GitHub Copilot Adds API Controls for Code Reviews

Key takeaways

• GitHub's November 6, 2026 update lets administrators manage Copilot code review settings through REST and GraphQL APIs, from enterprise policy down to individual repositories.

• API authentication differs by scope: repository settings support GitHub Apps and fine-grained personal access tokens, but enterprise and organization settings endpoints do not.

• Teams should review permissions, approval rules and credit use before automating AI code reviews across repositories.

GitHub announced new API controls and workflow improvements for Copilot code review on November 6, 2026. The update affects Copilot Pro, Pro+, Max, Business and Enterprise customers, giving administrators more ways to configure reviews while adding clearer attribution, usage visibility and reliability fixes.

What happened on November 6?

The GitHub Changelog announcement says administrators can now read and update Copilot code review settings through REST and GraphQL APIs at three levels:

• Enterprise: Administrators can enable or disable Copilot code review for all organizations, or allow organization administrators to make that decision.

• Organization: Administrators can control whether reviews are enabled, set the default review effort and configure the runner used by Copilot.

• Repository: Administrators can set review effort and decide whether reviews can use custom instructions and Model Context Protocol (MCP) tools. MCP is a standard that lets AI systems connect to external tools and data sources.

The API responses also provide more information about Copilot's work. Teams can identify Copilot reviews and comments, see the review effort used when that metadata is available, and inspect which skills, MCP servers or custom instructions Copilot reported as sources for a comment.

There is an important authentication distinction. GitHub says enterprise and organization settings endpoints, including the organization runner endpoint, do not support GitHub Apps or fine-grained personal access tokens. Repository settings endpoints support both, with Administration: read required to retrieve settings and Administration: write required to change them. Classic personal access tokens require repository administrator access.

GitHub also changed the review overview comment. Findings are kept together near the top, while review effort and surveys move to a compact footer. Skipped and excluded files appear in one “Files not reviewed” section, empty sections are removed, and long lists show an overflow count.

Other changes include showing AI credits consumed in code review agent sessions, adding a bypass list to automatic review rules, and hiding findings on later reviews when they are unrelated to recent pull-request changes. Balanced reviews now use three reviewer models, followed by another model that combines their findings.

The release also includes reliability and billing fixes. Failed or timed-out reviews are retried once automatically, Copilot can switch to another eligible model if its preferred model is unavailable, and billing and preview settings are preserved when code review is turned off and on again. GitHub says reviews should no longer report a false failure immediately after starting.

Independent coverage from UnderCode News also describes the expanded administrative controls and reliability changes.

Why the API changes matter for engineering teams

Analysis: The biggest practical change is that Copilot code review settings can now be managed as part of an organization's existing automation. Teams that operate many repositories can use scripts and internal tooling to apply review settings more consistently instead of relying only on administrators to make changes manually in GitHub's interface.

The attribution fields are also useful for governance. When a reviewer asks why Copilot flagged a change, teams may be able to see which custom instructions, skills or MCP servers Copilot reported using. That gives engineers more context when auditing a comment or investigating an unexpected recommendation.

But attribution is not proof that a finding is correct. AI-generated reviews can still miss defects or raise findings that do not hold up under testing. Security-sensitive changes, access-control logic and production code still need appropriate human review and automated tests.

This release is part of a wider contest to own more of the software development workflow. Big Zero has covered OpenAI's planned acquisition of Pierre's code storage and review tools and AI-assisted Linux vulnerability research. GitHub's update takes a different route: it adds administrative control and visibility to an established code-review product rather than announcing a new coding agent.

What should GitHub Copilot administrators do now?

Teams already using Copilot code review should check their settings before building automation around the new endpoints.

1. Map who controls each setting. Confirm which policies are managed at the enterprise, organization and repository levels. A lower-level administrator cannot override a setting controlled by the level above.

2. Choose the right authentication method. Repository-level automation can use GitHub Apps or fine-grained personal access tokens with the required Administration permission. Enterprise and organization settings endpoints need a different supported authentication approach.

3. Start with a limited rollout. Test API changes against a small set of repositories before applying them broadly. Check that the review effort and permitted tools match each repository's risk.

4. Review custom instructions and MCP access. Keep the instructions and external tools available to Copilot limited to what the repository needs. Avoid granting broad access simply to make automated reviews easier to configure.

5. Track AI credit consumption. Use the new per-session visibility to understand which reviews consume credits, then compare usage with the value of the findings and fixes.

6. Keep human approval for important changes. Treat Copilot's comments as review input, not as automatic proof that code is safe. Retain required human approvals and tests for security-sensitive or production changes.

GitHub's configuration documentation explains how review effort, automatic reviews and other settings fit into repository and organization controls. Administrators should compare that guidance with their current rulesets before changing a production workflow.

What is still unknown and what should teams watch next?

GitHub has not published evidence in this announcement showing how much the changes improve review accuracy, reduce review time or lower the number of false positives. The use of three reviewer models in Balanced mode is a product-design detail, not a measured guarantee that every review will be more accurate.

The API also does not expose every code review setting. GitHub's configuration documentation says maximum review effort, billing choices and approval settings are not available through these API controls. Administrators who need to manage those policies should continue using the supported GitHub settings interface.

Teams should watch the official API documentation for endpoint details and changes, especially if they depend on enterprise-wide automation. They should also monitor their own review quality, AI credit use and developer feedback after enabling the new controls.

FAQ: GitHub Copilot code review API

Which Copilot plans get these updates?

GitHub lists Copilot Pro, Pro+, Max, Business and Enterprise as eligible plans. Administrators should check their organization's plan and feature settings before assuming every repository has code review enabled.

Can GitHub Apps manage all Copilot code review settings?

No. GitHub says GitHub Apps and fine-grained personal access tokens are not supported by the enterprise and organization settings endpoints covered by this update. Repository settings endpoints support both, subject to the required Administration permissions.

Can teams manage billing and maximum review effort through the new API?

No. GitHub's configuration documentation says maximum review effort, billing and approval settings are not available through these API controls. Teams must continue to manage those settings through the supported GitHub interface.

Does Copilot's new attribution show that a review finding is correct?

No. Attribution can show which skills, MCP servers or custom instructions Copilot reported using, but it does not verify the technical accuracy of a finding. Developers should reproduce and test important issues before changing or approving code.

Bottom line

GitHub's November 6 update gives engineering teams more control over where and how Copilot code review runs, but authentication restrictions and settings that remain outside the API matter. Administrators should test repository-level automation first, confirm permissions and keep human review in place for consequential code changes.