Copilot code review settings move into the REST and GraphQL APIs
GitHub Copilot code review settings can now be read and updated through the REST and GraphQL APIs, covering enterprise policy, organization defaults and per-repository configuration. The same update adds attribution fields that identify Copilot's reviews, compact review overviews, AI credit reporting and a batch of billing and reliability fixes.
Key points
- Code review settings can now be read and updated through REST and GraphQL, from enterprise policy down to single repositories.
- Enterprise-managed settings cannot be overridden at organization or repository level.
- API responses include attribution fields for Copilot reviews, the effort level used, and the skills, MCP servers and custom instructions behind a comment.
- Enterprise and organization settings endpoints do not support GitHub Apps or fine-grained personal access tokens; repository endpoints do.
- The Automatically request Copilot code review rule now respects the bypass list.
- Agent sessions show AI credits consumed, and failed or timed-out reviews are retried once with another eligible model if needed.
GitHub added API-level control for Copilot code review settings, so teams no longer need the web UI to configure reviews. Enterprise administrators can switch code review on or off across all organizations or hand that decision down; organization admins set enablement, default review effort and runner configuration; repository admins choose effort and whether custom instructions and MCP tools are used. Settings managed higher up cannot be overridden lower down.
The REST API also exposes attribution fields that mark which comments came from Copilot, which effort level a review used, and which skills, MCP servers or custom instructions it drew on. Review overviews are now more compact, with effort and surveys in a footer and skipped and excluded files grouped under one section. Sessions report AI credits consumed, and the automatic review rule now honors the bypass list.
Real-world use
- A platform team that wants to enforce one Copilot review policy across hundreds of repositories without clicking through settings pages.
- A CI pipeline that queries the API to confirm which review effort level ran and which MCP servers informed a comment before merging.
- An organization that pays for reviews on bot-authored pull requests and needs the bypass list to stay exempt from automatic reviews.
- A FinOps-minded team tracking AI credits consumed per Copilot review session to budget assistant usage.
Why it matters
Teams can now automate and audit Copilot review configuration instead of relying on manual UI changes, and attribution data makes it easier to see why Copilot flagged something before you trust or dismiss it.