> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Automatic Approvals

> CodeRabbit requests changes on actionable findings and approves once its feedback is resolved and the latest commit is reviewed.

All Platforms (This feature is available on all supported platforms: GitHub, GitLab, Azure DevOps, and Bitbucket.) | Essentials Plan (This feature is available on Essentials (formerly Pro), Team (formerly Pro+), Advanced, and Enterprise. Please refer to our pricing page for more information about our plans and features.)

With Automatic Approvals, CodeRabbit's review decision follows its feedback. When a review leaves actionable comments, CodeRabbit requests changes. When that feedback is resolved and CodeRabbit has reviewed the latest commit, CodeRabbit approves the pull request. Repositories that require approving reviews before merging can count CodeRabbit as one of the reviewers.

Automatic Approvals adds only review decisions. It does not merge the pull request, and your Git provider's other merge requirements still apply. To decide how CodeRabbit's approval combines with human reviews, see [Choose an approval policy](https://docs.coderabbit.ai/pr-reviews/approval-policies.md).

![GitHub pull request merge box showing a changes requested review from coderabbitai\[bot\] and merging blocked](https://mintcdn.com/coderabbit/N5RZvrAPwAPwn-SE/assets/images/changes-requested.png?fit=max\&auto=format\&n=N5RZvrAPwAPwn-SE\&q=85\&s=130eae8ae2948a12a11e65ff2768e94a)

A GitHub pull request blocked by CodeRabbit's request-changes review

## How it works

**1. CodeRabbit reviews a commit**

If the review posts actionable inline comments, CodeRabbit submits a request-changes review.

**2. You address the feedback**

Push changes to the pull request and let CodeRabbit review the new commit.

**3. CodeRabbit resolves addressed threads**

During the next review, CodeRabbit checks its open threads and resolves those that the changes addressed.

**4. CodeRabbit checks the approval requirements**

CodeRabbit approves only when every [approval requirement](#approval-requirements) is met.

**5. CodeRabbit approves the reviewed commit**

Immediately before approving, CodeRabbit checks that the pull request HEAD has not changed.

### Approval requirements

CodeRabbit approves a pull request only when all of these are true:

* The latest commit has a completed CodeRabbit review.
* All required review threads are resolved.
* No [Pre-Merge Check](https://docs.coderabbit.ai/pr-reviews/pre-merge-checks.md) is failing.
* The pull request is within any configured [risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md).
* No matching [team or path override](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#require-human-approval-for-teams-or-paths) disables approval.

If every changed file is excluded by path filters, CodeRabbit skips the review content but still checks the other requirements and can approve the pull request. With a risk limit set, it withholds approval instead, because the commit has no risk assessment.

On GitLab, discussion handling depends on what triggers the approval check. When resolving a discussion triggers the check, CodeRabbit waits until GitLab reports that all blocking discussions are resolved. When a clean CodeRabbit review triggers the check, CodeRabbit checks only discussions that it created.

## Turn on Automatic Approvals

Automatic Approvals is off by default. Turn it on for a repository or an organization:

**Configuration file**

Add `reviews.auto_approvals.enabled` to `.coderabbit.yaml` in your repository or central configuration repository:

```yaml .coderabbit.yaml theme={null}
reviews:
  auto_approvals:
    enabled: true
```

**Web interface**

Open the [repository](https://docs.coderabbit.ai/guides/repository-settings.md) or [organization](https://docs.coderabbit.ai/guides/organization-settings.md) settings. In **Concise** mode, go to **Reviews → Behavior**, turn on **Automatic approvals**, and save your changes.

CodeRabbit's approval counts toward your Git provider's required approvals. Before you turn the feature on, decide how many approvals a pull request needs and whether higher-risk changes should need human approval. [Choose an approval policy](https://docs.coderabbit.ai/pr-reviews/approval-policies.md) walks through the common setups.

## Why CodeRabbit hasn't approved

While a review, thread, or Pre-Merge Check requirement is unmet, the approval stays pending and CodeRabbit posts no notice about it:

| Situation | What to do |
| - | - |
| The latest review is missing, in progress, or failed. | Wait for the review to finish, or comment `@coderabbitai review`. |
| The latest review was rate-limited. | Comment `@coderabbitai rate limit` to check your remaining capacity, then run `@coderabbitai review` after capacity is restored. |
| A required review thread is unresolved. | Address the comment and push a fix, or resolve the thread. |
| A Pre-Merge Check is failing. | Fix the cause, or [ignore the failed checks](https://docs.coderabbit.ai/pr-reviews/pre-merge-checks.md#unblocking-a-pr) for this pull request. |
| A new commit arrived while CodeRabbit was checking the requirements. | Let CodeRabbit review the new commit. It checks the requirements again afterward. |
| CodeRabbit posted an **Automatic approval withheld** review. | A risk limit or a matching override blocks approval. See [When CodeRabbit withholds approval](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#when-coderabbit-withholds-approval). |

During a rate-limited run, CodeRabbit may still resolve threads that the new changes addressed, but the approval stays pending because the latest commit has no completed review.

## Approve or resolve on demand

Post `@coderabbitai approve` or `@coderabbitai resolve` as a top-level pull request comment to skip the wait. Both commands resolve CodeRabbit's review threads. With Automatic Approvals turned on, both can also approve the pull request without a completed review of the latest commit and without passing Pre-Merge Checks. They work only as top-level comments, not as replies in a review thread.

The commands do not bypass [risk limits or disabled overrides](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md). The risk assessment comes from a completed review, so when a limit is set, the latest commit needs a completed review before either command can approve. CodeRabbit also checks, immediately before approving, that the pull request HEAD has not changed. If every approved commit must have a completed review, run `@coderabbitai review` first.

### Stop authors from approving their own pull requests

By default, pull request authors can use both commands on their own pull requests. Set [`reviews.allow_author_approval`](https://docs.coderabbit.ai/reference/configuration#param-reviews-allow-author-approval) to `false` to prevent this:

```yaml .coderabbit.yaml theme={null}
reviews:
  auto_approvals:
    enabled: true
  allow_author_approval: false
```

Anyone other than the author can still use the commands, provided CodeRabbit can identify both the commenter and the author. The pull request's branch configuration cannot turn author approval back on. This setting does not affect the approvals CodeRabbit submits after its own reviews.

## Turn off Automatic Approvals

Set `reviews.auto_approvals.enabled` to `false`, or turn off **Automatic approvals** in the web interface. CodeRabbit then stops requesting changes and approving on new reviews.

Turning the feature off does not remove reviews that CodeRabbit already submitted. On open pull requests, dismiss CodeRabbit's approvals that should no longer count toward your merge rules, and any request-changes reviews that still block merging.

## Configuration

[Approval risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md) explains the risk limits and overrides for teams and paths.

**enabled** `boolean` (default: false)

Request changes for blocking findings. Automatically approve when required threads are resolved, the latest commit is reviewed, pre-merge checks pass, and configured risk limits are satisfied. In GitLab, required discussions must be resolved.

**max\_merge\_risk** `enum`

Highest inclusive merge risk that permits approval. Omitted limits can be inherited; merge risk is unrestricted only when no configuration source sets a limit. A configured limit requires an assessment covering the current commit. One of: `minimal`, `low`, `moderate`, `high`, `critical`

**max\_security\_risk** `enum`

Highest inclusive security architecture risk that permits approval. Security risk assessments require the Advanced plan or above. Omitted limits can be inherited; security risk is unrestricted only when no configuration source sets a limit. This is separate from Security finding severity. A configured limit requires an assessment covering the current commit. One of: `minimal`, `low`, `moderate`, `high`, `critical`

**overrides\[].enabled** `boolean`

Set to false to withhold approval for matching pull requests, regardless of risk. Omit to use the global setting. Any matching disabled override wins. Review comments and requests for changes continue normally; overrides cannot turn on a globally disabled workflow.

**overrides\[].teams** `array of string`

Apply this override when the pull request author belongs to any listed GitHub team. Use organization/team-slug.

**overrides\[].paths** `array of string`

Apply this override when any changed file matches these repository-relative globs. Uses the same glob syntax as path\_filters, including ! exclusions. Renames match both old and new paths. When teams and paths are set, both must match. Omit to match all paths.

**overrides\[].max\_merge\_risk** `enum`

Override the global merge-risk limit for matching pull requests. Omit to inherit the global limit. One of: `minimal`, `low`, `moderate`, `high`, `critical`

**overrides\[].max\_security\_risk** `enum`

Override the global security-risk limit for matching pull requests. Omit to inherit the global limit. Security risk assessments require the Advanced plan or above. One of: `minimal`, `low`, `moderate`, `high`, `critical`

Full reference: [Automatic approvals](https://docs.coderabbit.ai/reference/configuration.md#param-reviews-auto-approvals)

### Legacy configuration key

CodeRabbit also reads `reviews.request_changes_workflow` and treats it as `reviews.auto_approvals.enabled`. Use only one of the two keys. If a configuration sets both to different values, CodeRabbit turns off Automatic Approvals for that configuration and reports a configuration error.

## What's next

> **[Approval risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md)**
>
> Keep higher-risk pull requests for human approval while CodeRabbit approves routine ones.

> **[Choose an approval policy](https://docs.coderabbit.ai/pr-reviews/approval-policies.md)**
>
> Combine CodeRabbit approvals with human reviews, GitHub branch rules, and Triage merges.

> **[Pre-Merge Checks](https://docs.coderabbit.ai/pr-reviews/pre-merge-checks.md)**
>
> Configure the quality gates that CodeRabbit verifies before it approves.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.