How to Request GitHub Copilot Code Review via REST and GraphQL API

Introduction

This tutorial is for developers and platform engineers who want GitHub Copilot code review to start from their own tooling instead of only from the pull request UI. You will learn how to request a Copilot review through the REST API and the GraphQL API, how to control the review effort level per request, and how to wire review requests into a CI pipeline so no pull request ships without one.

Quick answer

POST /repos/{owner}/{repo}/pulls/{number}/requested_reviewers with {"reviewers":["copilot-pull-request-reviewer[bot]"]} to trigger a review, or use the GraphQL requestReviewsByLogin mutation with botLogins. Your token needs Pull requests: write, and the request can set the effort.

Evidence

On October 2, 2026, GitHub announced API support for Copilot code review in its changelog: “You can now request a GitHub Copilot code review through the REST and GraphQL APIs and set the review effort level for each request.” The change is generally available on Copilot Pro, Pro+, Max, Business, and Enterprise plans (GitHub Changelog, “Copilot code review: API support and new default effort level,” published 2026-10-02).

The same announcement confirmed a cost-relevant default change. GitHub announced on August 28, 2026 that the Default review effort level would map to Balanced for new and existing repositories and organizations, and the change took effect on September 28, 2026. Repositories that had explicitly selected Lite kept that selection (GitHub Changelog, published 2026-10-02). GitHub’s code-review configuration documentation states that Balanced performs deeper analysis of complex logic, security-sensitive code, and cross-service changes, and that “Balanced reviews use more AI credits, and may consume marginally more GitHub Actions minutes.” As a named cost anchor, GitHub’s code-review concept documentation, as quoted in a community write-up on October 7, 2026, estimates roughly $0.05 to $1 of AI credits for a Lite review and roughly $0.25 to $5 for a Balanced review, excluding Actions minutes (zemna.net, “Leave Copilot Approve Off,” 2026-10-07). The practical takeaway: any repository that never explicitly chose Lite is now paying the Balanced rate unless an administrator changes it.

Prerequisites

• A GitHub personal access token (classic or fine-grained) with the Pull requests: write permission. A fine-grained token needs the same permission scoped to the target repository.
• Copilot code review enabled for the repository or organization, and the requesting account on one of the supported plans: Copilot Pro, Pro+, Max, Business, or Enterprise.
• curl or the GitHub CLI (gh) installed. The examples use gh api, which handles authentication headers and the X-GitHub-Api-Version header for you.
• A pull request you can test against. Reviews do not fire on draft pull requests.

Step 1: Check the effective review effort level first

Before you automate review requests, know which effort level the API requests will use. Since September 28, 2026, Default means Balanced, and Balanced costs more AI credits than Lite. If your automation will review dozens of pull requests a day, check the repository setting and pin it deliberately.

GitHub’s October 2 changelog gives the exact click paths to change the level, and each level can override the one above it:

• Enterprise: In your enterprise settings, go to AI controls, then Agents, then Copilot code review.
• Organization: In your organization settings, go to Copilot, then Code review.
• Repository: In your repository settings, go to Copilot, then Code review.
• Personal: Click your profile picture, then go to Copilot settings, then Copilot, then Code review.

Set Lite explicitly here if your team wants the lighter, cheaper review as the baseline for API-triggered requests. GitHub’s announcement says you can also set the effort level per API request, so a script can override the default on calls that warrant deeper analysis. Until the per-request parameter is fully documented in the REST reference, treat the settings page as the source of truth for the default and the announcement as the authority that per-request overrides are supported.

Step 2: Request a review through the REST API

GitHub’s code-review how-to names the reviewer login for programmatic requests: copilot-pull-request-reviewer[bot]. The review-request endpoint is POST /repos/{owner}/{repo}/pulls/{pull_number}/requested_reviewers, and the reviewers array accepts reviewer logins. The REST reference documents a 201 Created response for this endpoint, which means GitHub accepted the reviewer request, not that the review has finished.

With gh:

OWNER="octo-org"
REPO="payments-service"
PR="42"

gh api repos/$OWNER/$REPO/pulls/$PR/requested_reviewers \
  --method POST \
  --input - <<'EOF'
{"reviewers":["copilot-pull-request-reviewer[bot]"]}
EOF

With curl:

curl -L -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer $GH_TOKEN" \
  -H "X-GitHub-Api-Version: 2026-03-10" \
  https://api.github.com/repos/$OWNER/$REPO/pulls/$PR/requested_reviewers \
  -d '{"reviewers":["copilot-pull-request-reviewer[bot]"]}'

Note two things about this call. First, the 201 response confirms acceptance only; check the pull request’s reviewers and activity before treating the review as complete. Second, GitHub’s REST reference warns that sending requests too quickly on this endpoint can hit secondary rate limiting, so put a small sleep between calls if you are fanning out across many pull requests in a loop.

Step 3: Request a review through the GraphQL API

Copilot’s reviewer identity is a Bot node in GitHub’s GraphQL schema, not a User. That is why the bot belongs in the dedicated botLogins field of the requestReviewsByLogin mutation, not in userLogins. Community testing has repeatedly shown that gh pr edit <n> --add-reviewer @copilot can print success while silently doing nothing, and that a REST 200 can be accepted without a visible review. The GraphQL mutation below is the reliable programmatic equivalent of clicking the review request in the web UI.

First resolve the pull request node ID:

PR_NODE=$(gh pr view 42 --repo "$OWNER/$REPO" --json id --jq .id)

Then send the mutation:

gh api graphql -f query='mutation($pr: ID!) {
  requestReviewsByLogin(input: {
    pullRequestId: $pr,
    botLogins: ["copilot-pull-request-reviewer[bot]"],
    union: true
  }) {
    clientMutationId
  }
}' -F pr="$PR_NODE"

The union: true flag adds Copilot without removing existing requested reviewers, so the mutation is safe to re-run when you push new commits. If you need to confirm the request landed, do not rely on gh pr view --json reviewRequests, which only enumerates User reviewers. Query GraphQL directly for bot reviewers instead:

gh api graphql -f query='query($o:String!,$r:String!,$n:Int!) {
  repository(owner:$o,name:$r) {
    pullRequest(number:$n) {
      reviewRequests(first:10) {
        nodes { requestedReviewer { __typename ... on Bot { login } } }
      }
    }
  }
}' -F o="$OWNER" -F r="$REPO" -F n=42

A successful request shows {"__typename":"Bot","login":"copilot-pull-request-reviewer"} in the response.

Step 4: Wire review requests into CI

A common pattern is a workflow that requests a Copilot review every time a non-draft, non-dependabot pull request is opened. Keep the workflow non-blocking: Copilot is an advisory reviewer, not a status check provider, so a failed review request should never block the merge queue.

name: Request Copilot review
on:
  pull_request:
    types: [opened, ready_for_review]

jobs:
  request-review:
    if: github.event.pull_request.draft == false && github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: Request Copilot code review
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/requested_reviewers" \
            --method POST \
            -f 'reviewers[]=copilot-pull-request-reviewer[bot]' || true

The || true keeps the step from failing the workflow when Copilot is not enabled on the repository. The GitHub-provided GITHUB_TOKEN carries the pull-requests: write permission declared in the permissions block, so no extra secret is needed for repositories where Copilot code review is available.

One caveat about effort: this CI call inherits whatever effort level the repository or organization settings specify, because the announcement’s per-request effort option is not yet spelled out as a field in the REST reference. If your CI opens many pull requests, set the repository effort to Lite explicitly (Step 1) and reserve Balanced for reviews you trigger by hand on risky changes.

Step 5: Verify the review actually landed

HTTP 201 or a green gh exit is not proof that Copilot started reviewing. Verify in one of these two ways:

1. Read the requested reviewers with gh api repos/$OWNER/$REPO/pulls/$PR/requested_reviewers and confirm Copilot appears.
2. Watch the pull request activity for review comments from copilot-pull-request-reviewer[bot]. Community tooling confirms a copilot_work_started event on the issue events feed when the review actually begins, which is a stronger signal than the acceptance response.

If the reviewers endpoint does not list Copilot after a 201, code review is most likely not enabled for the repository or the account lacks entitlement. Fix the entitlement, then re-send the request; re-requesting the same reviewer on the same pull request is idempotent.

Troubleshooting

The API returns 201 but no review appears

A 201 Created means GitHub accepted the reviewer request, nothing more. First, confirm Copilot shows up in the requested reviewers list for the pull request. If it does not, the usual cause is that Copilot code review is not enabled on the repository, or the token’s account is not on an eligible plan. Also check that the pull request is not a draft: reviews do not fire on drafts even when the request is accepted. Fix the enablement or the entitlement, then re-send the request.

gh pr edit --add-reviewer @copilot succeeds silently with no review

This is a documented community-verified gotcha: the gh pr edit reviewer path is built for User and Team reviewers, and Copilot’s reviewer identity is a Bot node. The command can print the pull request URL with no error while creating no visible request. Use the GraphQL requestReviewsByLogin mutation with botLogins from Step 3 instead, and verify with the reviewRequests GraphQL query.

403 Forbidden or 422 Unprocessable Entity

A 403 almost always means the token lacks the Pull requests: write permission, or an organization policy blocks third-party applications from requesting reviewers. A 422 usually means the reviewer login is wrong: use the full copilot-pull-request-reviewer[bot] string, not copilot, Copilot, or a bare login. Re-check the token scopes and the exact login string, then retry.

Reviews suddenly cost more credits after September 28

If your credit consumption jumped without any config change, the Default-to-Balanced change is the likely cause. On September 28, 2026, GitHub switched the Default effort level to Balanced for repositories and organizations that had never explicitly selected Lite. Balanced is estimated at roughly $0.25 to $5 of AI credits per review versus about $0.05 to $1 for Lite. Fix it by selecting Lite explicitly at the organization or repository Copilot code review settings page; the repository setting overrides the organization setting.

GraphQL returns “could not resolve bot”

If the mutation complains it cannot resolve the reviewer, you are most likely passing the login in the wrong field. Bots go in botLogins, not userLogins, and the login is copilot-pull-request-reviewer with the [bot] suffix for the botLogins field. The plain display name Copilot does not resolve as a bot slug.

Secondary rate limits on bulk requests

GitHub’s REST reference warns that rapid-fire review requests on requested_reviewers can trigger secondary rate limits. If you are iterating over dozens of pull requests, add a delay of a few seconds between calls and respect Retry-After headers. The API response headers include rate-limit metadata; a well-behaved loop checks them instead of guessing.

FAQ

Can I request a GitHub Copilot code review from the API?

Yes. Since October 2, 2026, GitHub supports requesting Copilot code reviews through the REST and GraphQL APIs, with an optional review effort level per request. It is generally available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

What is the exact REST endpoint to request a Copilot review?

POST https://api.github.com/repos/{owner}/{repo}/pulls/{pull_number}/requested_reviewers with body {"reviewers":["copilot-pull-request-reviewer[bot]"]}. The token needs Pull requests: write permission.

Which effort level should I use, Lite or Balanced?

Balanced gives deeper analysis of complex logic and security-sensitive code but uses more AI credits (roughly $0.25 to $5 of credits per review versus about $0.05 to $1 for Lite). Use Lite for high-volume, low-risk repositories and Balanced for critical code.

Why did my API request return 201 but no review appeared?

Acceptance is not completion. Verify Copilot appears in the pull request’s requested reviewers, confirm code review is enabled for the repository, and check that the requesting account has Copilot code-review entitlement. Draft pull requests also will not fire a review.

Can a scripted API request set the effort level?

GitHub’s October 2, 2026 announcement says you can optionally set the review effort level for each API request. If you want a guaranteed, auditable effort setting today, pin it explicitly in the repository or organization Copilot code review settings.

Does requesting a review turn on automatic reviews?

No. An API request covers one pull request only; it does not create an automatic-review rule. Personal settings and branch rulesets control recurring automatic reviews, and those are a separate control from the effort level.

Conclusion

The October 2026 API support turns Copilot code review into a building block you can call from scripts, CI pipelines, and internal tools, instead of a feature that only starts from the pull request UI. Request reviews with the documented bot login, verify that each request actually landed instead of trusting the status code, and pin the effort level deliberately now that Default means Balanced. For a deeper look at keeping Copilot costs and policies under control, see the GitHub Copilot local sandboxing walkthrough, and if you want Copilot driving your desktop rather than just reviewing diffs, read the Copilot computer-use walkthrough.

Frequently asked questions