GitHub Copilot Usage API Now Measures Review Outcomes

Summary: On November 5, 2026, GitHub added a copilot_code_review object to the enterprise and organization repos-1-day Copilot usage metrics reports, tracking what actually happens to Copilot code review feedback after it lands. You can now compute an addressed rate per repository and see which kinds of comments get acted on. For anyone rolling out Copilot code review across teams, this is the first time the API distinguishes between “Copilot left a comment” and “a human did something about it.”

The old fields told you Copilot showed up, not whether it worked

If you’ve been watching Copilot code review through the existing metrics, the pull_requests fields could tell you how often Copilot reviewed a PR and how often someone clicked to apply a suggestion. That’s a thin slice of reality. Most of the time, a developer who finds a review comment useful doesn’t click “apply suggestion” — they edit the code themselves, ask Copilot to make the fix, or reply that the fix will ship in a follow-up PR. All of those count as the developer acting on the feedback, and none of them showed up in your numbers.

The new fields close that gap. According to GitHub’s changelog entry published November 5, 2026, each row of the enterprise and organization repos-1-day report now carries a copilot_code_review object with these fields:

total_comments_evaluated — how many Copilot review comments were checked to see whether the developer acted on them
total_comments_addressed — how many of those the developer acted on, by any of the routes above
review_comments_by_severity, review_comments_by_review_tier, review_comments_by_comment_type, and review_comments_by_customization — both counts broken down by severity (high, medium, low), review tier (lite, balanced, max), comment type (bug, security, or custom), and customization (custom instructions, skills, MCP servers, or none)
total_merged_no_human_change_request_after_review — merged PRs that Copilot reviewed where no person requested changes afterward

The addressed rate is just total_comments_addressed divided by total_comments_evaluated, per repository, per day. When a repo had no Copilot code review activity that day, counts are 0 and arrays are empty rather than missing.

This is an attribution mechanism, not a new telemetry stream. A comment stays unevaluated until its pull request merges; then GitHub checks what happened and books the result against the merge day. That design choice shapes everything downstream.

Why the breakdowns are the interesting part

The raw addressed rate tells you whether developers engage with Copilot’s reviews at all. The by_customization breakdown tells you something more useful: whether your investment in custom instructions, skills, and MCP servers changes which comments actually land. If your repo’s custom coding guidelines generate lots of comments but developers rarely act on them, that’s a signal to revise the guidelines — or accept that they’re noise.

Similarly, total_merged_no_human_change_request_after_review is a rough proxy for whether Copilot’s review satisfies human reviewers. A high count means people merge without pushing back after Copilot’s first pass. That’s not proof Copilot caught everything — it just means nobody escalated. Treat it as a trend line, not a verdict.

I wrote earlier about how the same API already splits usage by client with the totals_by_client breakdown (Copilot Usage Metrics API: totals_by_client Breakdown). These two changes follow the same pattern: GitHub is turning the API from an activity log into something closer to an outcome ledger. The existing pull_requests.total_copilot_applied_suggestions field counts only ready-to-apply suggestions that someone actually applied. The new counts include every evaluated comment, and count it as addressed no matter how the developer responded.

The limitations to know before you build a dashboard

Three things in the changelog will bite you if you don’t plan for them.

First, the merge-day accounting. Comments count on the day their PR merges, not the day Copilot posted them. If you chart addressed comments over time, you’re charting merge activity, which lags review activity by however long your PRs stay open. Don’t read a dip as “developers stopped acting on feedback” when it might just be a quiet merge week.

Second, bot pull requests. Copilot usually doesn’t evaluate comments on PRs opened by bots — Copilot’s own cloud agent being the obvious case. But those PRs still count toward total_merged_no_human_change_request_after_review. If your repos are heavy with agent-generated PRs, that merged-without-pushback number will include traffic your addressed rate never sees. The two metrics measure different populations.

Third, null semantics. The related changelog entry from the same day — GitHub also added fields flagging which users are missing client telemetry or running IDE versions below the usage metrics minimums — is explicit that null or omitted values mean the data is unavailable, not false or zero, and that days before the release have no values at all. A dashboard that renders null as 0 will quietly show a perfect record where there’s actually no record.

There’s also a data-quality companion worth knowing about. The same-day update added per-user fields client_telemetry_present and usage_metrics_requirements to enterprise and organization user reports, plus daily counts of missing_client_telemetry_user_count and below_usage_metrics_minimum_user_count. Users without client telemetry still count as active, but their data lacks lines of code, feature breakdowns, and model breakdowns — common causes include outdated editors, disabled IDE telemetry, and proxies blocking events. GitHub warns that a user can appear in both daily gap counts, so don’t add the two counts together, and don’t sum across days to estimate unique users.

Access, and what the sources don’t tell you

Both features sit behind the same gate: enterprise owners, enterprise billing managers, organization owners, or anyone with a custom role granting the View Copilot Metrics permission. The Copilot usage metrics policy has to be enabled. If you’re an individual developer on a team without enterprise metrics turned on, none of this is visible to you.

A few things the sources leave open. They don’t specify which minimum IDE or extension versions count as supported — the API just reports met, unmet, or unknown per user against them. They give no benchmark for what a healthy addressed rate looks like, so you’ll need to baseline your own repos before judging the numbers. And they don’t quantify how many users are typically affected by telemetry gaps, only that the fields exist to help you find out. The docs site offers general Copilot documentation but no further specifics on these endpoints in what was reviewed.

If you run Copilot code review anywhere, the practical next step is small: pull one repo’s repos-1-day rows for a few weeks, compute the addressed rate and the by_customization split, and check whether your custom instructions are generating comments people act on. Then audit which of your users show up in the telemetry-gap counts — because if a chunk of your team’s editors aren’t reporting events, your address rate is computed on a partial picture, and no dashboard setting will fix that.

Sources

Original post

View the original post on X