Skip to content
GitmoapAPIBeta
Reviewreviewers
GET/repositories/{repo_id}/merge-requests/{mr_id}/reviewers

List reviewers for a merge request

list_reviewers
  • reviewer:read
    A token needs the reviewer:read scope: List merge-request reviewersGranted by mcp_agent, mcp_agent_write, read_api, read_repository, write_api, write_repository.Every operation this scope unlocks
  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

Everyone asked to review the merge request, in the order they were added, each with their review status and when they reviewed. An approval given before the latest push to the source branch is marked stale. Anyone who can read the merge request may call it.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
  • mr_idMergeRequestId (integer · int64)Merge request ID

Responses

200Reviewers listedapplication/json
  • auth_methodReviewAuthMethodsessiontokenunknownHow the review was made: through a sign-in session or with an access token. An approval rule may count only the first.
  • created_atstring
  • merge_request_idMergeRequestId (integer · int64)
  • principal_kindPrincipalKinduserservice_accountagentA person or a service account.
  • repository_idRepositoryId (string · uuid)
  • review_statusReviewStatuspendingapprovedrejected
  • reviewerActorSummaryDenormalized reviewer snapshot (write-time enrichment)
  • stalebooleanWhether this reviewer's approval predates the current source-branch tip (i.e. was cast against an older revision). Computed at read time; not stored. Purely informational — whether staleness blocks a merge is governed by the approval policy's reset_on_push, surfaced per approval in the merge check. Always present in responses; it is recomputed on every read.
  • approved_at_shaCommitHash (string) or nulloptional
  • reviewed_atstring or nulloptional
200 exampleSynthesized example
[
{
"auth_method": "session",
"created_at": "2026-10-08T15:00:17Z",
"merge_request_id": 42,
"principal_kind": "user",
"repository_id": "5b0e7c2a-9d14-4e8b-a6f1-2c3d4e5f6a70",
"review_status": "pending",
"reviewer": {
"email": "lin@acme.example",
"id": "id-d8f8",
"username": "lin"
},
"stale": false
},
{
"auth_method": "session",
"created_at": "2026-10-13T22:40:16Z",
"merge_request_id": 42,
"principal_kind": "user",
"repository_id": "5b0e7c2a-9d14-4e8b-a6f1-2c3d4e5f6a70",
"review_status": "pending",
"reviewer": {
"email": "lin@acme.example",
"id": "id-3bde",
"username": "lin"
},
"stale": false
}
]
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-61a0",
"message": "Draw the region map from operation density"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-3a18",
"message": "Label every synthesized example"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-4ab2",
"message": "Inline scalar newtypes but keep their brand"
}
}
404Not found — or found and private, which is masked as absentapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-3e73",
"message": "Pin a page's payload to the build that rendered it"
}
}

CLI

gitmoap reviewers list

  • --repo-ididRepository ID (id or owner/repo path)
  • --mr-ididMerge request ID

Used in these guides