Code Review Becomes Infrastructure: Copilot Review Gets an API and a Per-Request Effort Dial

What happened: review went from button to API

GitHub's October 2 changelog announced two things. First, developers can now request Copilot code review through REST and GraphQL APIs — review no longer lives only behind a GitHub UI click, but can be triggered from your own scripts, workflows, and internal tools. Second, each request can carry its own review effort level, with Balanced becoming the new default as of September 28, replacing Lite.

Coverage is broad: Copilot Pro, Pro+, Max, Business, and Enterprise all get it. Effort can be configured at four levels — enterprise, organization, repository, personal — each overriding the one above.

Why it matters: review timing just became programmable

The real story isn't the three letters 'API' — it's the transfer of triggering power. Before, AI review was human-initiated: you clicked when a PR felt worth reviewing. Now review can live inside the flow — a deep review auto-triggered after CI passes, a light review for dependabot PRs, a maximum-effort review for a midnight hotfix.

The effort dial matters here too. Lite is cheap but shallow, Balanced sits in the middle, higher tiers cost more but dig deeper. Making 'how much effort' a per-request parameter admits a reality: not all code deserves the same review intensity. A copy change and a payments-logic change were never meant to share one standard.

A cooler head: APIs don't fix review quality

A bucket of cold water is warranted: being API-callable doesn't make reviews more accurate. Accuracy, false-positive rates, understanding of business context — none of the core problems moved. The API only automates the act of requesting a review; the quality ceiling stays where it was.

The more practical risk is abuse: since scripts can trigger it, someone will trigger maximum-effort review on every commit, then drown in bills and noise. Our judgment — design the trigger strategy before writing the first API call. Start narrow: auto-review only for PRs targeting main, log what change triggered each review and who owns the verdict, run it for a month before expanding.

Our take: a new toy for vibe coders

For indie developers, the most interesting part isn't enterprise orchestration — it's programmable personal workflows. Script it in your side project: auto-request a review on every push, send the verdict to your Telegram; or auto-trigger a strict review on large AI-generated diffs — AI reviewing AI-written code sounds recursive, but it's currently the highest-ROI error-catching combo available.

Code review is shifting from human habit to machine process. Habits rely on discipline; processes rely on design — and designing trigger strategy is precisely the part AI can't do for you.