Review a pull request in the session's repository
Submits a review (APPROVE, REQUEST_CHANGES or COMMENT) on pull request number of the session's repository with the workspace's reviewer App, a second App apart from the one that opens pull requests, since GitHub refuses an approval from a pull request's own author. Any open pull request in the repository can be reviewed, whoever opened it. The agent's release must turn on review under the workspace ceiling; without a reviewer App the call is refused (409 GITHUB_REFUSED no_reviewer_app). The token is the reviewer App's, scoped to this repository with contents: read and pull_requests: write.
commit_id is the head the caller read and is required: GitHub files the review on that commit, so nothing pushed after the read is approved. The platform also reads the pull request first, and when its head is not commit_id it submits nothing and refuses with 409 GITHUB_REFUSED stale_commit (error.details.head_sha is the head it read). body (required unless APPROVE) goes to GitHub only, with mentions and cross-references neutralized and secret-shaped lines replaced by [REDACTED]. Whether an approval satisfies the repository's required reviews is GitHub's rule, as are branch protection and CODEOWNERS. Leaves a review_pull_request receipt either way, naming the commit, the event and, when the platform opened the pull request, the session and agent that opened it; never the body.
Scope: sessions:write (API key or cookie session). Idempotency-Key: ignored.
AuthorizationBearer <token>For servers and scripts: an API key sent as an HTTP bearer token, Bearer <key>. It holds exactly the scopes it was issued with; a key issued before scopes existed holds none. It never needs the CSRF header, and it cannot manage agents, members, teams or API keys. Issue one in the web console under Settings → API keys; each operation names the scope it needs.
Scope: sessions:write
id*stringThe session's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidnumber*integerThe pull request's number on its repository.
0 < value <= 2147483647X-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
event*string"APPROVE""REQUEST_CHANGES""COMMENT"commit_id*string^[0-9a-f]{40}$body?string1 <= length <= 65536Submitted; the receipt and the review GitHub made.
application/json- response
receipt_id*string^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidreview*curl -X POST 'https://example.com/v1/sessions/497f6eca-6276-4993-bfeb-53cbbbba6f08/github/pull-requests/1/reviews' \ -H 'Content-Type: application/json' \ -d '{ "event": "APPROVE", "commit_id": "9f2c1e0b7a6d5c4b3a2918f7e6d5c4b3a2918f7e"}'{ "receipt_id": "c4a1e9d2-7b3f-4e8a-a6c5-1d2e3f4a5b6c", "review": { "id": 2345678901, "html_url": "https://github.com/acme/sample-app/pull/12#pullrequestreview-2345678901" }}