GitHub Copilot code review can now be requested through GitHub's REST and GraphQL APIs, with an optional effort level on each request, and its default effort moved to Balanced on 28 September 2026. Teams should check which effort their organisation now runs at, then decide where an API-triggered review fits their pipeline.
What GitHub released
The change was announced by GitHub on 2 October 2026 in its changelog entry on Copilot code review API support. It has two parts:
- API requests. You can now ask Copilot for a review through the supported REST and GraphQL APIs, and optionally set the review effort for that request. GitHub's September entries describe requesting a review from the pull request page or through automatic review settings.
- A new default effort. The default review effort changed from "Default" to "Balanced" for all repositories and organisations, effective 28 September 2026. Anyone who had already chosen "Lite" keeps that setting.
Both are generally available on the Copilot Pro, Pro+, Max, Business and Enterprise plans.
How it fits with September's other review changes
This release closes out a month of changes to Copilot code review, all from GitHub's own changelog:
- On 1 September, Copilot gained the ability to approve pull requests in public preview. Approvals are off by default; once enabled, they count toward required-approval rules and are dismissed when new commits arrive, like a human reviewer's.
- On 18 September, the review overview comment started grouping findings as open, resolved since the last review, and previously missed.
- On 23 September, personal settings and an enterprise-wide default effort arrived, with automatic reviews on new pull requests, new pushes and drafts.
Taken together, Copilot review is now something you can configure, trigger and gate on from code, not just a button on a pull request.
Where the effort setting lives
Effort can be set at four levels, and a lower level overrides the one above it:
- Enterprise: AI controls, then Agents, then Copilot code review
- Organisation: Copilot, then Code review
- Repository: Copilot, then Code review
- Personal: Copilot settings, then Copilot, then Code review
The choice at each level is Balanced or Lite. GitHub's changelog does not describe what each level does differently, so treat the difference in depth, speed and usage as something to measure on your own repositories rather than assume.
What the default change means for your organisation
If nobody in your organisation picked an effort level, your reviews have been running at Balanced since 28 September. In CodeDTX's view, that is worth a deliberate check rather than a shrug:
- Confirm the setting at each level. A repository or personal override can mean two teams get different reviews on the same codebase.
- Compare a sample of reviews from before and after 28 September. Look at how many findings were raised and how many your engineers resolved or dismissed as incorrect.
- Watch usage. If your Copilot plan meters review activity, check your usage reports for the period since the change, as you would for any other model setting that changed under you. Our note on controlling what an AI agent costs to run applies here too.
What to build with the API
API access matters most for teams that already run their own review tooling or AI agents. Some practical uses, which are CodeDTX's suggestions rather than GitHub's:
- Request reviews from your own pipeline. Trigger a Copilot review after your tests pass, so it reviews code that builds, instead of on every push.
- Pick effort by risk. Ask for Balanced on changes to payment, authentication or data access paths, and Lite on documentation or configuration changes.
- Review agent-written pull requests. If coding agents open pull requests in your repositories, request a Copilot review as a standard step before a human looks at it. That gives the reviewer a structured list of findings, but it is not a substitute for the human check; see human in the loop without friction.
When to hold back
Do not let an API-triggered review become an approval by default. If you enable Copilot approvals, limit them to the file paths the repository setting allows and keep a human approval on anything that reaches production, in line with how to stop an agent taking a wrong action. Approvals are still in public preview, so plan for the behaviour to change.
Also keep a record of which reviews were requested by automation and at what effort. When something slips through, you will want to know whether it was reviewed, by what, and how thoroughly, which is the same question an AI agent audit trail answers.
Frequently asked questions
Can you request a Copilot code review through the GitHub API?
Yes. Since GitHub's 2 October 2026 changelog entry, you can request a review from Copilot using the supported REST and GraphQL APIs, and optionally set the effort level for each request. It is generally available on the Copilot Pro, Pro+, Max, Business and Enterprise plans, so it can be wired into internal tools and pipelines.
What is the new default effort for Copilot code review?
The default changed from "Default" to "Balanced" for all repositories and organisations, effective 28 September 2026. If your organisation, a repository or an individual had already selected "Lite", that choice was kept. Anyone who never chose a level is now on Balanced unless they change it in their Copilot code review settings.
How do you change the Copilot code review effort level?
Set it in the Copilot code review settings at enterprise, organisation, repository or personal level, choosing Balanced or Lite. A setting at a lower level overrides the default set above it. When calling the API, you can also pass an effort level on the individual request, which suits pipelines that review some changes more closely than others.
Should Copilot approve pull requests on its own?
Only in narrow cases, if at all. Copilot approvals are in public preview and off by default. When enabled, they count toward required-approval rules, and repository admins can choose which file paths Copilot may approve. Keep a human approval for production code and sensitive paths, and treat Copilot's review as input to that decision.
