Why This Matters

The REST API is how you manage Copilot at scale: seats, usage, policy, audit. Knowing the surface is the foundation for all professional API work.

Concept Explained

The Copilot REST API lives under api.github.com. Endpoint groups: /copilot/users (seat management), /copilot/organizations (org management), /copilot/usage (metrics), /copilot/metrics (detailed metrics).

How It Works

Authenticate with PAT or GitHub App token. Call endpoints with curl or any HTTP client. Responses are JSON. Rate limits apply.

Step-by-Step Tutorial

1. Get auth token

2. List endpoints

3. Try /copilot/usage

4. Try /copilot/users

5. Build client skeleton

Real-World Example

A platform team built a Python client for the Copilot API. Pulled seat list daily (alert on unassigned seats), usage weekly (alert on over-budget), metrics monthly (dashboard for leadership). Saved hours of manual reporting.

Example Prompts / Commands / Code

Base: https://api.github.com

Endpoint groups:
/orgs/{org}/copilot/users              Seat management
/orgs/{org}/copilot/usage              Usage metrics (GA Feb 2025)
/orgs/{org}/copilot/metrics            Detailed metrics
/enterprises/{enterprise}/copilot     Enterprise-level

Auth:
- PAT (personal access token) with read:org scope
- GitHub App installation token (recommended for automation)

Rate limits:
- Standard GitHub API rate limits apply
- Use conditional requests (ETag) to reduce calls

import requests
import os

class CopilotClient:
    def __init__(self, org: str, token: str = None):
        self.org = org
        self.token = token or os.environ['GITHUB_TOKEN']
        self.base = 'https://api.github.com'

    def _headers(self):
        return {
            'Authorization': f'Bearer {self.token}',
            'Accept': 'application/vnd.github+json',
            'X-GitHub-Api-Version': '2022-11-28'
        }

    def list_seats(self):
        r = requests.get(f'{self.base}/orgs/{self.org}/copilot/users',
                         headers=self._headers())
        r.raise_for_status()
        return r.json()

    def get_usage(self):
        r = requests.get(f'{self.base}/orgs/{self.org}/copilot/usage',
                         headers=self._headers())
        r.raise_for_status()
        return r.json()

# Usage:
client = CopilotClient(org='your-org')
seats = client.list_seats()
usage = client.get_usage()

Common Mistakes

• Using wrong auth scope — endpoints fail.
• Not handling rate limits — 403 errors.
• Not using API version header — deprecation breaks.
• Polling too frequently — wastes rate limit budget.

Best Practices

• Use GitHub App tokens for automation (not PATs).
• Set X-GitHub-Api-Version header.
• Handle rate limits with retries.
• Use conditional requests (ETag) to save calls.
• Cache responses; poll at sensible intervals.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• REST API for Copilot

Official References

• REST API for Copilot

Related lessons: PR-07, PR-08