',
+                    'stats_events_list',
                 ],
                 'nullable': [
                 ],
@@ -682,17 +686,13 @@ def __init__(self, api_client=None):
                 'allowed_values': {
                 },
                 'openapi_types': {
-                    'repository':
-                        (str,),
-                    'garbage_collection_rules':
-                        (GarbageCollectionRules,),
+                    'stats_events_list':
+                        (StatsEventsList,),
                 },
                 'attribute_map': {
-                    'repository': 'repository',
                 },
                 'location_map': {
-                    'repository': 'path',
-                    'garbage_collection_rules': 'body',
+                    'stats_events_list': 'body',
                 },
                 'collection_format_map': {
                 }
@@ -930,23 +930,21 @@ def __init__(self, api_client=None):
             api_client=api_client
         )
 
-    def create_branch_protection_rule(
+    def create_branch_protection_rule_preflight(
         self,
         repository,
-        branch_protection_rule,
         **kwargs
     ):
-        """create_branch_protection_rule  # noqa: E501
+        """create_branch_protection_rule_preflight  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.create_branch_protection_rule(repository, branch_protection_rule, async_req=True)
+        >>> thread = api.create_branch_protection_rule_preflight(repository, async_req=True)
         >>> result = thread.get()
 
         Args:
             repository (str):
-            branch_protection_rule (BranchProtectionRule):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -995,27 +993,28 @@ def create_branch_protection_rule(
         kwargs['_host_index'] = kwargs.get('_host_index')
         kwargs['repository'] = \
             repository
-        kwargs['branch_protection_rule'] = \
-            branch_protection_rule
-        return self.create_branch_protection_rule_endpoint.call_with_http_info(**kwargs)
+        return self.create_branch_protection_rule_preflight_endpoint.call_with_http_info(**kwargs)
 
-    def create_branch_protection_rule_preflight(
+    def create_symlink_file(
         self,
         repository,
+        branch,
         **kwargs
     ):
-        """create_branch_protection_rule_preflight  # noqa: E501
+        """creates symlink files corresponding to the given directory  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.create_branch_protection_rule_preflight(repository, async_req=True)
+        >>> thread = api.create_symlink_file(repository, branch, async_req=True)
         >>> result = thread.get()
 
         Args:
             repository (str):
+            branch (str):
 
         Keyword Args:
+            location (str): path to the table data. [optional]
             _return_http_data_only (bool): response data without head status
                 code and headers. Default is True.
             _preload_content (bool): if False, the urllib3.HTTPResponse object
@@ -1037,7 +1036,7 @@ def create_branch_protection_rule_preflight(
             async_req (bool): execute request asynchronously
 
         Returns:
-            None
+            StorageURI
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1062,28 +1061,24 @@ def create_branch_protection_rule_preflight(
         kwargs['_host_index'] = kwargs.get('_host_index')
         kwargs['repository'] = \
             repository
-        return self.create_branch_protection_rule_preflight_endpoint.call_with_http_info(**kwargs)
+        kwargs['branch'] = \
+            branch
+        return self.create_symlink_file_endpoint.call_with_http_info(**kwargs)
 
-    def create_symlink_file(
+    def get_auth_capabilities(
         self,
-        repository,
-        branch,
         **kwargs
     ):
-        """creates symlink files corresponding to the given directory  # noqa: E501
+        """list authentication capabilities supported  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.create_symlink_file(repository, branch, async_req=True)
+        >>> thread = api.get_auth_capabilities(async_req=True)
         >>> result = thread.get()
 
-        Args:
-            repository (str):
-            branch (str):
 
         Keyword Args:
-            location (str): path to the table data. [optional]
             _return_http_data_only (bool): response data without head status
                 code and headers. Default is True.
             _preload_content (bool): if False, the urllib3.HTTPResponse object
@@ -1105,7 +1100,7 @@ def create_symlink_file(
             async_req (bool): execute request asynchronously
 
         Returns:
-            StorageURI
+            AuthCapabilities
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1128,29 +1123,21 @@ def create_symlink_file(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['repository'] = \
-            repository
-        kwargs['branch'] = \
-            branch
-        return self.create_symlink_file_endpoint.call_with_http_info(**kwargs)
+        return self.get_auth_capabilities_endpoint.call_with_http_info(**kwargs)
 
-    def delete_branch_protection_rule(
+    def get_garbage_collection_config(
         self,
-        repository,
-        inline_object1,
         **kwargs
     ):
-        """delete_branch_protection_rule  # noqa: E501
+        """get_garbage_collection_config  # noqa: E501
 
+        get information of gc settings  # noqa: E501
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.delete_branch_protection_rule(repository, inline_object1, async_req=True)
+        >>> thread = api.get_garbage_collection_config(async_req=True)
         >>> result = thread.get()
 
-        Args:
-            repository (str):
-            inline_object1 (InlineObject1):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1174,7 +1161,7 @@ def delete_branch_protection_rule(
             async_req (bool): execute request asynchronously
 
         Returns:
-            None
+            GarbageCollectionConfig
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1197,27 +1184,20 @@ def delete_branch_protection_rule(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['repository'] = \
-            repository
-        kwargs['inline_object1'] = \
-            inline_object1
-        return self.delete_branch_protection_rule_endpoint.call_with_http_info(**kwargs)
+        return self.get_garbage_collection_config_endpoint.call_with_http_info(**kwargs)
 
-    def delete_garbage_collection_rules(
+    def get_setup_state(
         self,
-        repository,
         **kwargs
     ):
-        """delete_garbage_collection_rules  # noqa: E501
+        """check if the lakeFS installation is already set up  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.delete_garbage_collection_rules(repository, async_req=True)
+        >>> thread = api.get_setup_state(async_req=True)
         >>> result = thread.get()
 
-        Args:
-            repository (str):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1241,7 +1221,7 @@ def delete_garbage_collection_rules(
             async_req (bool): execute request asynchronously
 
         Returns:
-            None
+            SetupState
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1264,22 +1244,25 @@ def delete_garbage_collection_rules(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['repository'] = \
-            repository
-        return self.delete_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
+        return self.get_setup_state_endpoint.call_with_http_info(**kwargs)
 
-    def get_auth_capabilities(
+    def internal_create_branch_protection_rule(
         self,
+        repository,
+        branch_protection_rule,
         **kwargs
     ):
-        """list authentication capabilities supported  # noqa: E501
+        """internal_create_branch_protection_rule  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.get_auth_capabilities(async_req=True)
+        >>> thread = api.internal_create_branch_protection_rule(repository, branch_protection_rule, async_req=True)
         >>> result = thread.get()
 
+        Args:
+            repository (str):
+            branch_protection_rule (BranchProtectionRule):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1303,7 +1286,7 @@ def get_auth_capabilities(
             async_req (bool): execute request asynchronously
 
         Returns:
-            AuthCapabilities
+            None
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1326,23 +1309,29 @@ def get_auth_capabilities(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        return self.get_auth_capabilities_endpoint.call_with_http_info(**kwargs)
+        kwargs['repository'] = \
+            repository
+        kwargs['branch_protection_rule'] = \
+            branch_protection_rule
+        return self.internal_create_branch_protection_rule_endpoint.call_with_http_info(**kwargs)
 
-    def get_branch_protection_rules(
+    def internal_delete_branch_protection_rule(
         self,
         repository,
+        inline_object1,
         **kwargs
     ):
-        """get branch protection rules  # noqa: E501
+        """internal_delete_branch_protection_rule  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.get_branch_protection_rules(repository, async_req=True)
+        >>> thread = api.internal_delete_branch_protection_rule(repository, inline_object1, async_req=True)
         >>> result = thread.get()
 
         Args:
             repository (str):
+            inline_object1 (InlineObject1):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1366,7 +1355,7 @@ def get_branch_protection_rules(
             async_req (bool): execute request asynchronously
 
         Returns:
-            [BranchProtectionRule]
+            None
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1391,21 +1380,25 @@ def get_branch_protection_rules(
         kwargs['_host_index'] = kwargs.get('_host_index')
         kwargs['repository'] = \
             repository
-        return self.get_branch_protection_rules_endpoint.call_with_http_info(**kwargs)
+        kwargs['inline_object1'] = \
+            inline_object1
+        return self.internal_delete_branch_protection_rule_endpoint.call_with_http_info(**kwargs)
 
-    def get_garbage_collection_config(
+    def internal_delete_garbage_collection_rules(
         self,
+        repository,
         **kwargs
     ):
-        """get_garbage_collection_config  # noqa: E501
+        """internal_delete_garbage_collection_rules  # noqa: E501
 
-        get information of gc settings  # noqa: E501
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.get_garbage_collection_config(async_req=True)
+        >>> thread = api.internal_delete_garbage_collection_rules(repository, async_req=True)
         >>> result = thread.get()
 
+        Args:
+            repository (str):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1429,7 +1422,7 @@ def get_garbage_collection_config(
             async_req (bool): execute request asynchronously
 
         Returns:
-            GarbageCollectionConfig
+            None
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1452,19 +1445,21 @@ def get_garbage_collection_config(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        return self.get_garbage_collection_config_endpoint.call_with_http_info(**kwargs)
+        kwargs['repository'] = \
+            repository
+        return self.internal_delete_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
 
-    def get_garbage_collection_rules(
+    def internal_get_branch_protection_rules(
         self,
         repository,
         **kwargs
     ):
-        """get_garbage_collection_rules  # noqa: E501
+        """get branch protection rules  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.get_garbage_collection_rules(repository, async_req=True)
+        >>> thread = api.internal_get_branch_protection_rules(repository, async_req=True)
         >>> result = thread.get()
 
         Args:
@@ -1492,7 +1487,7 @@ def get_garbage_collection_rules(
             async_req (bool): execute request asynchronously
 
         Returns:
-            GarbageCollectionRules
+            [BranchProtectionRule]
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1517,20 +1512,23 @@ def get_garbage_collection_rules(
         kwargs['_host_index'] = kwargs.get('_host_index')
         kwargs['repository'] = \
             repository
-        return self.get_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
+        return self.internal_get_branch_protection_rules_endpoint.call_with_http_info(**kwargs)
 
-    def get_setup_state(
+    def internal_get_garbage_collection_rules(
         self,
+        repository,
         **kwargs
     ):
-        """check if the lakeFS installation is already set up  # noqa: E501
+        """internal_get_garbage_collection_rules  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.get_setup_state(async_req=True)
+        >>> thread = api.internal_get_garbage_collection_rules(repository, async_req=True)
         >>> result = thread.get()
 
+        Args:
+            repository (str):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1554,7 +1552,7 @@ def get_setup_state(
             async_req (bool): execute request asynchronously
 
         Returns:
-            SetupState
+            GarbageCollectionRules
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -1577,23 +1575,27 @@ def get_setup_state(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        return self.get_setup_state_endpoint.call_with_http_info(**kwargs)
+        kwargs['repository'] = \
+            repository
+        return self.internal_get_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
 
-    def post_stats_events(
+    def internal_set_garbage_collection_rules(
         self,
-        stats_events_list,
+        repository,
+        garbage_collection_rules,
         **kwargs
     ):
-        """post stats events, this endpoint is meant for internal use only  # noqa: E501
+        """internal_set_garbage_collection_rules  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.post_stats_events(stats_events_list, async_req=True)
+        >>> thread = api.internal_set_garbage_collection_rules(repository, garbage_collection_rules, async_req=True)
         >>> result = thread.get()
 
         Args:
-            stats_events_list (StatsEventsList):
+            repository (str):
+            garbage_collection_rules (GarbageCollectionRules):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1640,27 +1642,27 @@ def post_stats_events(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['stats_events_list'] = \
-            stats_events_list
-        return self.post_stats_events_endpoint.call_with_http_info(**kwargs)
+        kwargs['repository'] = \
+            repository
+        kwargs['garbage_collection_rules'] = \
+            garbage_collection_rules
+        return self.internal_set_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
 
-    def set_garbage_collection_rules(
+    def post_stats_events(
         self,
-        repository,
-        garbage_collection_rules,
+        stats_events_list,
         **kwargs
     ):
-        """set_garbage_collection_rules  # noqa: E501
+        """post stats events, this endpoint is meant for internal use only  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.set_garbage_collection_rules(repository, garbage_collection_rules, async_req=True)
+        >>> thread = api.post_stats_events(stats_events_list, async_req=True)
         >>> result = thread.get()
 
         Args:
-            repository (str):
-            garbage_collection_rules (GarbageCollectionRules):
+            stats_events_list (StatsEventsList):
 
         Keyword Args:
             _return_http_data_only (bool): response data without head status
@@ -1707,11 +1709,9 @@ def set_garbage_collection_rules(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['repository'] = \
-            repository
-        kwargs['garbage_collection_rules'] = \
-            garbage_collection_rules
-        return self.set_garbage_collection_rules_endpoint.call_with_http_info(**kwargs)
+        kwargs['stats_events_list'] = \
+            stats_events_list
+        return self.post_stats_events_endpoint.call_with_http_info(**kwargs)
 
     def set_garbage_collection_rules_preflight(
         self,
diff --git a/clients/python/lakefs_client/api/repositories_api.py b/clients/python/lakefs_client/api/repositories_api.py
index 1973690325b..d63cc8e3b83 100644
--- a/clients/python/lakefs_client/api/repositories_api.py
+++ b/clients/python/lakefs_client/api/repositories_api.py
@@ -22,7 +22,9 @@
     none_type,
     validate_and_convert_types
 )
+from lakefs_client.model.branch_protection_rule import BranchProtectionRule
 from lakefs_client.model.error import Error
+from lakefs_client.model.garbage_collection_rules import GarbageCollectionRules
 from lakefs_client.model.repository import Repository
 from lakefs_client.model.repository_creation import RepositoryCreation
 from lakefs_client.model.repository_list import RepositoryList
@@ -101,6 +103,61 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
+        self.delete_gc_rules_endpoint = _Endpoint(
+            settings={
+                'response_type': None,
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/settings/gc_rules',
+                'operation_id': 'delete_gc_rules',
+                'http_method': 'DELETE',
+                'servers': None,
+            },
+            params_map={
+                'all': [
+                    'repository',
+                ],
+                'required': [
+                    'repository',
+                ],
+                'nullable': [
+                ],
+                'enum': [
+                ],
+                'validation': [
+                ]
+            },
+            root_map={
+                'validations': {
+                },
+                'allowed_values': {
+                },
+                'openapi_types': {
+                    'repository':
+                        (str,),
+                },
+                'attribute_map': {
+                    'repository': 'repository',
+                },
+                'location_map': {
+                    'repository': 'path',
+                },
+                'collection_format_map': {
+                }
+            },
+            headers_map={
+                'accept': [
+                    'application/json'
+                ],
+                'content_type': [],
+            },
+            api_client=api_client
+        )
         self.delete_repository_endpoint = _Endpoint(
             settings={
                 'response_type': None,
@@ -156,6 +213,116 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
+        self.get_branch_protection_rules_endpoint = _Endpoint(
+            settings={
+                'response_type': ([BranchProtectionRule],),
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/settings/branch_protection',
+                'operation_id': 'get_branch_protection_rules',
+                'http_method': 'GET',
+                'servers': None,
+            },
+            params_map={
+                'all': [
+                    'repository',
+                ],
+                'required': [
+                    'repository',
+                ],
+                'nullable': [
+                ],
+                'enum': [
+                ],
+                'validation': [
+                ]
+            },
+            root_map={
+                'validations': {
+                },
+                'allowed_values': {
+                },
+                'openapi_types': {
+                    'repository':
+                        (str,),
+                },
+                'attribute_map': {
+                    'repository': 'repository',
+                },
+                'location_map': {
+                    'repository': 'path',
+                },
+                'collection_format_map': {
+                }
+            },
+            headers_map={
+                'accept': [
+                    'application/json'
+                ],
+                'content_type': [],
+            },
+            api_client=api_client
+        )
+        self.get_gc_rules_endpoint = _Endpoint(
+            settings={
+                'response_type': (GarbageCollectionRules,),
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/settings/gc_rules',
+                'operation_id': 'get_gc_rules',
+                'http_method': 'GET',
+                'servers': None,
+            },
+            params_map={
+                'all': [
+                    'repository',
+                ],
+                'required': [
+                    'repository',
+                ],
+                'nullable': [
+                ],
+                'enum': [
+                ],
+                'validation': [
+                ]
+            },
+            root_map={
+                'validations': {
+                },
+                'allowed_values': {
+                },
+                'openapi_types': {
+                    'repository':
+                        (str,),
+                },
+                'attribute_map': {
+                    'repository': 'repository',
+                },
+                'location_map': {
+                    'repository': 'path',
+                },
+                'collection_format_map': {
+                }
+            },
+            headers_map={
+                'accept': [
+                    'application/json'
+                ],
+                'content_type': [],
+            },
+            api_client=api_client
+        )
         self.get_repository_endpoint = _Endpoint(
             settings={
                 'response_type': (Repository,),
@@ -335,25 +502,219 @@ def __init__(self, api_client=None):
             },
             api_client=api_client
         )
+        self.set_branch_protection_rules_endpoint = _Endpoint(
+            settings={
+                'response_type': None,
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/settings/branch_protection',
+                'operation_id': 'set_branch_protection_rules',
+                'http_method': 'PUT',
+                'servers': None,
+            },
+            params_map={
+                'all': [
+                    'repository',
+                    'branch_protection_rule',
+                    'if_match',
+                ],
+                'required': [
+                    'repository',
+                    'branch_protection_rule',
+                ],
+                'nullable': [
+                ],
+                'enum': [
+                ],
+                'validation': [
+                ]
+            },
+            root_map={
+                'validations': {
+                },
+                'allowed_values': {
+                },
+                'openapi_types': {
+                    'repository':
+                        (str,),
+                    'branch_protection_rule':
+                        ([BranchProtectionRule],),
+                    'if_match':
+                        (str,),
+                },
+                'attribute_map': {
+                    'repository': 'repository',
+                    'if_match': 'If-Match',
+                },
+                'location_map': {
+                    'repository': 'path',
+                    'branch_protection_rule': 'body',
+                    'if_match': 'header',
+                },
+                'collection_format_map': {
+                }
+            },
+            headers_map={
+                'accept': [
+                    'application/json'
+                ],
+                'content_type': [
+                    'application/json'
+                ]
+            },
+            api_client=api_client
+        )
+        self.set_gc_rules_endpoint = _Endpoint(
+            settings={
+                'response_type': None,
+                'auth': [
+                    'basic_auth',
+                    'cookie_auth',
+                    'jwt_token',
+                    'oidc_auth',
+                    'saml_auth'
+                ],
+                'endpoint_path': '/repositories/{repository}/settings/gc_rules',
+                'operation_id': 'set_gc_rules',
+                'http_method': 'PUT',
+                'servers': None,
+            },
+            params_map={
+                'all': [
+                    'repository',
+                    'garbage_collection_rules',
+                ],
+                'required': [
+                    'repository',
+                    'garbage_collection_rules',
+                ],
+                'nullable': [
+                ],
+                'enum': [
+                ],
+                'validation': [
+                ]
+            },
+            root_map={
+                'validations': {
+                },
+                'allowed_values': {
+                },
+                'openapi_types': {
+                    'repository':
+                        (str,),
+                    'garbage_collection_rules':
+                        (GarbageCollectionRules,),
+                },
+                'attribute_map': {
+                    'repository': 'repository',
+                },
+                'location_map': {
+                    'repository': 'path',
+                    'garbage_collection_rules': 'body',
+                },
+                'collection_format_map': {
+                }
+            },
+            headers_map={
+                'accept': [
+                    'application/json'
+                ],
+                'content_type': [
+                    'application/json'
+                ]
+            },
+            api_client=api_client
+        )
 
     def create_repository(
         self,
-        repository_creation,
+        repository_creation,
+        **kwargs
+    ):
+        """create repository  # noqa: E501
+
+        This method makes a synchronous HTTP request by default. To make an
+        asynchronous HTTP request, please pass async_req=True
+
+        >>> thread = api.create_repository(repository_creation, async_req=True)
+        >>> result = thread.get()
+
+        Args:
+            repository_creation (RepositoryCreation):
+
+        Keyword Args:
+            bare (bool): If true, create a bare repository with no initial commit and branch. [optional] if omitted the server will use the default value of False
+            _return_http_data_only (bool): response data without head status
+                code and headers. Default is True.
+            _preload_content (bool): if False, the urllib3.HTTPResponse object
+                will be returned without reading/decoding response data.
+                Default is True.
+            _request_timeout (int/float/tuple): timeout setting for this request. If
+                one number provided, it will be total request timeout. It can also
+                be a pair (tuple) of (connection, read) timeouts.
+                Default is None.
+            _check_input_type (bool): specifies if type checking
+                should be done one the data sent to the server.
+                Default is True.
+            _check_return_type (bool): specifies if type checking
+                should be done one the data received from the server.
+                Default is True.
+            _host_index (int/None): specifies the index of the server
+                that we want to use.
+                Default is read from the configuration.
+            async_req (bool): execute request asynchronously
+
+        Returns:
+            Repository
+                If the method is called asynchronously, returns the request
+                thread.
+        """
+        kwargs['async_req'] = kwargs.get(
+            'async_req', False
+        )
+        kwargs['_return_http_data_only'] = kwargs.get(
+            '_return_http_data_only', True
+        )
+        kwargs['_preload_content'] = kwargs.get(
+            '_preload_content', True
+        )
+        kwargs['_request_timeout'] = kwargs.get(
+            '_request_timeout', None
+        )
+        kwargs['_check_input_type'] = kwargs.get(
+            '_check_input_type', True
+        )
+        kwargs['_check_return_type'] = kwargs.get(
+            '_check_return_type', True
+        )
+        kwargs['_host_index'] = kwargs.get('_host_index')
+        kwargs['repository_creation'] = \
+            repository_creation
+        return self.create_repository_endpoint.call_with_http_info(**kwargs)
+
+    def delete_gc_rules(
+        self,
+        repository,
         **kwargs
     ):
-        """create repository  # noqa: E501
+        """delete_gc_rules  # noqa: E501
 
         This method makes a synchronous HTTP request by default. To make an
         asynchronous HTTP request, please pass async_req=True
 
-        >>> thread = api.create_repository(repository_creation, async_req=True)
+        >>> thread = api.delete_gc_rules(repository, async_req=True)
         >>> result = thread.get()
 
         Args:
-            repository_creation (RepositoryCreation):
+            repository (str):
 
         Keyword Args:
-            bare (bool): If true, create a bare repository with no initial commit and branch. [optional] if omitted the server will use the default value of False
             _return_http_data_only (bool): response data without head status
                 code and headers. Default is True.
             _preload_content (bool): if False, the urllib3.HTTPResponse object
@@ -375,7 +736,7 @@ def create_repository(
             async_req (bool): execute request asynchronously
 
         Returns:
-            Repository
+            None
                 If the method is called asynchronously, returns the request
                 thread.
         """
@@ -398,9 +759,9 @@ def create_repository(
             '_check_return_type', True
         )
         kwargs['_host_index'] = kwargs.get('_host_index')
-        kwargs['repository_creation'] = \
-            repository_creation
-        return self.create_repository_endpoint.call_with_http_info(**kwargs)
+        kwargs['repository'] = \
+            repository
+        return self.delete_gc_rules_endpoint.call_with_http_info(**kwargs)
 
     def delete_repository(
         self,
@@ -467,6 +828,136 @@ def delete_repository(
             repository
         return self.delete_repository_endpoint.call_with_http_info(**kwargs)
 
+    def get_branch_protection_rules(
+        self,
+        repository,
+        **kwargs
+    ):
+        """get branch protection rules  # noqa: E501
+
+        This method makes a synchronous HTTP request by default. To make an
+        asynchronous HTTP request, please pass async_req=True
+
+        >>> thread = api.get_branch_protection_rules(repository, async_req=True)
+        >>> result = thread.get()
+
+        Args:
+            repository (str):
+
+        Keyword Args:
+            _return_http_data_only (bool): response data without head status
+                code and headers. Default is True.
+            _preload_content (bool): if False, the urllib3.HTTPResponse object
+                will be returned without reading/decoding response data.
+                Default is True.
+            _request_timeout (int/float/tuple): timeout setting for this request. If
+                one number provided, it will be total request timeout. It can also
+                be a pair (tuple) of (connection, read) timeouts.
+                Default is None.
+            _check_input_type (bool): specifies if type checking
+                should be done one the data sent to the server.
+                Default is True.
+            _check_return_type (bool): specifies if type checking
+                should be done one the data received from the server.
+                Default is True.
+            _host_index (int/None): specifies the index of the server
+                that we want to use.
+                Default is read from the configuration.
+            async_req (bool): execute request asynchronously
+
+        Returns:
+            [BranchProtectionRule]
+                If the method is called asynchronously, returns the request
+                thread.
+        """
+        kwargs['async_req'] = kwargs.get(
+            'async_req', False
+        )
+        kwargs['_return_http_data_only'] = kwargs.get(
+            '_return_http_data_only', True
+        )
+        kwargs['_preload_content'] = kwargs.get(
+            '_preload_content', True
+        )
+        kwargs['_request_timeout'] = kwargs.get(
+            '_request_timeout', None
+        )
+        kwargs['_check_input_type'] = kwargs.get(
+            '_check_input_type', True
+        )
+        kwargs['_check_return_type'] = kwargs.get(
+            '_check_return_type', True
+        )
+        kwargs['_host_index'] = kwargs.get('_host_index')
+        kwargs['repository'] = \
+            repository
+        return self.get_branch_protection_rules_endpoint.call_with_http_info(**kwargs)
+
+    def get_gc_rules(
+        self,
+        repository,
+        **kwargs
+    ):
+        """get repository GC rules  # noqa: E501
+
+        This method makes a synchronous HTTP request by default. To make an
+        asynchronous HTTP request, please pass async_req=True
+
+        >>> thread = api.get_gc_rules(repository, async_req=True)
+        >>> result = thread.get()
+
+        Args:
+            repository (str):
+
+        Keyword Args:
+            _return_http_data_only (bool): response data without head status
+                code and headers. Default is True.
+            _preload_content (bool): if False, the urllib3.HTTPResponse object
+                will be returned without reading/decoding response data.
+                Default is True.
+            _request_timeout (int/float/tuple): timeout setting for this request. If
+                one number provided, it will be total request timeout. It can also
+                be a pair (tuple) of (connection, read) timeouts.
+                Default is None.
+            _check_input_type (bool): specifies if type checking
+                should be done one the data sent to the server.
+                Default is True.
+            _check_return_type (bool): specifies if type checking
+                should be done one the data received from the server.
+                Default is True.
+            _host_index (int/None): specifies the index of the server
+                that we want to use.
+                Default is read from the configuration.
+            async_req (bool): execute request asynchronously
+
+        Returns:
+            GarbageCollectionRules
+                If the method is called asynchronously, returns the request
+                thread.
+        """
+        kwargs['async_req'] = kwargs.get(
+            'async_req', False
+        )
+        kwargs['_return_http_data_only'] = kwargs.get(
+            '_return_http_data_only', True
+        )
+        kwargs['_preload_content'] = kwargs.get(
+            '_preload_content', True
+        )
+        kwargs['_request_timeout'] = kwargs.get(
+            '_request_timeout', None
+        )
+        kwargs['_check_input_type'] = kwargs.get(
+            '_check_input_type', True
+        )
+        kwargs['_check_return_type'] = kwargs.get(
+            '_check_return_type', True
+        )
+        kwargs['_host_index'] = kwargs.get('_host_index')
+        kwargs['repository'] = \
+            repository
+        return self.get_gc_rules_endpoint.call_with_http_info(**kwargs)
+
     def get_repository(
         self,
         repository,
@@ -660,3 +1151,142 @@ def list_repositories(
         kwargs['_host_index'] = kwargs.get('_host_index')
         return self.list_repositories_endpoint.call_with_http_info(**kwargs)
 
+    def set_branch_protection_rules(
+        self,
+        repository,
+        branch_protection_rule,
+        **kwargs
+    ):
+        """set_branch_protection_rules  # noqa: E501
+
+        This method makes a synchronous HTTP request by default. To make an
+        asynchronous HTTP request, please pass async_req=True
+
+        >>> thread = api.set_branch_protection_rules(repository, branch_protection_rule, async_req=True)
+        >>> result = thread.get()
+
+        Args:
+            repository (str):
+            branch_protection_rule ([BranchProtectionRule]):
+
+        Keyword Args:
+            if_match (str): if provided, the branch protection rules will be updated only if the current ETag match the provided value. [optional]
+            _return_http_data_only (bool): response data without head status
+                code and headers. Default is True.
+            _preload_content (bool): if False, the urllib3.HTTPResponse object
+                will be returned without reading/decoding response data.
+                Default is True.
+            _request_timeout (int/float/tuple): timeout setting for this request. If
+                one number provided, it will be total request timeout. It can also
+                be a pair (tuple) of (connection, read) timeouts.
+                Default is None.
+            _check_input_type (bool): specifies if type checking
+                should be done one the data sent to the server.
+                Default is True.
+            _check_return_type (bool): specifies if type checking
+                should be done one the data received from the server.
+                Default is True.
+            _host_index (int/None): specifies the index of the server
+                that we want to use.
+                Default is read from the configuration.
+            async_req (bool): execute request asynchronously
+
+        Returns:
+            None
+                If the method is called asynchronously, returns the request
+                thread.
+        """
+        kwargs['async_req'] = kwargs.get(
+            'async_req', False
+        )
+        kwargs['_return_http_data_only'] = kwargs.get(
+            '_return_http_data_only', True
+        )
+        kwargs['_preload_content'] = kwargs.get(
+            '_preload_content', True
+        )
+        kwargs['_request_timeout'] = kwargs.get(
+            '_request_timeout', None
+        )
+        kwargs['_check_input_type'] = kwargs.get(
+            '_check_input_type', True
+        )
+        kwargs['_check_return_type'] = kwargs.get(
+            '_check_return_type', True
+        )
+        kwargs['_host_index'] = kwargs.get('_host_index')
+        kwargs['repository'] = \
+            repository
+        kwargs['branch_protection_rule'] = \
+            branch_protection_rule
+        return self.set_branch_protection_rules_endpoint.call_with_http_info(**kwargs)
+
+    def set_gc_rules(
+        self,
+        repository,
+        garbage_collection_rules,
+        **kwargs
+    ):
+        """set_gc_rules  # noqa: E501
+
+        This method makes a synchronous HTTP request by default. To make an
+        asynchronous HTTP request, please pass async_req=True
+
+        >>> thread = api.set_gc_rules(repository, garbage_collection_rules, async_req=True)
+        >>> result = thread.get()
+
+        Args:
+            repository (str):
+            garbage_collection_rules (GarbageCollectionRules):
+
+        Keyword Args:
+            _return_http_data_only (bool): response data without head status
+                code and headers. Default is True.
+            _preload_content (bool): if False, the urllib3.HTTPResponse object
+                will be returned without reading/decoding response data.
+                Default is True.
+            _request_timeout (int/float/tuple): timeout setting for this request. If
+                one number provided, it will be total request timeout. It can also
+                be a pair (tuple) of (connection, read) timeouts.
+                Default is None.
+            _check_input_type (bool): specifies if type checking
+                should be done one the data sent to the server.
+                Default is True.
+            _check_return_type (bool): specifies if type checking
+                should be done one the data received from the server.
+                Default is True.
+            _host_index (int/None): specifies the index of the server
+                that we want to use.
+                Default is read from the configuration.
+            async_req (bool): execute request asynchronously
+
+        Returns:
+            None
+                If the method is called asynchronously, returns the request
+                thread.
+        """
+        kwargs['async_req'] = kwargs.get(
+            'async_req', False
+        )
+        kwargs['_return_http_data_only'] = kwargs.get(
+            '_return_http_data_only', True
+        )
+        kwargs['_preload_content'] = kwargs.get(
+            '_preload_content', True
+        )
+        kwargs['_request_timeout'] = kwargs.get(
+            '_request_timeout', None
+        )
+        kwargs['_check_input_type'] = kwargs.get(
+            '_check_input_type', True
+        )
+        kwargs['_check_return_type'] = kwargs.get(
+            '_check_return_type', True
+        )
+        kwargs['_host_index'] = kwargs.get('_host_index')
+        kwargs['repository'] = \
+            repository
+        kwargs['garbage_collection_rules'] = \
+            garbage_collection_rules
+        return self.set_gc_rules_endpoint.call_with_http_info(**kwargs)
+
diff --git a/clients/python/test/test_internal_api.py b/clients/python/test/test_internal_api.py
index cf5ae78cca6..6b293896031 100644
--- a/clients/python/test/test_internal_api.py
+++ b/clients/python/test/test_internal_api.py
@@ -24,12 +24,6 @@ def setUp(self):
     def tearDown(self):
         pass
 
-    def test_create_branch_protection_rule(self):
-        """Test case for create_branch_protection_rule
-
-        """
-        pass
-
     def test_create_branch_protection_rule_preflight(self):
         """Test case for create_branch_protection_rule_preflight
 
@@ -43,61 +37,67 @@ def test_create_symlink_file(self):
         """
         pass
 
-    def test_delete_branch_protection_rule(self):
-        """Test case for delete_branch_protection_rule
+    def test_get_auth_capabilities(self):
+        """Test case for get_auth_capabilities
 
+        list authentication capabilities supported  # noqa: E501
         """
         pass
 
-    def test_delete_garbage_collection_rules(self):
-        """Test case for delete_garbage_collection_rules
+    def test_get_garbage_collection_config(self):
+        """Test case for get_garbage_collection_config
 
         """
         pass
 
-    def test_get_auth_capabilities(self):
-        """Test case for get_auth_capabilities
+    def test_get_setup_state(self):
+        """Test case for get_setup_state
 
-        list authentication capabilities supported  # noqa: E501
+        check if the lakeFS installation is already set up  # noqa: E501
         """
         pass
 
-    def test_get_branch_protection_rules(self):
-        """Test case for get_branch_protection_rules
+    def test_internal_create_branch_protection_rule(self):
+        """Test case for internal_create_branch_protection_rule
 
-        get branch protection rules  # noqa: E501
         """
         pass
 
-    def test_get_garbage_collection_config(self):
-        """Test case for get_garbage_collection_config
+    def test_internal_delete_branch_protection_rule(self):
+        """Test case for internal_delete_branch_protection_rule
 
         """
         pass
 
-    def test_get_garbage_collection_rules(self):
-        """Test case for get_garbage_collection_rules
+    def test_internal_delete_garbage_collection_rules(self):
+        """Test case for internal_delete_garbage_collection_rules
 
         """
         pass
 
-    def test_get_setup_state(self):
-        """Test case for get_setup_state
+    def test_internal_get_branch_protection_rules(self):
+        """Test case for internal_get_branch_protection_rules
 
-        check if the lakeFS installation is already set up  # noqa: E501
+        get branch protection rules  # noqa: E501
         """
         pass
 
-    def test_post_stats_events(self):
-        """Test case for post_stats_events
+    def test_internal_get_garbage_collection_rules(self):
+        """Test case for internal_get_garbage_collection_rules
+
+        """
+        pass
+
+    def test_internal_set_garbage_collection_rules(self):
+        """Test case for internal_set_garbage_collection_rules
 
-        post stats events, this endpoint is meant for internal use only  # noqa: E501
         """
         pass
 
-    def test_set_garbage_collection_rules(self):
-        """Test case for set_garbage_collection_rules
+    def test_post_stats_events(self):
+        """Test case for post_stats_events
 
+        post stats events, this endpoint is meant for internal use only  # noqa: E501
         """
         pass
 
diff --git a/clients/python/test/test_repositories_api.py b/clients/python/test/test_repositories_api.py
index 67b03398c7e..aa67244d876 100644
--- a/clients/python/test/test_repositories_api.py
+++ b/clients/python/test/test_repositories_api.py
@@ -31,6 +31,12 @@ def test_create_repository(self):
         """
         pass
 
+    def test_delete_gc_rules(self):
+        """Test case for delete_gc_rules
+
+        """
+        pass
+
     def test_delete_repository(self):
         """Test case for delete_repository
 
@@ -38,6 +44,20 @@ def test_delete_repository(self):
         """
         pass
 
+    def test_get_branch_protection_rules(self):
+        """Test case for get_branch_protection_rules
+
+        get branch protection rules  # noqa: E501
+        """
+        pass
+
+    def test_get_gc_rules(self):
+        """Test case for get_gc_rules
+
+        get repository GC rules  # noqa: E501
+        """
+        pass
+
     def test_get_repository(self):
         """Test case for get_repository
 
@@ -59,6 +79,18 @@ def test_list_repositories(self):
         """
         pass
 
+    def test_set_branch_protection_rules(self):
+        """Test case for set_branch_protection_rules
+
+        """
+        pass
+
+    def test_set_gc_rules(self):
+        """Test case for set_gc_rules
+
+        """
+        pass
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/cmd/lakectl/cmd/branch_protect.go b/cmd/lakectl/cmd/branch_protect.go
index 512e17393a2..87a2860fffd 100644
--- a/cmd/lakectl/cmd/branch_protect.go
+++ b/cmd/lakectl/cmd/branch_protect.go
@@ -1,9 +1,9 @@
 package cmd
 
 import (
-	"fmt"
 	"net/http"
 
+	"github.com/go-openapi/swag"
 	"github.com/spf13/cobra"
 	"github.com/treeverse/lakefs/pkg/api/apigen"
 )
@@ -54,11 +54,17 @@ var branchProtectAddCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		client := getClient()
 		u := MustParseRepoURI("repository", args[0])
-		resp, err := client.CreateBranchProtectionRuleWithResponse(cmd.Context(), u.Repository, apigen.CreateBranchProtectionRuleJSONRequestBody{
+		resp, err := client.GetBranchProtectionRulesWithResponse(cmd.Context(), u.Repository)
+
+		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusOK)
+		rules := *resp.JSON200
+		rules = append(rules, apigen.BranchProtectionRule{
 			Pattern: args[1],
 		})
-		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusNoContent)
-		fmt.Printf("Branch protection rule added to '%s' repository.\n", u.Repository)
+		setResp, err := client.SetBranchProtectionRulesWithResponse(cmd.Context(), u.Repository, &apigen.SetBranchProtectionRulesParams{
+			IfMatch: swag.String(resp.HTTPResponse.Header.Get("ETag")),
+		}, rules)
+		DieOnErrorOrUnexpectedStatusCode(setResp, err, http.StatusNoContent)
 	},
 }
 
@@ -72,11 +78,22 @@ var branchProtectDeleteCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		client := getClient()
 		u := MustParseRepoURI("repository", args[0])
-		resp, err := client.DeleteBranchProtectionRuleWithResponse(cmd.Context(), u.Repository, apigen.DeleteBranchProtectionRuleJSONRequestBody{
-			Pattern: args[1],
-		})
-		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusNoContent)
-		fmt.Printf("Branch protection rule deleted from '%s' repository.\n", u.Repository)
+		resp, err := client.GetBranchProtectionRulesWithResponse(cmd.Context(), u.Repository)
+		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusOK)
+		rules := *resp.JSON200
+		for i, rule := range *resp.JSON200 {
+			if rule.Pattern == args[1] {
+				rules = append(rules[:i], rules[i+1:]...)
+				break
+			}
+		}
+		if len(rules) == len(*resp.JSON200) {
+			Die("Branch protection rule not found", 1)
+		}
+		setResp, err := client.SetBranchProtectionRulesWithResponse(cmd.Context(), u.Repository, &apigen.SetBranchProtectionRulesParams{
+			IfMatch: swag.String(resp.HTTPResponse.Header.Get("ETag")),
+		}, rules)
+		DieOnErrorOrUnexpectedStatusCode(setResp, err, http.StatusNoContent)
 	},
 }
 
diff --git a/cmd/lakectl/cmd/gc_delete_config.go b/cmd/lakectl/cmd/gc_delete_config.go
index a260d4f4147..9747afaeac5 100644
--- a/cmd/lakectl/cmd/gc_delete_config.go
+++ b/cmd/lakectl/cmd/gc_delete_config.go
@@ -17,7 +17,7 @@ var gcDeleteConfigCmd = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		u := MustParseRepoURI("repository", args[0])
 		client := getClient()
-		resp, err := client.DeleteGarbageCollectionRulesWithResponse(cmd.Context(), u.Repository)
+		resp, err := client.DeleteGCRulesWithResponse(cmd.Context(), u.Repository)
 		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusNoContent)
 	},
 }
diff --git a/cmd/lakectl/cmd/gc_get_config.go b/cmd/lakectl/cmd/gc_get_config.go
index 283decb9f67..0c42b871e74 100644
--- a/cmd/lakectl/cmd/gc_get_config.go
+++ b/cmd/lakectl/cmd/gc_get_config.go
@@ -24,7 +24,7 @@ var gcGetConfigCmd = &cobra.Command{
 		u := MustParseRepoURI("repository", args[0])
 		isJSON := Must(cmd.Flags().GetBool(jsonFlagName))
 		client := getClient()
-		resp, err := client.GetGarbageCollectionRulesWithResponse(cmd.Context(), u.Repository)
+		resp, err := client.GetGCRulesWithResponse(cmd.Context(), u.Repository)
 		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusOK)
 		if resp.JSON200 == nil {
 			Die("Bad response from server", 1)
diff --git a/cmd/lakectl/cmd/gc_set_config.go b/cmd/lakectl/cmd/gc_set_config.go
index 9323123a6c1..515c155bdb6 100644
--- a/cmd/lakectl/cmd/gc_set_config.go
+++ b/cmd/lakectl/cmd/gc_set_config.go
@@ -51,13 +51,13 @@ Example configuration file:
 				_ = reader.Close()
 			}()
 		}
-		var body apigen.SetGarbageCollectionRulesJSONRequestBody
+		var body apigen.SetGCRulesJSONRequestBody
 		err = json.NewDecoder(reader).Decode(&body)
 		if err != nil {
 			DieErr(err)
 		}
 		client := getClient()
-		resp, err := client.SetGarbageCollectionRulesWithResponse(cmd.Context(), u.Repository, body)
+		resp, err := client.SetGCRules(cmd.Context(), u.Repository, body)
 		DieOnErrorOrUnexpectedStatusCode(resp, err, http.StatusNoContent)
 	},
 }
diff --git a/docs/assets/js/swagger.yml b/docs/assets/js/swagger.yml
index fbe956545ca..17799a4f4cf 100644
--- a/docs/assets/js/swagger.yml
+++ b/docs/assets/js/swagger.yml
@@ -2323,6 +2323,130 @@ paths:
         default:
           $ref: "#/components/responses/ServerError"
 
+  /repositories/{repository}/settings/gc_rules:
+    parameters:
+      - in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+    get:
+      tags:
+        - repositories
+      operationId: getGCRules
+      summary: get repository GC rules
+      responses:
+        200:
+          description: repository GC rules
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GarbageCollectionRules"
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+    put:
+      tags:
+        - repositories
+      operationId: setGCRules
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/GarbageCollectionRules"
+      responses:
+        204:
+          description: set garbage collection rules successfully
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+    delete:
+      tags:
+        - repositories
+      operationId: deleteGCRules
+      responses:
+        204:
+          description: deleted garbage collection rules successfully
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+
+  /repositories/{repository}/settings/branch_protection:
+    parameters:
+      - in: path
+        name: repository
+        required: true
+        schema:
+          type: string
+    get:
+      tags:
+        - repositories
+      operationId: getBranchProtectionRules
+      summary: get branch protection rules
+      responses:
+        200:
+          description: branch protection rules
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/BranchProtectionRule"
+          headers:
+            ETag:
+              schema:
+                type: string
+                description: ETag of the branch protection rules
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/ServerError"
+
+    put:
+      parameters:
+        - in: header
+          name: If-Match
+          schema:
+            type: string
+          description: if provided, the branch protection rules will be updated only if the current ETag match the provided value
+          allowEmptyValue: true
+      tags:
+        - repositories
+      operationId: setBranchProtectionRules
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: array
+              items:
+                $ref: "#/components/schemas/BranchProtectionRule"
+      responses:
+        204:
+          description: branch protection rule created successfully
+        400:
+          $ref: "#/components/responses/BadRequest"
+        401:
+          $ref: "#/components/responses/Unauthorized"
+        404:
+          $ref: "#/components/responses/NotFound"
+        412:
+          $ref: "#/components/responses/PreconditionFailed"
+        default:
+          $ref: "#/components/responses/ServerError"
+
   /otf/diffs:
     get:
       tags:
@@ -4060,7 +4184,7 @@ paths:
     get:
       tags:
         - internal
-      operationId: getGarbageCollectionRules
+      operationId: internalGetGarbageCollectionRules
       responses:
         200:
           description: gc rule list
@@ -4078,7 +4202,7 @@ paths:
     post:
       tags:
         - internal
-      operationId: set garbage collection rules
+      operationId: internalSetGarbageCollectionRules
       requestBody:
         required: true
         content:
@@ -4097,7 +4221,7 @@ paths:
     delete:
       tags:
         - internal
-      operationId: delete garbage collection rules
+      operationId: internalDeleteGarbageCollectionRules
       responses:
         204:
           description: deleted garbage collection rules successfully
@@ -4200,7 +4324,7 @@ paths:
     get:
       tags:
         - internal
-      operationId: getBranchProtectionRules
+      operationId: internalGetBranchProtectionRules
       summary: get branch protection rules
       responses:
         200:
@@ -4221,7 +4345,7 @@ paths:
     post:
       tags:
         - internal
-      operationId: createBranchProtectionRule
+      operationId: internalCreateBranchProtectionRule
       requestBody:
         required: true
         content:
@@ -4240,7 +4364,7 @@ paths:
     delete:
       tags:
         - internal
-      operationId: deleteBranchProtectionRule
+      operationId: internalDeleteBranchProtectionRule
       requestBody:
         required: true
         content:
diff --git a/esti/gc_test.go b/esti/gc_test.go
deleted file mode 100644
index eacc4386dfc..00000000000
--- a/esti/gc_test.go
+++ /dev/null
@@ -1,315 +0,0 @@
-package esti
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/spf13/viper"
-	"github.com/treeverse/lakefs/pkg/api/apigen"
-	"github.com/treeverse/lakefs/pkg/block"
-	"github.com/treeverse/lakefs/pkg/config"
-	"github.com/treeverse/lakefs/pkg/testutil"
-)
-
-type GCMode int
-
-const (
-	fullGCMode GCMode = iota
-	markOnlyMode
-	sweepOnlyMode
-)
-
-const (
-	committedGCRepoName = "gc"
-)
-
-var (
-	currentEpochInSeconds = time.Now().Unix()
-	dayInSeconds          = int64(100000) // rounded up from 86400
-)
-
-type testCase struct {
-	id           string
-	policy       apigen.GarbageCollectionRules
-	branches     []branchProperty
-	fileDeleted  bool
-	description  string
-	directUpload bool
-	testMode     GCMode
-}
-
-type branchProperty struct {
-	name                string
-	deleteCommitDaysAgo int64
-}
-
-var testCases = []testCase{
-	{
-		id:     "1",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{}, DefaultRetentionDays: 1},
-		branches: []branchProperty{
-			{name: "a1", deleteCommitDaysAgo: 2}, {name: "b1", deleteCommitDaysAgo: 2},
-		},
-		fileDeleted:  true,
-		description:  "The file is deleted according to the default retention policy",
-		directUpload: false,
-	},
-	{
-		id:     "2",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a2", RetentionDays: 1}, {BranchId: "b2", RetentionDays: 3}}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a2", deleteCommitDaysAgo: 4}, {name: "b2", deleteCommitDaysAgo: 4},
-		},
-		fileDeleted:  true,
-		description:  "The file is deleted according to branches' retention policies",
-		directUpload: false,
-	},
-	{
-		id:     "3",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a3", RetentionDays: 1}, {BranchId: "b3", RetentionDays: 3}}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a3", deleteCommitDaysAgo: 4}, {name: "b3", deleteCommitDaysAgo: 2},
-		},
-		fileDeleted:  false,
-		description:  "The file is not deleted because of the retention policy of the second branch",
-		directUpload: false,
-	},
-	{
-		id:     "4",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a4", deleteCommitDaysAgo: 4}, {name: "b4", deleteCommitDaysAgo: 2},
-		},
-		fileDeleted:  false,
-		description:  "The file isn't deleted according to default retention policy",
-		directUpload: false,
-	},
-	{
-		id:     "5",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a5", RetentionDays: 1}, {BranchId: "b5", RetentionDays: 3}}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a5", deleteCommitDaysAgo: 1},
-		},
-		fileDeleted:  false,
-		description:  "The file is not deleted as it still exists in the second branch",
-		directUpload: false,
-	},
-	{
-		id:     "6",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a6", RetentionDays: 1}}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a6", deleteCommitDaysAgo: 1}, {name: "b6", deleteCommitDaysAgo: 4},
-		},
-		fileDeleted:  false,
-		description:  "The file is not deleted because default retention time keeps it for the second branch",
-		directUpload: false,
-	},
-	{
-		id:     "7",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a7", RetentionDays: 1}}, DefaultRetentionDays: 5},
-		branches: []branchProperty{
-			{name: "a7", deleteCommitDaysAgo: 1}, {name: "b7", deleteCommitDaysAgo: 5},
-		},
-		fileDeleted:  true,
-		description:  "The file is deleted as the retention policy for the branch permits the deletion from the branch, and the default retention policy permits deletion for the second branch",
-		directUpload: false,
-	},
-	{
-		id:     "8",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{{BranchId: "a8", RetentionDays: 3}}, DefaultRetentionDays: 1},
-		branches: []branchProperty{
-			{name: "a8", deleteCommitDaysAgo: 2}, {name: "b8", deleteCommitDaysAgo: -1},
-		},
-		fileDeleted:  false,
-		description:  "The file (direct upload) is not deleted as the branch retention policy overrules the default retention policy",
-		directUpload: true,
-	},
-	{
-		id:     "9",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{}, DefaultRetentionDays: 1},
-		branches: []branchProperty{
-			{name: "a9", deleteCommitDaysAgo: -1}, {name: "b9", deleteCommitDaysAgo: -1},
-		},
-		fileDeleted:  true,
-		description:  "The file (direct upload) is deleted because it's in a dangling commit and the default retention policy has passed",
-		directUpload: true,
-	},
-	{
-		id:     "10",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{}, DefaultRetentionDays: 1},
-		branches: []branchProperty{
-			{name: "a10", deleteCommitDaysAgo: -1}, {name: "b10", deleteCommitDaysAgo: -1},
-		},
-		fileDeleted:  false,
-		description:  "The file (direct upload) is only marked for deletion (not actually deleted)",
-		directUpload: true,
-		testMode:     markOnlyMode,
-	},
-	{
-		id:     "11",
-		policy: apigen.GarbageCollectionRules{Branches: []apigen.GarbageCollectionRule{}, DefaultRetentionDays: 1},
-		branches: []branchProperty{
-			{name: "a11", deleteCommitDaysAgo: -1}, {name: "b11", deleteCommitDaysAgo: -1},
-		},
-		fileDeleted:  true,
-		description:  "The file (direct upload) is swept after it's first marked",
-		directUpload: true,
-		testMode:     sweepOnlyMode,
-	},
-}
-
-func newSubmitConfig(repo string, blockstoreType string, doMark bool, doSweep bool) *sparkSubmitConfig {
-	extraSubmitArgs := make([]string, 0)
-	if !doMark {
-		extraSubmitArgs = append(extraSubmitArgs,
-			"--conf", "spark.hadoop.lakefs.gc.do_mark=false",
-			"--conf", fmt.Sprintf("spark.hadoop.lakefs.gc.mark_id=marker-%s", repo))
-	}
-	if !doSweep {
-		extraSubmitArgs = append(extraSubmitArgs,
-			"--conf", "spark.hadoop.lakefs.gc.do_sweep=false",
-			"--conf", fmt.Sprintf("spark.hadoop.lakefs.gc.mark_id=marker-%s", repo))
-	}
-	if blockstoreType == block.BlockstoreTypeAzure {
-		extraSubmitArgs = append(extraSubmitArgs,
-			"--packages", "org.apache.hadoop:hadoop-azure:3.2.1",
-			"--conf", "spark.hadoop.lakefs.api.connection.timeout_seconds=3", "--conf", "spark.hadoop.lakefs.api.read.timeout_seconds=8",
-			"--conf", fmt.Sprintf("spark.hadoop.fs.azure.account.key.%s.dfs.core.windows.net=%s", azureStorageAccount, azureStorageAccessKey))
-	}
-	extraSubmitArgs = append(extraSubmitArgs,
-		"--conf", "spark.hadoop.lakefs.gc.commit.num_partitions=1",
-		"--conf", "spark.hadoop.lakefs.gc.range.num_partitions=8",
-		"--conf", "spark.hadoop.lakefs.gc.address.num_partitions=16")
-	return &sparkSubmitConfig{
-		sparkVersion:    sparkImageTag,
-		localJar:        metaClientJarPath,
-		entryPoint:      "io.treeverse.clients.GarbageCollector",
-		extraSubmitArgs: extraSubmitArgs,
-		programArgs:     []string{repo, "us-east-1"},
-		logSource:       fmt.Sprintf("gc-%s", repo),
-	}
-}
-
-func TestCommittedGC(t *testing.T) {
-	blockstoreType := viper.GetString(config.BlockstoreTypeKey)
-	logger.Infof("Got blockstore type %s", blockstoreType)
-	ctx := context.Background()
-	for _, tst := range testCases {
-		tst := tst // re-define tst to be in the scope of the closure. See: https://gist.github.com/posener/92a55c4cd441fc5e5e85f27bca008721
-		t.Run(fmt.Sprintf("Test case %s", tst.id), func(t *testing.T) {
-			fileExistingRef := prepareForGC(t, ctx, &tst, blockstoreType)
-			t.Parallel()
-			t.Logf("fileExistingRef %s", fileExistingRef)
-			repo := committedGCRepoName + tst.id
-
-			if tst.testMode == sweepOnlyMode || tst.testMode == markOnlyMode {
-				submitConfig := newSubmitConfig(repo, blockstoreType, true, false)
-				testutil.MustDo(t, "run GC with do_sweep=false", runSparkSubmit(submitConfig))
-			}
-			if tst.testMode == sweepOnlyMode {
-				submitConfig := newSubmitConfig(repo, blockstoreType, false, true)
-				testutil.MustDo(t, "run GC with do_mark=false", runSparkSubmit(submitConfig))
-			}
-			if tst.testMode == fullGCMode {
-				submitConfig := newSubmitConfig(repo, blockstoreType, true, true)
-				testutil.MustDo(t, "run GC", runSparkSubmit(submitConfig))
-			}
-			validateGCJob(t, ctx, &tst, fileExistingRef)
-		})
-	}
-}
-
-func prepareForGC(t *testing.T, ctx context.Context, testCase *testCase, blockstoreType string) string {
-	repo := createRepositoryByName(ctx, t, committedGCRepoName+testCase.id)
-
-	// upload 3 files not to be deleted and commit
-	_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, "not_deleted_file1")
-	_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, "not_deleted_file2")
-	_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, "not_deleted_file3")
-
-	commitTime := int64(0)
-	_, err := client.CommitWithResponse(ctx, repo, mainBranch, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "add three files not to be deleted", Date: &commitTime})
-	if err != nil {
-		t.Fatalf("Commit some data %s", err)
-	}
-
-	newBranch := "a" + testCase.id
-	_, err = client.CreateBranchWithResponse(ctx, repo, apigen.CreateBranchJSONRequestBody{Name: newBranch, Source: mainBranch})
-	if err != nil {
-		t.Fatalf("Create new branch %s", err)
-	}
-
-	objPath := "file" + testCase.id
-	if testCase.directUpload && blockstoreType == block.BlockstoreTypeS3 {
-		_, _ = uploadFileRandomDataDirect(ctx, t, repo, newBranch, objPath)
-	} else {
-		_, _ = uploadFileRandomData(ctx, t, repo, newBranch, objPath)
-	}
-	commitTime = int64(10)
-
-	// get commit id after commit for the validation step in the tests
-	commitRes, err := client.CommitWithResponse(ctx, repo, newBranch, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "Uploaded file" + testCase.id, Date: &commitTime})
-	if err != nil || commitRes.StatusCode() != 201 {
-		t.Fatalf("Commit some data %s", err)
-	}
-	commit := commitRes.JSON201
-	commitID := commit.Id
-
-	_, err = client.CreateBranchWithResponse(ctx, repo, apigen.CreateBranchJSONRequestBody{Name: "b" + testCase.id, Source: newBranch})
-	if err != nil {
-		t.Fatalf("Create new branch %s", err)
-	}
-
-	_, err = client.SetGarbageCollectionRulesWithResponse(ctx, repo, apigen.SetGarbageCollectionRulesJSONRequestBody{Branches: testCase.policy.Branches, DefaultRetentionDays: testCase.policy.DefaultRetentionDays})
-	if err != nil {
-		t.Fatalf("Set GC rules %s", err)
-	}
-
-	for _, branch := range testCase.branches {
-		if branch.deleteCommitDaysAgo > -1 {
-			_, err = client.DeleteObjectWithResponse(ctx, repo, branch.name, &apigen.DeleteObjectParams{Path: objPath})
-			if err != nil {
-				t.Fatalf("DeleteObject %s", err)
-			}
-			epochCommitDateInSeconds := currentEpochInSeconds - (dayInSeconds * branch.deleteCommitDaysAgo)
-			_, err = client.CommitWithResponse(ctx, repo, branch.name, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "Deleted file" + testCase.id, Date: &epochCommitDateInSeconds})
-			if err != nil {
-				t.Fatalf("Commit some data %s", err)
-			}
-			_, _ = uploadFileRandomData(ctx, t, repo, branch.name, objPath+"not_deleted")
-			// This is for the previous commit to be the HEAD of the branch outside the retention time (according to GC https://github.com/treeverse/lakeFS/issues/1932)
-			_, err = client.CommitWithResponse(ctx, repo, branch.name, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "not deleted file commit: " + testCase.id, Date: &epochCommitDateInSeconds})
-			if err != nil {
-				t.Fatalf("Commit some data %s", err)
-			}
-		} else {
-			_, err = client.DeleteBranchWithResponse(ctx, repo, branch.name)
-			if err != nil {
-				t.Fatalf("Delete brach %s", err)
-			}
-		}
-	}
-	return commitID
-}
-
-func validateGCJob(t *testing.T, ctx context.Context, testCase *testCase, existingRef string) {
-	repo := committedGCRepoName + testCase.id
-
-	res, _ := client.GetObjectWithResponse(ctx, repo, existingRef, &apigen.GetObjectParams{Path: "file" + testCase.id})
-	fileExists := res.StatusCode() == 200
-
-	if fileExists && testCase.fileDeleted {
-		t.Errorf("Expected the file to be removed by the garbage collector but it has remained in the repository. Test case '%s'. Test description '%s'", testCase.id, testCase.description)
-	} else if !fileExists && !testCase.fileDeleted {
-		t.Errorf("Expected the file to remain in the repository but it was removed by the garbage collector. Test case '%s'. Test description '%s'", testCase.id, testCase.description)
-	}
-	locations := []string{"not_deleted_file1", "not_deleted_file2", "not_deleted_file3"}
-	for _, location := range locations {
-		res, _ = client.GetObjectWithResponse(ctx, repo, "main", &apigen.GetObjectParams{Path: location})
-		if res.StatusCode() != 200 {
-			t.Errorf("expected '%s' to exist. Test case '%s', Test description '%s'", location, testCase.id, testCase.description)
-		}
-	}
-}
diff --git a/esti/ugc_test.go b/esti/ugc_test.go
deleted file mode 100644
index 4e14dd20dab..00000000000
--- a/esti/ugc_test.go
+++ /dev/null
@@ -1,394 +0,0 @@
-package esti
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/rs/xid"
-	"github.com/treeverse/lakefs/pkg/api/apigen"
-	"github.com/treeverse/lakefs/pkg/block"
-	blocks3 "github.com/treeverse/lakefs/pkg/block/s3"
-	"github.com/treeverse/lakefs/pkg/testutil"
-	"golang.org/x/exp/slices"
-)
-
-const (
-	uncommittedGCRepoName = "ugc"
-	ugcFindingsFilename   = "ugc-findings.json"
-)
-
-type UncommittedFindings struct {
-	All            []Object
-	Deleted        []string
-	preLinkAddress apigen.StagingLocation
-}
-
-func TestUncommittedGC(t *testing.T) {
-	requireBlockstoreType(t, block.BlockstoreTypeS3)
-	ctx := context.Background()
-	prepareForUncommittedGC(t, ctx)
-
-	// upload files while ugc is running
-	ticker := time.NewTicker(time.Second)
-	var durObjects []string
-	done := make(chan bool)
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			select {
-			case <-done:
-				ticker.Stop()
-				return
-			case <-ticker.C:
-				obj := uploadAndDeleteSafeTestData(t, ctx, uncommittedGCRepoName)
-				durObjects = append(durObjects, obj)
-			}
-		}
-	}()
-
-	submitConfig := &sparkSubmitConfig{
-		sparkVersion:    sparkImageTag,
-		localJar:        metaClientJarPath,
-		entryPoint:      "io.treeverse.gc.UncommittedGarbageCollector",
-		extraSubmitArgs: []string{"--conf", "spark.hadoop.lakefs.debug.gc.uncommitted_min_age_seconds=1"},
-		programArgs:     []string{uncommittedGCRepoName, "us-east-1"},
-		logSource:       "ugc",
-	}
-	testutil.MustDo(t, "run uncommitted GC", runSparkSubmit(submitConfig))
-	done <- true
-	wg.Wait()
-
-	validateUncommittedGC(t, durObjects)
-}
-
-func prepareForUncommittedGC(t *testing.T, ctx context.Context) {
-	repo := createRepositoryByName(ctx, t, uncommittedGCRepoName)
-	var gone []string
-
-	// upload some data and commit
-	for i := 0; i < 3; i++ {
-		_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, "committed/data-"+strconv.Itoa(i))
-		_, _ = uploadFileRandomDataDirect(ctx, t, repo, mainBranch, "committed/data-direct-"+strconv.Itoa(i))
-	}
-	_, err := client.CommitWithResponse(ctx, repo, mainBranch, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "Commit initial data"})
-	if err != nil {
-		t.Fatal("Commit some data", err)
-	}
-
-	// upload the same file twice and commit, keep delete physical location
-	for _, direct := range []bool{false, true} {
-		objPath := fmt.Sprintf("committed/double-or-nothing-%t", direct)
-		_, err = uploadFileAndReport(ctx, repo, mainBranch, objPath, objPath+"1", direct)
-		if err != nil {
-			t.Fatalf("Failed to upload double-or-nothing I: %s", err)
-		}
-		addr := objectPhysicalAddress(t, ctx, repo, objPath)
-		gone = append(gone, addr)
-
-		_, err = uploadFileAndReport(ctx, repo, mainBranch, objPath, objPath+"2", direct)
-		if err != nil {
-			t.Fatalf("Failed to upload double-or-nothing II: %s", err)
-		}
-		_, err = client.CommitWithResponse(ctx, repo, mainBranch, &apigen.CommitParams{}, apigen.CommitJSONRequestBody{Message: "Commit initial data"})
-		if err != nil {
-			t.Fatal("Commit single file uploaded twice", err)
-		}
-	}
-
-	// upload uncommitted data
-
-	for _, direct := range []bool{false, true} {
-		// just leave uncommitted data
-		_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, fmt.Sprintf("uncommitted/data1-%t", direct))
-
-		// delete uncommitted
-		objPath := fmt.Sprintf("uncommitted/data2-%t", direct)
-		_, _ = uploadFileRandomData(ctx, t, repo, mainBranch, objPath)
-
-		gone = append(gone, objectPhysicalAddress(t, ctx, repo, objPath))
-
-		delResp, err := client.DeleteObjectWithResponse(ctx, repo, mainBranch, &apigen.DeleteObjectParams{Path: objPath})
-		if err != nil {
-			t.Fatalf("Delete object '%s' failed: %s", objPath, err)
-		}
-		if delResp.StatusCode() != http.StatusNoContent {
-			t.Fatalf("Delete object '%s' failed with status code %d", objPath, delResp.StatusCode())
-		}
-	}
-
-	// getting physical address before the ugc run and linking it after
-	getPhysicalResp, err := client.GetPhysicalAddressWithResponse(ctx, repo, mainBranch, &apigen.GetPhysicalAddressParams{Path: "foo/bar"})
-	if err != nil {
-		t.Fatalf("Failed to get physical address %s", err)
-	}
-	if getPhysicalResp.JSON200 == nil {
-		t.Fatalf("Failed to get physical address information: status code %d", getPhysicalResp.StatusCode())
-	}
-
-	objects, _ := listRepositoryUnderlyingStorage(t, ctx, repo)
-	// write findings into a file
-	findings, err := json.MarshalIndent(
-		UncommittedFindings{
-			All:     objects,
-			Deleted: gone,
-			preLinkAddress: apigen.StagingLocation{
-				PhysicalAddress: getPhysicalResp.JSON200.PhysicalAddress,
-				Token:           getPhysicalResp.JSON200.Token,
-			},
-		}, "", "  ")
-	if err != nil {
-		t.Fatalf("failed to marshal findings: %s", err)
-	}
-	t.Logf("Findings: %s", findings)
-	findingsPath := findingFilePath()
-	err = os.WriteFile(findingsPath, findings, 0o666)
-	if err != nil {
-		t.Fatalf("Failed to write findings file '%s': %s", findingsPath, err)
-	}
-}
-
-func findingFilePath() string {
-	return filepath.Join(os.TempDir(), ugcFindingsFilename)
-}
-
-func objectPhysicalAddress(t *testing.T, ctx context.Context, repo, objPath string) string {
-	resp, err := client.StatObjectWithResponse(ctx, repo, mainBranch, &apigen.StatObjectParams{Path: objPath})
-	if err != nil {
-		t.Fatalf("Failed to stat object '%s': %s", objPath, err)
-	}
-	if resp.JSON200 == nil {
-		t.Fatalf("Failed to stat object '%s': status code %d", objPath, resp.StatusCode())
-	}
-	return resp.JSON200.PhysicalAddress
-}
-
-func validateUncommittedGC(t *testing.T, durObjects []string) {
-	ctx := context.Background()
-	const repo = uncommittedGCRepoName
-
-	findingPath := findingFilePath()
-	b, err := os.ReadFile(findingPath)
-	if err != nil {
-		t.Fatalf("Failed to read '%s': %s", findingPath, err)
-	}
-	var findings UncommittedFindings
-	err = json.Unmarshal(b, &findings)
-	if err != nil {
-		t.Fatalf("Failed to unmarshal findings '%s': %s", findingPath, err)
-	}
-
-	// link the pre physical address
-	const expectedSizeBytes = 38
-	_, err = client.LinkPhysicalAddressWithResponse(ctx, "repo1", "main", &apigen.LinkPhysicalAddressParams{
-		Path: "foo/bar",
-	}, apigen.LinkPhysicalAddressJSONRequestBody{
-		Checksum:  "afb0689fe58b82c5f762991453edbbec",
-		SizeBytes: expectedSizeBytes,
-		Staging: apigen.StagingLocation{
-			PhysicalAddress: findings.preLinkAddress.PhysicalAddress,
-			Token:           findings.preLinkAddress.Token,
-		},
-	})
-	if err != nil {
-		t.Fatalf("Failed to link physical address %s", err)
-	}
-
-	// list underlying storage
-	objects, qk := listRepositoryUnderlyingStorage(t, ctx, repo)
-
-	// verify that all previous objects are found or deleted, if needed
-	for _, obj := range findings.All {
-		foundIt := slices.Contains(objects, obj)
-		expectDeleted := slices.Contains(findings.Deleted, obj.Key)
-		if foundIt && expectDeleted {
-			t.Errorf("Object '%s' FOUND - should have been deleted", obj)
-		} else if !foundIt && !expectDeleted {
-			t.Errorf("Object '%s' NOT FOUND - should NOT been deleted", obj)
-		}
-	}
-
-	// verify that we do not have new objects
-	for _, obj := range objects {
-		// skip uncommitted retention reports
-		if strings.Contains(obj.Key, "/_lakefs/retention/gc/uncommitted/") {
-			continue
-		}
-		// verify we know this object
-		if !slices.Contains(findings.All, obj) && !slices.Contains(durObjects, obj.Key) {
-			t.Errorf("Object '%s' FOUND KNOWN - was not found pre ugc", obj)
-		}
-	}
-
-	bucket, key := blocks3.ExtractParamsFromQK(qk)
-	s3Client := newDefaultS3Client(t)
-	runID := getLastUGCRunID(t, ctx, s3Client, bucket, key)
-	reportPath := fmt.Sprintf("%s_lakefs/retention/gc/uncommitted/%s/summary.json", key, runID)
-	cutoffTime, err := getReportCutoffTime(ctx, s3Client, bucket, reportPath)
-	if err != nil {
-		t.Fatalf("Failed to get start list time from ugc report %s", err)
-	}
-
-	objectsMap := make(map[string]Object)
-	for _, obj := range objects {
-		objectsMap[obj.Key] = obj
-	}
-
-	// Validation that deleted objects that were created after the cutoff are not deleted
-	// and that deleted objects that were created before the cutoff are deleted
-	for _, obj := range durObjects {
-		x, foundIt := objectsMap[obj]
-		expectDeleted := true
-		if foundIt {
-			expectDeleted = x.LastModified.Before(cutoffTime)
-		}
-		if foundIt && expectDeleted {
-			t.Errorf("Object '%s' FOUND - should have been deleted", obj)
-		} else if !foundIt && !expectDeleted {
-			t.Errorf("Object '%s' NOT FOUND - should NOT been deleted", obj)
-		}
-	}
-}
-
-// listRepositoryUnderlyingStorage list on the repository storage namespace returns its objects, and the storage namespace
-func listRepositoryUnderlyingStorage(t *testing.T, ctx context.Context, repo string) ([]Object, block.CommonQualifiedKey) {
-	// list all objects in the physical layer
-	repoResponse, err := client.GetRepositoryWithResponse(ctx, repo)
-	if err != nil {
-		t.Fatalf("Failed to get repository '%s' information: %s", repo, err)
-	}
-	if repoResponse.JSON200 == nil {
-		t.Fatalf("Failed to get repository '%s' information: status code %d", repo, repoResponse.StatusCode())
-	}
-
-	// list committed files and keep the physical paths
-	storageNamespace := repoResponse.JSON200.StorageNamespace
-	qk, err := block.DefaultResolveNamespace(storageNamespace, "", block.IdentifierTypeRelative)
-	if err != nil {
-		t.Fatalf("Failed to resolve namespace '%s': %s", storageNamespace, err)
-	}
-
-	bucket, key := blocks3.ExtractParamsFromQK(qk)
-	s3Client := newDefaultS3Client(t)
-	objects := listUnderlyingStorage(t, ctx, s3Client, bucket, key)
-	return objects, qk
-}
-
-func listUnderlyingStorage(t *testing.T, ctx context.Context, s3Client *s3.Client, bucket, prefix string) []Object {
-	listInput := &s3.ListObjectsInput{
-		Bucket: aws.String(bucket),
-		Prefix: aws.String(prefix),
-	}
-	listOutput, err := s3Client.ListObjects(ctx, listInput)
-	if err != nil {
-		t.Fatalf("Failed to list objects (bucket: %s, prefix: %s): %s", bucket, prefix, err)
-	}
-
-	// sorted list of objects found on repository - before ugc
-	var objects []Object
-	for _, obj := range listOutput.Contents {
-		objects = append(objects, Object{
-			Key:          fmt.Sprintf("s3://%s/%s", bucket, aws.ToString(obj.Key)),
-			LastModified: aws.ToTime(obj.LastModified),
-		})
-	}
-	return objects
-}
-
-type Object struct {
-	Key          string
-	LastModified time.Time
-}
-
-// newDefaultS3Client setup new s3 client for direct access to the underlying storage
-func newDefaultS3Client(t *testing.T) *s3.Client {
-	cfg, err := config.LoadDefaultConfig(context.Background(), config.WithRegion("us-east-1"))
-	if err != nil {
-		t.Fatalf("Failed to create aws config: %s", err)
-	}
-	return s3.NewFromConfig(cfg)
-}
-
-func getLastUGCRunID(t *testing.T, ctx context.Context, s3Client *s3.Client, bucket, prefix string) string {
-	runIDPrefix := prefix + "_lakefs/retention/gc/uncommitted/"
-	listSize := int64(1)
-	listInput := &s3.ListObjectsInput{
-		Bucket:    aws.String(bucket),
-		Prefix:    aws.String(runIDPrefix),
-		Delimiter: aws.String("/"),
-		MaxKeys:   int32(listSize),
-	}
-	listOutput, err := s3Client.ListObjects(ctx, listInput)
-	if err != nil {
-		t.Fatalf("Failed to list objects (bucket: %s, prefix: %s): %s", bucket, runIDPrefix, err)
-	}
-
-	if len(listOutput.CommonPrefixes) == 0 {
-		t.Fatalf("Failed to list last run id (bucket: %s, prefix: %s): %s", bucket, runIDPrefix, err)
-	}
-	key := strings.ReplaceAll(*listOutput.CommonPrefixes[0].Prefix, runIDPrefix, "")
-	runID := strings.ReplaceAll(key, "/", "")
-	return runID
-}
-
-func uploadAndDeleteSafeTestData(t *testing.T, ctx context.Context, repository string) string {
-	name := xid.New().String()
-	_, _ = uploadFileRandomData(ctx, t, repository, mainBranch, name)
-
-	addr := objectPhysicalAddress(t, ctx, repository, name)
-
-	_, err := client.DeleteObjectWithResponse(ctx, repository, mainBranch, &apigen.DeleteObjectParams{Path: name})
-	if err != nil {
-		t.Fatalf("Failed to delete object %s", err)
-	}
-	return addr
-}
-
-func getReportCutoffTime(ctx context.Context, s3Client *s3.Client, bucket, reportPath string) (time.Time, error) {
-	res, err := s3Client.GetObject(ctx, &s3.GetObjectInput{
-		Bucket: aws.String(bucket),
-		Key:    aws.String(reportPath),
-	})
-	if err != nil {
-		return time.Time{}, err
-	}
-	defer func() { _ = res.Body.Close() }()
-
-	buf := new(bytes.Buffer)
-	_, err = buf.ReadFrom(res.Body)
-	if err != nil {
-		return time.Time{}, err
-	}
-	myFileContentAsString := buf.String()
-
-	type Report struct {
-		RunID             string    `json:"run_id"`
-		Success           bool      `json:"success"`
-		FirstSlice        string    `json:"first_slice"`
-		StartTime         time.Time `json:"start_time"`
-		CutoffTime        time.Time `json:"cutoff_time"`
-		NumDeletedObjects int       `json:"num_deleted_objects"`
-	}
-
-	var report Report
-	err = json.Unmarshal([]byte(myFileContentAsString), &report)
-	if err != nil {
-		return time.Time{}, err
-	}
-	return report.CutoffTime, nil
-}
diff --git a/esti/unified_gc_test.go b/esti/unified_gc_test.go
index 452b0078f31..d6e4806152a 100644
--- a/esti/unified_gc_test.go
+++ b/esti/unified_gc_test.go
@@ -200,7 +200,7 @@ func prepareForUnifiedGC(t *testing.T, ctx context.Context) {
 	createBranchRes, err = client.CreateBranchWithResponse(ctx, repo, apigen.CreateBranchJSONRequestBody{Name: "dev2", Source: mainBranch})
 	testutil.MustDo(t, "Create branch dev2", err)
 	require.False(t, createBranchRes.StatusCode() > 299, "Create branch dev2")
-	setGCRulesRes, err := client.SetGarbageCollectionRulesWithResponse(ctx, repo, apigen.SetGarbageCollectionRulesJSONRequestBody{Branches: []apigen.GarbageCollectionRule{
+	setGCRulesRes, err := client.SetGCRulesWithResponse(ctx, repo, apigen.SetGCRulesJSONRequestBody{Branches: []apigen.GarbageCollectionRule{
 		{BranchId: "main", RetentionDays: 10}, {BranchId: "dev", RetentionDays: 7}, {BranchId: "dev", RetentionDays: 7},
 	}, DefaultRetentionDays: 7})
 	testutil.MustDo(t, "Set gc rules", err)
diff --git a/pkg/api/controller.go b/pkg/api/controller.go
index 310c6d5e158..feb87f32fc3 100644
--- a/pkg/api/controller.go
+++ b/pkg/api/controller.go
@@ -34,7 +34,7 @@ import (
 	"github.com/treeverse/lakefs/pkg/catalog"
 	"github.com/treeverse/lakefs/pkg/cloud"
 	"github.com/treeverse/lakefs/pkg/config"
-	"github.com/treeverse/lakefs/pkg/graveler"
+	graveler "github.com/treeverse/lakefs/pkg/graveler"
 	"github.com/treeverse/lakefs/pkg/graveler/ref"
 	"github.com/treeverse/lakefs/pkg/httputil"
 	"github.com/treeverse/lakefs/pkg/kv"
@@ -1731,6 +1731,134 @@ func (c *Controller) GetRepositoryMetadata(w http.ResponseWriter, r *http.Reques
 	writeResponse(w, r, http.StatusOK, apigen.RepositoryMetadata{AdditionalProperties: metadata})
 }
 
+func (c *Controller) GetBranchProtectionRules(w http.ResponseWriter, r *http.Request, repository string) {
+	if !c.authorize(w, r, permissions.Node{
+		Permission: permissions.Permission{
+			Action:   permissions.GetBranchProtectionRulesAction,
+			Resource: permissions.RepoArn(repository),
+		},
+	}) {
+		return
+	}
+	ctx := r.Context()
+	rules, eTag, err := c.Catalog.GetBranchProtectionRules(ctx, repository)
+	if c.handleAPIError(ctx, w, r, err) {
+		return
+	}
+	resp := make([]*apigen.BranchProtectionRule, 0, len(rules.BranchPatternToBlockedActions))
+	for pattern := range rules.BranchPatternToBlockedActions {
+		resp = append(resp, &apigen.BranchProtectionRule{
+			Pattern: pattern,
+		})
+	}
+	if eTag == "" {
+		// workaround since swagger doesn't allow empty headers
+		// https://github.com/deepmap/oapi-codegen/issues/954
+		eTag = base64.StdEncoding.EncodeToString([]byte("EMPTY"))
+	}
+	w.Header().Set("ETag", eTag)
+	writeResponse(w, r, http.StatusOK, resp)
+}
+
+func (c *Controller) SetBranchProtectionRules(w http.ResponseWriter, r *http.Request, body apigen.SetBranchProtectionRulesJSONRequestBody, repository string, params apigen.SetBranchProtectionRulesParams) {
+	if !c.authorize(w, r, permissions.Node{
+		Permission: permissions.Permission{
+			Action:   permissions.SetBranchProtectionRulesAction,
+			Resource: permissions.RepoArn(repository),
+		},
+	}) {
+		return
+	}
+	ctx := r.Context()
+	c.LogAction(ctx, "create_branch_protection_rule", r, repository, "", "")
+
+	// For now, all protected branches use the same default set of blocked actions. In the future this set will be user configurable.
+	blockedActions := []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_STAGING_WRITE, graveler.BranchProtectionBlockedAction_COMMIT}
+
+	rules := &graveler.BranchProtectionRules{
+		BranchPatternToBlockedActions: make(map[string]*graveler.BranchProtectionBlockedActions),
+	}
+	for _, r := range body {
+		rules.BranchPatternToBlockedActions[r.Pattern] = &graveler.BranchProtectionBlockedActions{
+			Value: blockedActions,
+		}
+	}
+	eTag := params.IfMatch
+	if swag.StringValue(eTag) == "" {
+		// workaround since swagger doesn't allow empty headers
+		// https://github.com/deepmap/oapi-codegen/issues/954
+		eTag = swag.String(base64.StdEncoding.EncodeToString([]byte("EMPTY")))
+	}
+	err := c.Catalog.SetBranchProtectionRules(ctx, repository, rules, params.IfMatch)
+	if c.handleAPIError(ctx, w, r, err) {
+		return
+	}
+	writeResponse(w, r, http.StatusNoContent, nil)
+}
+
+func (c *Controller) DeleteGCRules(w http.ResponseWriter, r *http.Request, repository string) {
+	if !c.authorize(w, r, permissions.Node{
+		Permission: permissions.Permission{
+			Action:   permissions.SetGarbageCollectionRulesAction,
+			Resource: permissions.RepoArn(repository),
+		},
+	}) {
+		return
+	}
+	ctx := r.Context()
+	err := c.Catalog.SetGarbageCollectionRules(ctx, repository, nil)
+	if c.handleAPIError(ctx, w, r, err) {
+		return
+	}
+	writeResponse(w, r, http.StatusNoContent, nil)
+}
+
+func (c *Controller) GetGCRules(w http.ResponseWriter, r *http.Request, repository string) {
+	if !c.authorize(w, r, permissions.Node{
+		Permission: permissions.Permission{
+			Action:   permissions.GetGarbageCollectionRulesAction,
+			Resource: permissions.RepoArn(repository),
+		},
+	}) {
+		return
+	}
+	ctx := r.Context()
+	rules, err := c.Catalog.GetGarbageCollectionRules(ctx, repository)
+	if c.handleAPIError(ctx, w, r, err) {
+		return
+	}
+	resp := apigen.GarbageCollectionRules{}
+	resp.DefaultRetentionDays = int(rules.DefaultRetentionDays)
+	for branchID, retentionDays := range rules.BranchRetentionDays {
+		resp.Branches = append(resp.Branches, apigen.GarbageCollectionRule{BranchId: branchID, RetentionDays: int(retentionDays)})
+	}
+	writeResponse(w, r, http.StatusOK, resp)
+}
+
+func (c *Controller) SetGCRules(w http.ResponseWriter, r *http.Request, body apigen.SetGCRulesJSONRequestBody, repository string) {
+	if !c.authorize(w, r, permissions.Node{
+		Permission: permissions.Permission{
+			Action:   permissions.SetGarbageCollectionRulesAction,
+			Resource: permissions.RepoArn(repository),
+		},
+	}) {
+		return
+	}
+	ctx := r.Context()
+	rules := &graveler.GarbageCollectionRules{
+		DefaultRetentionDays: int32(body.DefaultRetentionDays),
+		BranchRetentionDays:  make(map[string]int32),
+	}
+	for _, rule := range body.Branches {
+		rules.BranchRetentionDays[rule.BranchId] = int32(rule.RetentionDays)
+	}
+	err := c.Catalog.SetGarbageCollectionRules(ctx, repository, rules)
+	if c.handleAPIError(ctx, w, r, err) {
+		return
+	}
+	writeResponse(w, r, http.StatusNoContent, nil)
+}
+
 func (c *Controller) ListRepositoryRuns(w http.ResponseWriter, r *http.Request, repository string, params apigen.ListRepositoryRunsParams) {
 	if !c.authorize(w, r, permissions.Node{
 		Permission: permissions.Permission{
@@ -2113,7 +2241,9 @@ func (c *Controller) handleAPIErrorCallback(ctx context.Context, w http.Response
 	case errors.Is(err, graveler.ErrTooManyTries):
 		log.Debug("Retried too many times")
 		cb(w, r, http.StatusLocked, "Too many attempts, try again later")
-
+	case errors.Is(err, graveler.ErrPreconditionFailed):
+		log.Debug("Precondition failed")
+		cb(w, r, http.StatusPreconditionFailed, "Precondition failed")
 	case err != nil:
 		c.Logger.WithContext(ctx).WithError(err).Error("API call returned status internal server error")
 		cb(w, r, http.StatusInternalServerError, err)
@@ -2845,26 +2975,8 @@ func (c *Controller) GetCommit(w http.ResponseWriter, r *http.Request, repositor
 	writeResponse(w, r, http.StatusOK, response)
 }
 
-func (c *Controller) GetGarbageCollectionRules(w http.ResponseWriter, r *http.Request, repository string) {
-	if !c.authorize(w, r, permissions.Node{
-		Permission: permissions.Permission{
-			Action:   permissions.GetGarbageCollectionRulesAction,
-			Resource: permissions.RepoArn(repository),
-		},
-	}) {
-		return
-	}
-	ctx := r.Context()
-	rules, err := c.Catalog.GetGarbageCollectionRules(ctx, repository)
-	if c.handleAPIError(ctx, w, r, err) {
-		return
-	}
-	resp := apigen.GarbageCollectionRules{}
-	resp.DefaultRetentionDays = int(rules.DefaultRetentionDays)
-	for branchID, retentionDays := range rules.BranchRetentionDays {
-		resp.Branches = append(resp.Branches, apigen.GarbageCollectionRule{BranchId: branchID, RetentionDays: int(retentionDays)})
-	}
-	writeResponse(w, r, http.StatusOK, resp)
+func (c *Controller) InternalGetGarbageCollectionRules(w http.ResponseWriter, r *http.Request, repository string) {
+	c.GetGCRules(w, r, repository)
 }
 
 func (c *Controller) SetGarbageCollectionRulesPreflight(w http.ResponseWriter, r *http.Request, repository string) {
@@ -2883,45 +2995,15 @@ func (c *Controller) SetGarbageCollectionRulesPreflight(w http.ResponseWriter, r
 	writeResponse(w, r, http.StatusNoContent, nil)
 }
 
-func (c *Controller) SetGarbageCollectionRules(w http.ResponseWriter, r *http.Request, body apigen.SetGarbageCollectionRulesJSONRequestBody, repository string) {
-	if !c.authorize(w, r, permissions.Node{
-		Permission: permissions.Permission{
-			Action:   permissions.SetGarbageCollectionRulesAction,
-			Resource: permissions.RepoArn(repository),
-		},
-	}) {
-		return
-	}
-	ctx := r.Context()
-	rules := &graveler.GarbageCollectionRules{
-		DefaultRetentionDays: int32(body.DefaultRetentionDays),
-		BranchRetentionDays:  make(map[string]int32),
-	}
-	for _, rule := range body.Branches {
-		rules.BranchRetentionDays[rule.BranchId] = int32(rule.RetentionDays)
-	}
-	err := c.Catalog.SetGarbageCollectionRules(ctx, repository, rules)
-	if c.handleAPIError(ctx, w, r, err) {
-		return
-	}
-	writeResponse(w, r, http.StatusNoContent, nil)
+func (c *Controller) InternalSetGarbageCollectionRules(w http.ResponseWriter, r *http.Request, body apigen.InternalSetGarbageCollectionRulesJSONRequestBody, repository string) {
+	c.SetGCRules(w, r, apigen.SetGCRulesJSONRequestBody{
+		Branches:             body.Branches,
+		DefaultRetentionDays: body.DefaultRetentionDays,
+	}, repository)
 }
 
-func (c *Controller) DeleteGarbageCollectionRules(w http.ResponseWriter, r *http.Request, repository string) {
-	if !c.authorize(w, r, permissions.Node{
-		Permission: permissions.Permission{
-			Action:   permissions.SetGarbageCollectionRulesAction,
-			Resource: permissions.RepoArn(repository),
-		},
-	}) {
-		return
-	}
-	ctx := r.Context()
-	err := c.Catalog.SetGarbageCollectionRules(ctx, repository, nil)
-	if c.handleAPIError(ctx, w, r, err) {
-		return
-	}
-	writeResponse(w, r, http.StatusNoContent, nil)
+func (c *Controller) InternalDeleteGarbageCollectionRules(w http.ResponseWriter, r *http.Request, repository string) {
+	c.DeleteGCRules(w, r, repository)
 }
 
 func (c *Controller) PrepareGarbageCollectionCommits(w http.ResponseWriter, r *http.Request, repository string) {
@@ -2954,30 +3036,11 @@ func (c *Controller) PrepareGarbageCollectionCommits(w http.ResponseWriter, r *h
 	})
 }
 
-func (c *Controller) GetBranchProtectionRules(w http.ResponseWriter, r *http.Request, repository string) {
-	if !c.authorize(w, r, permissions.Node{
-		Permission: permissions.Permission{
-			Action:   permissions.GetBranchProtectionRulesAction,
-			Resource: permissions.RepoArn(repository),
-		},
-	}) {
-		return
-	}
-	ctx := r.Context()
-	rules, _, err := c.Catalog.GetBranchProtectionRules(ctx, repository)
-	if c.handleAPIError(ctx, w, r, err) {
-		return
-	}
-	resp := make([]*apigen.BranchProtectionRule, 0, len(rules.BranchPatternToBlockedActions))
-	for pattern := range rules.BranchPatternToBlockedActions {
-		resp = append(resp, &apigen.BranchProtectionRule{
-			Pattern: pattern,
-		})
-	}
-	writeResponse(w, r, http.StatusOK, resp)
+func (c *Controller) InternalGetBranchProtectionRules(w http.ResponseWriter, r *http.Request, repository string) {
+	c.GetBranchProtectionRules(w, r, repository)
 }
 
-func (c *Controller) DeleteBranchProtectionRule(w http.ResponseWriter, r *http.Request, body apigen.DeleteBranchProtectionRuleJSONRequestBody, repository string) {
+func (c *Controller) InternalDeleteBranchProtectionRule(w http.ResponseWriter, r *http.Request, body apigen.InternalDeleteBranchProtectionRuleJSONRequestBody, repository string) {
 	if !c.authorize(w, r, permissions.Node{
 		Permission: permissions.Permission{
 			Action:   permissions.SetBranchProtectionRulesAction,
@@ -2989,11 +3052,19 @@ func (c *Controller) DeleteBranchProtectionRule(w http.ResponseWriter, r *http.R
 	ctx := r.Context()
 	c.LogAction(ctx, "delete_branch_protection_rule", r, repository, "", "")
 
-	err := c.Catalog.DeleteBranchProtectionRule(ctx, repository, body.Pattern)
+	rules, _, err := c.Catalog.GetBranchProtectionRules(ctx, repository)
 	if c.handleAPIError(ctx, w, r, err) {
 		return
 	}
-	writeResponse(w, r, http.StatusNoContent, nil)
+	for p := range rules.BranchPatternToBlockedActions {
+		if p == body.Pattern {
+			delete(rules.BranchPatternToBlockedActions, p)
+			err = c.Catalog.SetBranchProtectionRules(ctx, repository, rules, nil)
+			writeResponse(w, r, http.StatusNoContent, nil)
+			return
+		}
+	}
+	writeResponse(w, r, http.StatusNotFound, nil)
 }
 
 func (c *Controller) CreateBranchProtectionRulePreflight(w http.ResponseWriter, r *http.Request, repository string) {
@@ -3012,7 +3083,7 @@ func (c *Controller) CreateBranchProtectionRulePreflight(w http.ResponseWriter,
 	writeResponse(w, r, http.StatusNoContent, nil)
 }
 
-func (c *Controller) CreateBranchProtectionRule(w http.ResponseWriter, r *http.Request, body apigen.CreateBranchProtectionRuleJSONRequestBody, repository string) {
+func (c *Controller) InternalCreateBranchProtectionRule(w http.ResponseWriter, r *http.Request, body apigen.InternalCreateBranchProtectionRuleJSONRequestBody, repository string) {
 	if !c.authorize(w, r, permissions.Node{
 		Permission: permissions.Permission{
 			Action:   permissions.SetBranchProtectionRulesAction,
@@ -3023,10 +3094,22 @@ func (c *Controller) CreateBranchProtectionRule(w http.ResponseWriter, r *http.R
 	}
 	ctx := r.Context()
 	c.LogAction(ctx, "create_branch_protection_rule", r, repository, "", "")
-
-	// For now, all protected branches use the same default set of blocked actions. In the future this set will be user configurable.
-	blockedActions := []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_STAGING_WRITE, graveler.BranchProtectionBlockedAction_COMMIT}
-	err := c.Catalog.CreateBranchProtectionRule(ctx, repository, body.Pattern, blockedActions)
+	rules, _, err := c.Catalog.GetBranchProtectionRules(ctx, repository)
+	if !errors.Is(err, graveler.ErrNotFound) {
+		if c.handleAPIError(ctx, w, r, err) {
+			return
+		}
+	}
+	if rules == nil {
+		rules = &graveler.BranchProtectionRules{
+			BranchPatternToBlockedActions: make(map[string]*graveler.BranchProtectionBlockedActions),
+		}
+	}
+	blockedActions := &graveler.BranchProtectionBlockedActions{
+		Value: []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_STAGING_WRITE, graveler.BranchProtectionBlockedAction_COMMIT},
+	}
+	rules.BranchPatternToBlockedActions[body.Pattern] = blockedActions
+	err = c.Catalog.SetBranchProtectionRules(ctx, repository, rules, nil)
 	if c.handleAPIError(ctx, w, r, err) {
 		return
 	}
diff --git a/pkg/api/controller_test.go b/pkg/api/controller_test.go
index 5800c94d04c..68e01136bf2 100644
--- a/pkg/api/controller_test.go
+++ b/pkg/api/controller_test.go
@@ -929,7 +929,16 @@ func TestController_CommitHandler(t *testing.T) {
 		repo := testUniqueRepoName()
 		_, err := deps.catalog.CreateRepository(ctx, repo, onBlock(deps, repo), "main")
 		testutil.MustDo(t, "create repository", err)
-		err = deps.catalog.CreateBranchProtectionRule(ctx, repo, "main", []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_COMMIT})
+		rules := map[string]*graveler.BranchProtectionBlockedActions{
+			"main": {
+				Value: []graveler.BranchProtectionBlockedAction{
+					graveler.BranchProtectionBlockedAction_COMMIT,
+				},
+			},
+		}
+		err = deps.catalog.SetBranchProtectionRules(ctx, repo, &graveler.BranchProtectionRules{
+			BranchPatternToBlockedActions: rules,
+		}, swag.String(""))
 		testutil.MustDo(t, "protection rule", err)
 		err = deps.catalog.CreateEntry(ctx, repo, "main", catalog.DBEntry{Path: "foo/bar", PhysicalAddress: "pa", CreationDate: time.Now(), Size: 666, Checksum: "cs", Metadata: nil})
 		testutil.MustDo(t, "commit to protected branch", err)
@@ -2560,7 +2569,16 @@ func TestController_ObjectsDeleteObjectHandler(t *testing.T) {
 			resp, err := uploadObjectHelper(t, ctx, clt, p, strings.NewReader(content), repo, branch)
 			verifyResponseOK(t, resp, err)
 		}
-		err = deps.catalog.CreateBranchProtectionRule(ctx, repo, "*", []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_STAGING_WRITE})
+		rules := map[string]*graveler.BranchProtectionBlockedActions{
+			"*": {
+				Value: []graveler.BranchProtectionBlockedAction{
+					graveler.BranchProtectionBlockedAction_STAGING_WRITE,
+				},
+			},
+		}
+		err = deps.catalog.SetBranchProtectionRules(ctx, repo, &graveler.BranchProtectionRules{
+			BranchPatternToBlockedActions: rules,
+		}, swag.String(""))
 		testutil.Must(t, err)
 
 		// delete objects
@@ -4378,17 +4396,17 @@ func TestController_BranchProtectionRules(t *testing.T) {
 			}
 
 			// the result of an actual call to the endpoint should have the same result
-			resp, err := tc.clt.CreateBranchProtectionRuleWithResponse(currCtx, repo, apigen.CreateBranchProtectionRuleJSONRequestBody{
+			resp, err := tc.clt.InternalCreateBranchProtectionRuleWithResponse(currCtx, repo, apigen.InternalCreateBranchProtectionRuleJSONRequestBody{
 				Pattern: "main",
 			})
 			if err != nil {
 				t.Fatal(err)
 			}
 			if resp == nil {
-				t.Fatal("CreateBranchProtectionRuleWithResponse got no response")
+				t.Fatal("InternalCreateBranchProtectionRuleWithResponse got no response")
 			}
 			if resp.StatusCode() != respPreflight.StatusCode() {
-				t.Fatalf("CreateBranchProtectionRuleWithResponse and preflight shouls return the same unauthorized status expected %d, got %d", respPreflight.StatusCode(), resp.StatusCode())
+				t.Fatalf("InternalCreateBranchProtectionRuleWithResponse and preflight should return the same unauthorized status expected %d, got %d", respPreflight.StatusCode(), resp.StatusCode())
 			}
 		})
 	}
@@ -4437,7 +4455,7 @@ func TestController_GarbageCollectionRules(t *testing.T) {
 			}
 
 			// the result of an actual call to the endpoint should have the same result
-			resp, err := tc.clt.SetGarbageCollectionRulesWithResponse(currCtx, repo, apigen.SetGarbageCollectionRulesJSONRequestBody{
+			resp, err := tc.clt.SetGCRulesWithResponse(currCtx, repo, apigen.SetGCRulesJSONRequestBody{
 				Branches: []apigen.GarbageCollectionRule{{BranchId: "main", RetentionDays: 1}}, DefaultRetentionDays: 5,
 			})
 			if err != nil {
diff --git a/pkg/catalog/catalog.go b/pkg/catalog/catalog.go
index a709805d225..a1baa43323a 100644
--- a/pkg/catalog/catalog.go
+++ b/pkg/catalog/catalog.go
@@ -2088,20 +2088,12 @@ func (c *Catalog) GetBranchProtectionRules(ctx context.Context, repositoryID str
 	return c.Store.GetBranchProtectionRules(ctx, repository)
 }
 
-func (c *Catalog) DeleteBranchProtectionRule(ctx context.Context, repositoryID string, pattern string) error {
+func (c *Catalog) SetBranchProtectionRules(ctx context.Context, repositoryID string, rules *graveler.BranchProtectionRules, ifMatchETag *string) error {
 	repository, err := c.getRepository(ctx, repositoryID)
 	if err != nil {
 		return err
 	}
-	return c.Store.DeleteBranchProtectionRule(ctx, repository, pattern)
-}
-
-func (c *Catalog) CreateBranchProtectionRule(ctx context.Context, repositoryID string, pattern string, blockedActions []graveler.BranchProtectionBlockedAction) error {
-	repository, err := c.getRepository(ctx, repositoryID)
-	if err != nil {
-		return err
-	}
-	return c.Store.CreateBranchProtectionRule(ctx, repository, pattern, blockedActions)
+	return c.Store.SetBranchProtectionRules(ctx, repository, rules, ifMatchETag)
 }
 
 func (c *Catalog) PrepareExpiredCommits(ctx context.Context, repositoryID string) (*graveler.GarbageCollectionRunMetadata, error) {
diff --git a/pkg/catalog/interface.go b/pkg/catalog/interface.go
index bb19eaa8f2d..e36df87360c 100644
--- a/pkg/catalog/interface.go
+++ b/pkg/catalog/interface.go
@@ -164,8 +164,7 @@ type Interface interface {
 	PrepareGCUncommitted(ctx context.Context, repositoryID string, mark *GCUncommittedMark) (*PrepareGCUncommittedInfo, error)
 
 	GetBranchProtectionRules(ctx context.Context, repositoryID string) (*graveler.BranchProtectionRules, string, error)
-	DeleteBranchProtectionRule(ctx context.Context, repositoryID string, pattern string) error
-	CreateBranchProtectionRule(ctx context.Context, repositoryID string, pattern string, blockedActions []graveler.BranchProtectionBlockedAction) error
+	SetBranchProtectionRules(ctx context.Context, repositoryID string, rules *graveler.BranchProtectionRules, ifMatchETag *string) error
 
 	// SetLinkAddress to validate single use limited in time of a given physical address
 	SetLinkAddress(ctx context.Context, repository, token string) error
diff --git a/pkg/graveler/branch/protection_manager.go b/pkg/graveler/branch/protection_manager.go
index 0c09f22593b..9aa183acf3d 100644
--- a/pkg/graveler/branch/protection_manager.go
+++ b/pkg/graveler/branch/protection_manager.go
@@ -84,14 +84,18 @@ func (m *ProtectionManager) Get(ctx context.Context, repository *graveler.Reposi
 }
 
 func (m *ProtectionManager) GetRules(ctx context.Context, repository *graveler.RepositoryRecord) (*graveler.BranchProtectionRules, string, error) {
-	rules, eTag, err := m.settingManager.GetLatest(ctx, repository, ProtectionSettingKey, &graveler.BranchProtectionRules{})
-	if errors.Is(err, graveler.ErrNotFound) {
-		return &graveler.BranchProtectionRules{}, "", nil
-	}
+	rulesMsg, eTag, err := m.settingManager.GetLatest(ctx, repository, ProtectionSettingKey, &graveler.BranchProtectionRules{})
 	if err != nil {
 		return nil, "", err
 	}
-	return rules.(*graveler.BranchProtectionRules), eTag, nil
+	if proto.Size(rulesMsg) == 0 {
+		return &graveler.BranchProtectionRules{}, eTag, graveler.ErrNotFound
+	}
+	return rulesMsg.(*graveler.BranchProtectionRules), eTag, nil
+}
+
+func (m *ProtectionManager) SetRules(ctx context.Context, repository *graveler.RepositoryRecord, rules *graveler.BranchProtectionRules, ifMatchETag *string) error {
+	return m.settingManager.SaveIf(ctx, repository, ProtectionSettingKey, rules, ifMatchETag)
 }
 
 func (m *ProtectionManager) IsBlocked(ctx context.Context, repository *graveler.RepositoryRecord, branchID graveler.BranchID, action graveler.BranchProtectionBlockedAction) (bool, error) {
diff --git a/pkg/graveler/graveler.go b/pkg/graveler/graveler.go
index 686875d35b5..029b8025afc 100644
--- a/pkg/graveler/graveler.go
+++ b/pkg/graveler/graveler.go
@@ -612,13 +612,10 @@ type VersionController interface {
 	// GetBranchProtectionRules return all branch protection rules for the repository
 	GetBranchProtectionRules(ctx context.Context, repository *RepositoryRecord) (*BranchProtectionRules, string, error)
 
-	// DeleteBranchProtectionRule deletes the branch protection rule for the given pattern,
-	// or return ErrRuleNotExists if no such rule exists.
-	DeleteBranchProtectionRule(ctx context.Context, repository *RepositoryRecord, pattern string) error
-
-	// CreateBranchProtectionRule creates a rule for the given name pattern,
-	// or returns ErrRuleAlreadyExists if there is already a rule for the pattern.
-	CreateBranchProtectionRule(ctx context.Context, repository *RepositoryRecord, pattern string, blockedActions []BranchProtectionBlockedAction) error
+	// SetBranchProtectionRules sets the branch protection rules for the repository.
+	// If ifMatchETag is not nil, the update will only succeed if the current ETag matches the given one.
+	// Otherwise, ErrPreconditionFailed is returned.
+	SetBranchProtectionRules(ctx context.Context, repository *RepositoryRecord, rules *BranchProtectionRules, ifMatchETag *string) error
 
 	// SetLinkAddress stores the address token under the repository. The token will be valid for addressTokenTime.
 	// or return ErrAddressTokenAlreadyExists if a token already exists.
@@ -1499,12 +1496,12 @@ func (g *Graveler) GetBranchProtectionRules(ctx context.Context, repository *Rep
 	return g.protectedBranchesManager.GetRules(ctx, repository)
 }
 
-func (g *Graveler) DeleteBranchProtectionRule(ctx context.Context, repository *RepositoryRecord, pattern string) error {
-	return g.protectedBranchesManager.Delete(ctx, repository, pattern)
-}
-
-func (g *Graveler) CreateBranchProtectionRule(ctx context.Context, repository *RepositoryRecord, pattern string, blockedActions []BranchProtectionBlockedAction) error {
-	return g.protectedBranchesManager.Add(ctx, repository, pattern, blockedActions)
+func (g *Graveler) SetBranchProtectionRules(ctx context.Context, repository *RepositoryRecord, rules *BranchProtectionRules, ifMatchETag *string) error {
+	err := g.protectedBranchesManager.SetRules(ctx, repository, rules, ifMatchETag)
+	if errors.Is(err, kv.ErrPredicateFailed) {
+		return ErrPreconditionFailed
+	}
+	return err
 }
 
 // getFromStagingArea returns the most updated value of a given key in a branch staging area.
@@ -3247,6 +3244,9 @@ type ProtectedBranchesManager interface {
 	Get(ctx context.Context, repository *RepositoryRecord, branchNamePattern string) ([]BranchProtectionBlockedAction, error)
 	// GetRules returns all branch protection rules for the repository
 	GetRules(ctx context.Context, repository *RepositoryRecord) (*BranchProtectionRules, string, error)
+	// SetRules sets the branch protection rules for the repository.
+	// If the given ETag does not match the current ETag, returns ErrPreconditionFailed.
+	SetRules(ctx context.Context, repository *RepositoryRecord, rules *BranchProtectionRules, ifMatchETag *string) error
 	// IsBlocked returns whether the action is blocked by any branch protection rule matching the given branch.
 	IsBlocked(ctx context.Context, repository *RepositoryRecord, branchID BranchID, action BranchProtectionBlockedAction) (bool, error)
 }
diff --git a/pkg/graveler/mock/graveler.go b/pkg/graveler/mock/graveler.go
index 1ede1e5c4ca..339d1c794df 100644
--- a/pkg/graveler/mock/graveler.go
+++ b/pkg/graveler/mock/graveler.go
@@ -275,20 +275,6 @@ func (mr *MockVersionControllerMockRecorder) CreateBranch(ctx, repository, branc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateBranch", reflect.TypeOf((*MockVersionController)(nil).CreateBranch), ctx, repository, branchID, ref)
 }
 
-// CreateBranchProtectionRule mocks base method.
-func (m *MockVersionController) CreateBranchProtectionRule(ctx context.Context, repository *graveler.RepositoryRecord, pattern string, blockedActions []graveler.BranchProtectionBlockedAction) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateBranchProtectionRule", ctx, repository, pattern, blockedActions)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateBranchProtectionRule indicates an expected call of CreateBranchProtectionRule.
-func (mr *MockVersionControllerMockRecorder) CreateBranchProtectionRule(ctx, repository, pattern, blockedActions interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateBranchProtectionRule", reflect.TypeOf((*MockVersionController)(nil).CreateBranchProtectionRule), ctx, repository, pattern, blockedActions)
-}
-
 // CreateRepository mocks base method.
 func (m *MockVersionController) CreateRepository(ctx context.Context, repositoryID graveler.RepositoryID, storageNamespace graveler.StorageNamespace, branchID graveler.BranchID) (*graveler.RepositoryRecord, error) {
 	m.ctrl.T.Helper()
@@ -332,20 +318,6 @@ func (mr *MockVersionControllerMockRecorder) DeleteBranch(ctx, repository, branc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteBranch", reflect.TypeOf((*MockVersionController)(nil).DeleteBranch), ctx, repository, branchID)
 }
 
-// DeleteBranchProtectionRule mocks base method.
-func (m *MockVersionController) DeleteBranchProtectionRule(ctx context.Context, repository *graveler.RepositoryRecord, pattern string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteBranchProtectionRule", ctx, repository, pattern)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteBranchProtectionRule indicates an expected call of DeleteBranchProtectionRule.
-func (mr *MockVersionControllerMockRecorder) DeleteBranchProtectionRule(ctx, repository, pattern interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteBranchProtectionRule", reflect.TypeOf((*MockVersionController)(nil).DeleteBranchProtectionRule), ctx, repository, pattern)
-}
-
 // DeleteExpiredImports mocks base method.
 func (m *MockVersionController) DeleteExpiredImports(ctx context.Context, repository *graveler.RepositoryRecord) error {
 	m.ctrl.T.Helper()
@@ -836,6 +808,20 @@ func (mr *MockVersionControllerMockRecorder) SaveGarbageCollectionCommits(ctx, r
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveGarbageCollectionCommits", reflect.TypeOf((*MockVersionController)(nil).SaveGarbageCollectionCommits), ctx, repository)
 }
 
+// SetBranchProtectionRules mocks base method.
+func (m *MockVersionController) SetBranchProtectionRules(ctx context.Context, repository *graveler.RepositoryRecord, rules *graveler.BranchProtectionRules, ifMatchETag *string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetBranchProtectionRules", ctx, repository, rules, ifMatchETag)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetBranchProtectionRules indicates an expected call of SetBranchProtectionRules.
+func (mr *MockVersionControllerMockRecorder) SetBranchProtectionRules(ctx, repository, rules, ifMatchETag interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetBranchProtectionRules", reflect.TypeOf((*MockVersionController)(nil).SetBranchProtectionRules), ctx, repository, rules, ifMatchETag)
+}
+
 // SetGarbageCollectionRules mocks base method.
 func (m *MockVersionController) SetGarbageCollectionRules(ctx context.Context, repository *graveler.RepositoryRecord, rules *graveler.GarbageCollectionRules) error {
 	m.ctrl.T.Helper()
@@ -2957,3 +2943,17 @@ func (mr *MockProtectedBranchesManagerMockRecorder) IsBlocked(ctx, repository, b
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsBlocked", reflect.TypeOf((*MockProtectedBranchesManager)(nil).IsBlocked), ctx, repository, branchID, action)
 }
+
+// SetRules mocks base method.
+func (m *MockProtectedBranchesManager) SetRules(ctx context.Context, repository *graveler.RepositoryRecord, rules *graveler.BranchProtectionRules, ifMatchETag *string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetRules", ctx, repository, rules, ifMatchETag)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetRules indicates an expected call of SetRules.
+func (mr *MockProtectedBranchesManagerMockRecorder) SetRules(ctx, repository, rules, ifMatchETag interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetRules", reflect.TypeOf((*MockProtectedBranchesManager)(nil).SetRules), ctx, repository, rules, ifMatchETag)
+}
diff --git a/pkg/graveler/settings/manager.go b/pkg/graveler/settings/manager.go
index 8dc332340b7..f58787224cb 100644
--- a/pkg/graveler/settings/manager.go
+++ b/pkg/graveler/settings/manager.go
@@ -68,6 +68,21 @@ func (m *Manager) Save(ctx context.Context, repository *graveler.RepositoryRecor
 	return kv.SetMsg(ctx, m.store, graveler.RepoPartition(repository), []byte(graveler.SettingsPath(key)), setting)
 }
 
+// SaveIf persists the given setting under the given repository and key. Overrides settings key in KV Store.
+// The setting is persisted only if the given ETag matches the ETag of the current setting.
+// Otherwise, ErrPreconditionFailed is returned.
+func (m *Manager) SaveIf(ctx context.Context, repository *graveler.RepositoryRecord, key string, setting proto.Message, ifMatchETag *string) error {
+	logSetting(logging.FromContext(ctx), repository.RepositoryID, key, setting, "saving repository-level setting")
+	if ifMatchETag == nil {
+		return m.Save(ctx, repository, key, setting)
+	}
+	decodedEtag, err := base64.StdEncoding.DecodeString(*ifMatchETag)
+	if err != nil {
+		return fmt.Errorf("decode etag: %w", err)
+	}
+	return kv.SetMsgIf(ctx, m.store, graveler.RepoPartition(repository), []byte(graveler.SettingsPath(key)), setting, decodedEtag)
+}
+
 func (m *Manager) getWithPredicate(ctx context.Context, repo *graveler.RepositoryRecord, key string, data proto.Message) (kv.Predicate, error) {
 	pred, err := kv.GetMsg(ctx, m.store, graveler.RepoPartition(repo), []byte(graveler.SettingsPath(key)), data)
 	if err != nil {
@@ -120,14 +135,10 @@ func (m *Manager) Get(ctx context.Context, repository *graveler.RepositoryRecord
 	}
 	return setting.(proto.Message), eTag, nil
 }
-func (m *Manager) Update(ctx context.Context, repository *graveler.RepositoryRecord, key string, settingTemplate proto.Message, update updateFunc) error {
-	return m.UpdateIf(ctx, repository, key, settingTemplate, update, nil)
-}
 
-// UpdateIf atomically gets a setting, performs the update function, and persists the setting to the store.
+// Update atomically gets a setting, performs the update function, and persists the setting to the store.
 // The settingTemplate parameter is used to determine the type passed to the update function.
-// The ifMatchETag parameter is used to perform a conditional update. If the ETag does not match the current ETag of the setting, the update fails.
-func (m *Manager) UpdateIf(ctx context.Context, repository *graveler.RepositoryRecord, key string, settingTemplate proto.Message, update updateFunc, ifMatchETag *string) error {
+func (m *Manager) Update(ctx context.Context, repository *graveler.RepositoryRecord, key string, settingTemplate proto.Message, update updateFunc) error {
 	const (
 		maxIntervalSec = 2
 		maxElapsedSec  = 5
@@ -144,13 +155,7 @@ func (m *Manager) UpdateIf(ctx context.Context, repository *graveler.RepositoryR
 		} else if err != nil {
 			return backoff.Permanent(err)
 		}
-		if ifMatchETag != nil {
-			predBytes, err := base64.StdEncoding.DecodeString(*ifMatchETag)
-			if err != nil {
-				return backoff.Permanent(err)
-			}
-			pred = kv.Predicate(predBytes)
-		}
+
 		logSetting(logging.FromContext(ctx), repository.RepositoryID, key, data, "update repository-level setting")
 		newData, err := update(data)
 		if err != nil {
diff --git a/pkg/graveler/settings/manager_test.go b/pkg/graveler/settings/manager_test.go
index f7bfd58b0a4..9fa8443ddce 100644
--- a/pkg/graveler/settings/manager_test.go
+++ b/pkg/graveler/settings/manager_test.go
@@ -55,23 +55,26 @@ func TestSaveAndGet(t *testing.T) {
 	firstSettings := &settings.ExampleSettings{ExampleInt: 5, ExampleStr: "hello", ExampleMap: map[string]int32{"boo": 6}}
 	err := m.Save(ctx, repository, "settingKey", firstSettings)
 	testutil.Must(t, err)
-	gotSettings, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag, err := m.Get(ctx, repository, "settingKey", emptySettings)
 	testutil.Must(t, err)
 	if diff := deep.Equal(firstSettings, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
 	}
+	if eTag == "" {
+		t.Fatal("expected non-empty eTag")
+	}
 	secondSettings := &settings.ExampleSettings{ExampleInt: 15, ExampleStr: "hi", ExampleMap: map[string]int32{"boo": 16}}
 	err = m.Save(ctx, repository, "settingKey", secondSettings)
 	testutil.Must(t, err)
 	// the result should be cached, and we should get the first settings:
-	gotSettings, err = m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag, err = m.Get(ctx, repository, "settingKey", emptySettings)
 	testutil.Must(t, err)
 	if diff := deep.Equal(firstSettings, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
 	}
 	// after clearing the mc, we should get the new settings:
 	mc.c = make(map[interface{}]interface{})
-	gotSettings, err = m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag, err = m.Get(ctx, repository, "settingKey", emptySettings)
 	testutil.Must(t, err)
 	if diff := deep.Equal(secondSettings, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
@@ -98,7 +101,10 @@ func TestUpdate(t *testing.T) {
 	}
 	emptySettings := &settings.ExampleSettings{}
 	require.NoError(t, m.Update(ctx, repository, "settingKey", emptySettings, update))
-	gotSettings, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag1, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	if eTag1 == "" {
+		t.Fatal("expected non-empty eTag")
+	}
 	require.NoError(t, err)
 	if diff := deep.Equal(validationData, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
@@ -121,7 +127,10 @@ func TestUpdate(t *testing.T) {
 		return &newSettings, nil
 	}
 	require.NoError(t, m.Update(ctx, repository, "settingKey", emptySettings, update))
-	gotSettings, err = m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag2, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	if eTag2 == "" || eTag2 == eTag1 {
+		t.Fatal("expected non-empty eTag2 and different from eTag1")
+	}
 	require.NoError(t, err)
 	if diff := deep.Equal(initialData, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
@@ -136,7 +145,7 @@ func TestUpdate(t *testing.T) {
 		return &newSettings, nil
 	}
 	require.ErrorIs(t, m.Update(ctx, repository, "settingKey", emptySettings, update), graveler.ErrTooManyTries)
-	gotSettings, err = m.GetLatest(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag3, err := m.GetLatest(ctx, repository, "settingKey", emptySettings)
 	require.NoError(t, err)
 	if diff := deep.Equal(validationData, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
@@ -148,7 +157,10 @@ func TestUpdate(t *testing.T) {
 		return nil, testErr
 	}
 	require.ErrorIs(t, m.Update(ctx, repository, "settingKey", emptySettings, update), testErr)
-	gotSettings, err = m.GetLatest(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag4, err := m.GetLatest(ctx, repository, "settingKey", emptySettings)
+	if eTag4 != eTag3 {
+		t.Fatal("expected eTag4 to be equal to eTag3")
+	}
 	require.NoError(t, err)
 	if diff := deep.Equal(validationData, gotSettings); diff != nil {
 		t.Fatal("got unexpected settings:", diff)
@@ -192,7 +204,10 @@ func TestMultipleUpdates(t *testing.T) {
 	}
 	err = wg.Wait().ErrorOrNil()
 	testutil.Must(t, err)
-	gotSettings, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	if eTag == "" {
+		t.Fatal("expected non-empty eTag")
+	}
 	testutil.Must(t, err)
 	expectedSettings.ExampleInt += IncrementCount
 	expectedSettings.ExampleMap["boo"] += IncrementCount
@@ -206,11 +221,14 @@ func TestEmpty(t *testing.T) {
 	ctx := context.Background()
 	m, _ := prepareTest(t, ctx, nil, nil)
 	emptySettings := &settings.ExampleSettings{}
-	_, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	_, eTag, err := m.Get(ctx, repository, "settingKey", emptySettings)
 	// the key was not set, an error should be returned
 	if !errors.Is(err, graveler.ErrNotFound) {
 		t.Fatalf("expected error %v, got %v", graveler.ErrNotFound, err)
 	}
+	if eTag != "" {
+		t.Fatal("expected empty eTag")
+	}
 	// when using Update on an unset key, the update function gets an empty setting object to operate on
 	err = m.Update(ctx, repository, "settingKey", emptySettings, func(setting proto.Message) (proto.Message, error) {
 		newSettings := proto.Clone(setting).(*settings.ExampleSettings)
@@ -223,7 +241,7 @@ func TestEmpty(t *testing.T) {
 		return newSettings, nil
 	})
 	testutil.Must(t, err)
-	gotSettings, err := m.Get(ctx, repository, "settingKey", emptySettings)
+	gotSettings, eTag, err := m.Get(ctx, repository, "settingKey", emptySettings)
 	testutil.Must(t, err)
 	expectedSettings := &settings.ExampleSettings{ExampleInt: 1, ExampleMap: map[string]int32{"boo": 1}}
 	if diff := deep.Equal(expectedSettings, gotSettings); diff != nil {
diff --git a/pkg/samplerepo/samplecontent.go b/pkg/samplerepo/samplecontent.go
index cbda2829356..a8deb4d8aae 100644
--- a/pkg/samplerepo/samplecontent.go
+++ b/pkg/samplerepo/samplecontent.go
@@ -119,5 +119,12 @@ func PopulateSampleRepo(ctx context.Context, repo *catalog.Repository, cat catal
 
 func AddBranchProtection(ctx context.Context, repo *catalog.Repository, cat catalog.Interface) error {
 	// Set branch protection on the main branch
-	return cat.CreateBranchProtectionRule(ctx, repo.Name, repo.DefaultBranch, []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_COMMIT})
+	rules, eTag, err := cat.GetBranchProtectionRules(ctx, repo.Name)
+	if err != nil {
+		return err
+	}
+	rules.BranchPatternToBlockedActions[repo.DefaultBranch] = &graveler.BranchProtectionBlockedActions{
+		Value: []graveler.BranchProtectionBlockedAction{graveler.BranchProtectionBlockedAction_COMMIT},
+	}
+	return cat.SetBranchProtectionRules(ctx, repo.Name, rules, swag.String(eTag))
 }
diff --git a/webui/src/lib/api/index.js b/webui/src/lib/api/index.js
index d2959788319..db104218283 100644
--- a/webui/src/lib/api/index.js
+++ b/webui/src/lib/api/index.js
@@ -847,7 +847,7 @@ class Actions {
 
 class Retention {
     async getGCPolicy(repoID) {
-        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/gc/rules`);
+        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/settings/gc_rules`);
         if (response.status === 404) {
             throw new NotFoundError('policy not found')
         }
@@ -866,8 +866,8 @@ class Retention {
     }
 
     async setGCPolicy(repoID, policy) {
-        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/gc/rules`, {
-            method: 'POST',
+        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/settings/gc_rules`, {
+            method: 'PUT',
             body: policy
         });
         if (response.status !== 204) {
@@ -877,7 +877,7 @@ class Retention {
     }
 
     async deleteGCPolicy(repoID) {
-        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/gc/rules`, {
+        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/settings/gc_rules`, {
             method: 'DELETE',
         });
         if (response.status !== 204) {
@@ -980,14 +980,17 @@ class Config {
 
 class BranchProtectionRules {
     async getRules(repoID) {
-        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/branch_protection`);
+        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/settings/branch_protection`);
         if (response.status === 404) {
             throw new NotFoundError('branch protection rules not found')
         }
         if (response.status !== 200) {
             throw new Error(`could not get branch protection rules: ${await extractError(response)}`);
         }
-        return response.json();
+        return {
+            'checksum': response.headers.get('ETag'),
+            'rules': await response.json()
+        }
     }
 
     async createRulePreflight(repoID) {
@@ -996,11 +999,11 @@ class BranchProtectionRules {
 
     }
 
-    async createRule(repoID, pattern) {
-        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/branch_protection`, {
-            method: 'POST',
-            body: JSON.stringify({pattern: pattern})
-        });
+    async setRules(repoID, rules, lastKnownChecksum) {
+        const response = await apiRequest(`/repositories/${encodeURIComponent(repoID)}/settings/branch_protection`, {
+            method: 'PUT',
+            body: JSON.stringify(rules),
+        }, {'ETag': lastKnownChecksum});
         if (response.status !== 204) {
             throw new Error(`could not create protection rule: ${await extractError(response)}`);
         }
diff --git a/webui/src/lib/onboarding/repoOnboardingService.tsx b/webui/src/lib/onboarding/repoOnboardingService.tsx
index 9d515e3c9cf..b12505b20da 100644
--- a/webui/src/lib/onboarding/repoOnboardingService.tsx
+++ b/webui/src/lib/onboarding/repoOnboardingService.tsx
@@ -159,8 +159,8 @@ export const getRepoOnboardingSteps = (
     showStep: () => true,
     isCompleted: async () => {
       try {
-        const rules = await branchProtectionRules.getRules(currentRepo);
-        return rules?.length > 0;
+        const rulesResponse = await branchProtectionRules.getRules(currentRepo);
+        return rulesResponse['rules']?.length > 0;
       } catch (e) {
         if (e instanceof NotFoundError) {
           return false;
diff --git a/webui/src/pages/repositories/repository/settings/branches.jsx b/webui/src/pages/repositories/repository/settings/branches.jsx
index 84d5d03279d..1874b58f9ad 100644
--- a/webui/src/pages/repositories/repository/settings/branches.jsx
+++ b/webui/src/pages/repositories/repository/settings/branches.jsx
@@ -19,7 +19,7 @@ const SettingsContainer = () => {
     const [actionError, setActionError] = useState(null);
     const [deleteButtonDisabled, setDeleteButtonDisabled] = useState(false)
 
-    const {response: rules, error: rulesError, loading: rulesLoading} = useAPI(async () => {
+    const {response: rulesResponse, error: rulesError, loading: rulesLoading} = useAPI(async () => {
         return branchProtectionRules.getRules(repo.id)
     }, [repo, refresh])
     if (error) return <AlertError error={error}/>;
@@ -47,7 +47,7 @@ const SettingsContainer = () => {
                     <Card className={"w-100 rounded border-0"}>
                         <Card.Body className={"p-0 rounded"}>
                             <ListGroup>
-                                {rules && rules.length > 0 ? rules.map((r) => {
+                                {rulesResponse && rulesResponse['rules'].length > 0 ? rulesResponse['rules'].map((r) => {
                                     return <ListGroup.Item key={r.pattern}>
                                         <div className="d-flex">
                                             <code>{r.pattern}</code>
@@ -69,13 +69,13 @@ const SettingsContainer = () => {
                     </Card>
                 </div>}
         </div>
-        <CreateRuleModal show={showCreateModal} hideFn={() => setShowCreateModal(false)} onSuccess={() => {
+        <CreateRuleModal show={showCreateModal} hideFn={() => setShowCreateModal(false)} currentRulesResponse={rulesResponse} onSuccess={() => {
             setRefresh(!refresh)
             setShowCreateModal(false)
         }} repoID={repo.id}/>
     </>);
 }
-const CreateRuleModal = ({show, hideFn, onSuccess, repoID}) => {
+const CreateRuleModal = ({show, hideFn, onSuccess, repoID, currentRulesResponse}) => {
     const [error, setError] = useState(null);
     const [createButtonDisabled, setCreateButtonDisabled] = useState(true);
     const patternField = useRef(null);
@@ -86,7 +86,8 @@ const CreateRuleModal = ({show, hideFn, onSuccess, repoID}) => {
         }
         setError(null)
         setCreateButtonDisabled(true)
-        branchProtectionRules.createRule(repoID, pattern).then(onSuccess).catch(err => {
+        currentRulesResponse['rules'].push({pattern})
+        branchProtectionRules.setRules(repoID, currentRulesResponse['rules'], currentRulesResponse['ETag']).then(onSuccess).catch(err => {
             setError(err)
             setCreateButtonDisabled(false)
         })