What changed in the API
GitHub's changelog lists three additions for people who already pull review data through the API:
- Attribution fields: explicit fields identify which reviews and comments came from Copilot.
- Review effort: you can see the effort level a review used, when that metadata is available. GitHub's wording is conditional, so don't assume every review carries it.
- Comment sources: you can see which skills, MCP servers, and custom instructions Copilot reported as sources for a comment.
The attribution fields make it easier for tooling to separate Copilot's output from human review traffic. The source metadata is Copilot's own report. GitHub doesn't claim it is complete or independently verified, so treat it as a debugging aid and not as an audit trail.
Who can manage what
Settings can now be read and updated through REST and GraphQL, split by role:
| Role | What the API can manage |
|---|---|
| Enterprise administrators | Enable or disable code review for all organizations, or leave the decision to organization administrators |
| Organization administrators | Code review enablement, default review effort, and runner configuration. Enterprise-managed settings can't be overridden |
| Repository administrators | Review effort, and whether reviews use custom instructions and MCP tools |
The REST API accepts the same effort levels as the web interface. Organization and repository settings responses list the levels available to the caller.
GitHub's configuration documentation says Copilot code review runs on GitHub Actions, using the standard GitHub-hosted runner by default, though teams can configure self-hosted or large runners. The organization runner endpoint therefore matters for teams with specific runner requirements.
Not everything is exposed. GitHub's documentation says maximum review effort, billing, and approvals aren't available through the API. Anyone planning a full policy-as-code setup will still need the web UI for those.
The authentication catch
This is the detail most likely to affect your automation design:
- Enterprise and organization settings endpoints, including the organization runner endpoint, don't support GitHub Apps or fine-grained personal access tokens.
- Repository settings endpoints support both. They need Administration: read permission to read settings and Administration: write permission to update them.
- Classic personal access tokens need repository administrator access.
In practice, a fleet-wide rollout script at the enterprise or organization level can't use a scoped GitHub App identity. It will need a different credential type. Repository-level automation can use least-privilege tokens. Check that before you design a scheduled job.
A more compact review overview
New overview comments keep findings together at the top. The changes are:
- The review effort used and any surveys move into a compact footer.
- Skipped files and content-excluded files share one "Files not reviewed" section, with filenames and linked exclusion reasons.
- Empty sections are left out, and long lists show an overflow count.
This builds on the September overview refresh. That refresh introduced "Resolved since last review" and "Previously missed" sections. Some context from that rollout: every review includes an approval assessment in the overview comment saying whether Copilot considers the pull request ready to merge.
GitHub also added more feedback options. After you give an overview a 👎, choose "Add a reason" and pick the main problem. Examples include an approval assessment you disagree with, a comment that is too verbose, or findings that are incorrect or nitpicky. GitHub says it uses this feedback to improve Copilot's findings. It doesn't publish any measured improvement, so a tidier layout shouldn't be read as better accuracy.
Other improvements
- Agent sessions for Copilot code review now show the AI credits consumed in a review. The changelog gives no formula or price.
- The "Automatically request Copilot code review" repository rule now supports the bypass list. Actors on the list won't get an automatic review.
- Organization and repository settings pages have clearer wording and layout.
- On later reviews of the same pull request, findings unrelated to your recent changes are collapsed and then hidden. GitHub describes this as a presentation change, not deletion.
- Balanced-effort reviews now use three reviewer models, with another model combining their findings. GitHub offers no benchmark, latency, or cost comparison.
The credits display is useful because GitHub's documentation says Balanced and Max reviews use more AI credits and may use slightly more Actions minutes. Balanced is also the Default level for new and existing repositories and organizations, per GitHub's earlier announcement. So teams that never picked a level are on Balanced, and the credit counter will show the consequences.
Bug fixes
- Billing and preview settings are preserved when you turn code review off and on again.
- Failed or timed-out reviews are retried once automatically. Copilot can switch to another eligible model if the preferred one is unavailable.
- GitHub Actions, Dependabot, and apps your organization or enterprise owns can request reviews on bot-authored pull requests again. This applies when "Block reviews requested with an external Copilot license" is on, as long as your organization pays for the review.
- Reviews no longer report a false failure just after starting and then discard their results.
- Reviews in progress during a service update get more time to finish.
- Review surveys no longer appear when your organization has opted out of feedback collection.
What administrators should do
- Audit your tokens. Decide which credential type each automation job will use, given the App and fine-grained token limits at the enterprise and organization levels.
- Check effort defaults. Read back the current effort levels through the settings responses, and compare them with what you intended.
- Review the bypass list. If you use the automatic review rule, confirm that exempt actors are the ones you want skipped.
- Watch credit use. Use the new credit display in agent sessions to see what Balanced reviews cost on your busiest repositories.
- Keep humans in the loop. A tidier overview and a three-model Balanced run are implementation changes. GitHub hasn't published evidence that they make reviews more correct.
Bottom line
This is an administrative and observability update, not a change in what Copilot can find. For teams that manage many repositories, the settings APIs and attribution fields are the useful parts, with the token limitation as the main constraint. The bug fixes, especially the automatic retry and the restored bot-authored pull request reviews, should reduce the number of unexplained failed reviews.