# GitHub Copilot code review API: controls, permissions and limits

> GitHub's November 6 code review update adds API management and comment attribution. The enterprise, organization and repository controls differ—and billing stays outside the settings API.

- Published: Nov 10, 2026
- Author: PiRouter Team, Engineering
- Tags: agents, coding-agents, security
- Canonical: https://pirouter.ai/blog/copilot-code-review-api-permissions

---
GitHub's **November 6 Copilot code review update** makes some review settings manageable through APIs and makes review comments easier to identify and attribute. It does **not** make every review control programmable: the [configuration guide](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review/) explicitly excludes maximum review effort, billing, and approvals from the documented settings API. Before automating a rollout, separate the setting you want to change from the administrative level, credential, and tool access it requires.

The [GitHub changelog](https://github.blog/changelog/2026-11-06-copilot-code-review-api-management-and-review-overview-updates/) says the update is available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. Those are availability categories, not a claim that every account may edit enterprise settings. The announcement describes REST and GraphQL management; it does not establish that each setting has an equivalent endpoint in both interfaces. This article maps the published boundaries, not a tested request sequence.

## What can the Copilot code review settings API manage?

The answer depends on **whose policy the setting belongs to**. GitHub's changelog and [code review configuration guide](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review/) describe three scopes:

| Administrative scope | Documented API-manageable decisions |
|---|---|
| Enterprise | Enable or disable Copilot code review across organizations, or leave the choice to organization owners. |
| Organization | Enable or disable review where enterprise policy permits; set default review effort and runner configuration. |
| Repository | Set review effort and choose whether reviews use custom instructions and MCP servers. |

The hierarchy is not a set of three interchangeable toggles. Organization settings cannot override a decision managed by the enterprise. Nor should the **default review effort** be confused with **maximum review effort**: the first is among the documented organization controls; the latter is explicitly outside this settings API. The guide also excludes billing and whether Copilot approvals count toward merge requirements from API management. An automation that changes review effort still leaves those separate policy decisions to be handled in their documented settings surfaces.

The official guide says a review may be requested automatically through user settings, repository rulesets, or organization rulesets. More than one qualifying source still produces a single Copilot review. That matters when checking why a review ran: changing one repository setting alone may not remove an automatic review requested by another applicable rule.

![Enterprise, organization and repository settings scopes, credential restrictions, and controls excluded from the review settings API](/blog/images/copilot-code-review-api-permissions-scope-boundaries.png "Editorial map of the documented settings API, not a product screenshot. Source: [Copilot code review API update](https://github.blog/changelog/2026-11-06-copilot-code-review-api-management-and-review-overview-updates/)")

## Which credential works, and who pays for a review?

The changelog makes a narrow credential distinction. **Enterprise and organization settings endpoints**, including the organization runner endpoint, do **not** support GitHub Apps or fine-grained personal access tokens. **Repository settings endpoints** do support both; reading requires `Administration: read` and writing requires `Administration: write`. Classic personal access tokens need repository administrator access. Before selecting a credential, start with the official [Configuring Copilot code review with the API](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review#configuring-copilot-code-review-with-the-api) section and its linked [GraphQL API reference for Copilot](https://docs.github.com/en/graphql/reference/copilot). Locate the exact operation and check its current authentication and role requirements. If the documented credential requirements are unclear for your scope, stop before provisioning a token; the announcement alone is not a complete authentication guide.

Cost is a different control. The configuration guide says **Balanced and Max** review effort use more AI credits and may consume marginally more GitHub Actions minutes. Its organization billing settings distinguish two choices for usage tied to members with paid Copilot licenses. Under the default **Member** choice, review uses that member's entitlement and fails if their quota is exhausted. **Organization** bills the organization, requires AI credits paid usage to be enabled, and does not grant someone access to code review by itself. A budget is optional. These billing choices cannot be changed through the documented review-settings API.

The update says Copilot code review agent sessions now show AI credits consumed. That gives an operator a place to inspect usage for an actual review; it is not a published per-review price or a prediction of what a future pull request will cost. The number depends on the review and its settings.

## Does a review comment's MCP attribution prove the finding?

GitHub says reviews and comments now have explicit attribution fields, and comments can report which agent skills, MCP servers, and custom instructions were used as sources. Review-effort metadata is available **when present**, not guaranteed on every comment. Treat those fields as reported context for an audit, not independent proof that a tool caused a correct finding or that the tool was harmless.

MCP servers give the reviewer access to external tools. The [repository MCP configuration guide](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/configure-mcp-servers/) explains how that access is configured. A repository's MCP configuration is shared with Copilot cloud agent and code review; the GitHub and Playwright MCP servers are documented as enabled by default. Configured tools can be used autonomously without a prompt for each use. For code review, a server's `tools/list` response must annotate each usable tool with `annotations.readOnlyHint: true`; tools without that annotation are excluded. The annotation is an **admission rule**, not an access-control system or proof that an implementation only reads data. Restrict real credentials and explicitly allowlist the tools you intend to expose.

The same guide says this repository/custom-agent configuration supports MCP **tools**, not server resources or prompts, and does not currently support remote servers requiring OAuth. That qualification belongs to the documented configuration, not every possible Copilot client. To check a real review, GitHub directs administrators to the linked review session from a pull request and its setup logs, where started and called MCP tools are visible. We have not run that inspection on a live review.

For a pilot, identify the policy level, locate the supported operation in the official API reference, and confirm its authentication requirements before selecting a least-privilege credential. Use the repository MCP guide above to check the explicit tool allowlist. Before requesting the first review, confirm who will be billed and what entitlement or spending limit applies; afterward, inspect the review's reported sources and credit use. The new API controls improve administration, but they do not collapse permissions, costs, and review quality into one switch.

---

## Sources

### docs.github.com

- [configuration guide](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review/)
- [Configuring Copilot code review with the API](https://docs.github.com/en/copilot/how-tos/copilot-on-github/set-up-copilot/configure-code-review#configuring-copilot-code-review-with-the-api)
- [GraphQL API reference for Copilot](https://docs.github.com/en/graphql/reference/copilot)
- [repository MCP configuration guide](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/configure-mcp-servers/)

### github.blog

- [GitHub changelog](https://github.blog/changelog/2026-11-06-copilot-code-review-api-management-and-review-overview-updates/)