GitHub adds REST and GraphQL APIs for Copilot code review
Enterprise, organisation and repository code review settings, plus review attribution and AI-credit data, are now scriptable instead of UI-only.
GitHub published new REST and GraphQL endpoints on 6 November for managing Copilot code review, a setup that previously meant clicking through the UI at every level. Enterprise admins can now enable or disable review org-wide through the API, organisation admins can set default effort levels and runner configuration, and repository admins can control effort and which tools or instructions Copilot uses, all without leaving a script or CI job.
The same update adds attribution fields that identify which comments came from Copilot, plus data on review effort consumed and which skills, MCP servers or custom instructions fed into a given review. The automatic review repository rule now respects bypass lists, and Copilot’s Balanced effort level draws on three reviewer models to synthesise its findings.
Why it matters: anyone running Copilot review across more than a handful of repos has had to configure and audit it by hand. This makes policy enforcement and cost tracking something you can script and check into your own tooling instead.
The caveat: enterprise and organisation endpoints don’t support GitHub Apps or fine-grained personal access tokens, only classic PATs or OAuth, so some automation setups will need reworking before this is usable.