Copilot code review settings can now be managed through the GitHub REST and GraphQL APIs
Serguey Asael Shinder1 min readGitHub announced on 6 November that settings for Copilot code review can be managed through the REST and GraphQL APIs, from enterprise policy down to individual repositories. The update applies to the Copilot Pro, Pro+, Max, Business and Enterprise plans.
Reviews could already be requested through the REST API. Now Copilot's reviews and comments carry explicit attribution fields, the review effort used is exposed when that metadata exists, and a comment lists the skills, MCP servers and custom instructions Copilot reported as its sources. Enterprise administrators can switch code review on or off for all organisations or leave the choice to them; organisation administrators can set enablement, the default review effort and the runner configuration, without overriding enterprise settings; repository administrators can set review effort and whether reviews use custom instructions and MCP tools. GitHub warns that the enterprise and organisation endpoints do not support GitHub Apps or fine-grained personal access tokens, while the repository endpoints do, with Administration read or write permission.
The review overview comment is also more compact, with effort and surveys moved to a footer and skipped and excluded files merged into one Files not reviewed section. Other changes include showing the AI credits consumed by a review, bypass-list support in the rule that requests reviews automatically, and hiding earlier findings unrelated to recent changes on later reviews of the same pull request.
What it means
Moving review settings into an API lets organisations treat them like other policy, versioned and applied by script. The token limitation matters for automation: anything above repository level still needs a classic token or a person.