--- title: CodeRabbit API Integration on Truto slug: coderabbit category: Product Development canonical: "https://truto.one/integrations/detail/coderabbit/" --- # CodeRabbit API Integration on Truto **Category:** Product Development **Status:** Generally available ## MCP-ready AI tools Truto exposes 21 tools for CodeRabbit that AI agents can call directly. - **list_all_code_rabbit_users** — List all users in the CodeRabbit organization, including seat and role assignments for each user. Returns: user_id, cr_user_id, username, email, seat_assigned, role, role_name, role_type, workspace_role, accounts. - **code_rabbit_seats_bulk_assign** — Bulk assign or unassign CodeRabbit seats for up to 500 users. Organization or self-hosted API keys send action (assign|unassign) with user_ids (provider user IDs); workspace API keys send members (by email or cr_user_id). Returns status (success|partial_success|failure) with per-user results. - **code_rabbit_seats_bulk_change_roles** — Bulk change CodeRabbit roles for up to 500 users. Returns status (success|partial_success|failure) with per-user results. Required: role, user_ids. - **create_a_code_rabbit_report** — Generate a report with CodeRabbit by invoking the report.generate operation. Returns the generated report payload with fields as defined by CodeRabbit's report.generate API; the JSON request body follows the same reference. - **list_all_code_rabbit_audit_logs** — List CodeRabbit audit log entries. Returns: id, created_at, updated_at. Max 100 per page. - **delete_a_code_rabbit_learning_by_id** — Delete a CodeRabbit learning by id; deletion is idempotent and also succeeds when the learning is already absent. Returns an empty 204 response on success. Required: id. Enterprise plan only. - **list_all_code_rabbit_learnings** — List CodeRabbit learnings for an organization, filterable by repository, author, file path, and usage stats. Returns: id, learning, organization_id, organization_name, repository_id, repository_name, author_id, author_username, file, source_url, pull_request, created_at, updated_at, usage_count, last_used_at. Enterprise plan only. - **update_a_code_rabbit_learning_by_id** — Replace the text of a CodeRabbit learning and refresh its search embedding. Enterprise plan and learning:write permission required. Returns the updated learning. Required: id, learning. - **list_all_code_rabbit_review_comments** — List CodeRabbit review comment metrics for merged pull requests, one record per pull request with the CodeRabbit comments posted on it. Returns: pr_url, organization_id, repository_id, author_id, merged_at, coderabbit_comments. Required: start_date, end_date. - **list_all_code_rabbit_review_metrics** — List CodeRabbit PR review metrics for your organization over a date range. Returns per-pull-request records with pr_url, status, merged_at, review_iterations, estimated_review_minutes, and coderabbit_comments (posted vs accepted counts by severity and category). Required: start_date, end_date. - **list_all_code_rabbit_role_permission_options** — List the valid resource_id and access_type values for creating or updating Enterprise custom roles in CodeRabbit. Returns: resource_ids, access_types. Required: org_id when authenticating with a workspace-scoped API token. - **create_a_code_rabbit_role** — Create a custom role in CodeRabbit. Returns the created role including its id, name, role_type, and permissions. Required: name. - **delete_a_code_rabbit_role_by_id** — Delete a custom role in CodeRabbit by id. Only Enterprise custom roles that are not assigned to any organization members can be deleted; system roles cannot. Returns an empty 204 response on success. Required: id. - **get_single_code_rabbit_role_by_id** — Get details of a built-in or Enterprise custom role in CodeRabbit by id. Returns: id, name, resource_ids, access_types. Required: id. - **list_all_code_rabbit_roles** — List built-in and Enterprise custom roles for the authenticated CodeRabbit organization. Returns: id, name, role_type, permissions, user_count. - **update_a_code_rabbit_role_by_id** — Update a custom role in CodeRabbit by id. Returns the updated role including its id, name, role_type, and permissions. Required: id. - **list_all_code_rabbit_mcp_metrics** — List MCP server usage for merged, reviewed CodeRabbit pull requests in a UTC date window, one record per pull request with the MCP servers and tools used nested under servers. Join to review metrics on pr_url. Counts are best-effort telemetry and access depends on an organization feature flag. Required: start_date, end_date. - **list_all_code_rabbit_security_code_findings** — List CodeRabbit Deep Scan code findings for the repositories in scope, from each repository's latest completed scan unless scan_id is given. Defaults to open findings; filter with state, repo_id, org_id. Includes saved reachability evidence (call stacks) and explanations. - **list_all_code_rabbit_organizations** — List active CodeRabbit organizations. Organization API keys return their bound organization; workspace API keys return every active organization in the workspace. Use the returned id with the organization repositories tool. Enterprise plan only. - **list_all_code_rabbit_organization_repositories** — List the repositories CodeRabbit records as active for an organization. organization_id is the CodeRabbit organization UUID returned by the list organizations tool. Enterprise plan only. Required: organization_id. - **create_a_code_rabbit_seat_assignment_mode** — Set the organization's CodeRabbit seat assignment mode (automatic or manual). Only fully self-hosted organizations on the Enterprise plan can use this. Returns: mode. Required: mode. ## How it works 1. **Link your customer's CodeRabbit account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach CodeRabbit.** The Proxy API is a 1-to-1 mapping of the CodeRabbit API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Embed AI code review analytics in engineering management platforms** — EMPs can pull CodeRabbit review metrics and comments to show VPs of Engineering exactly how much review time AI saved and how often developers accept AI-suggested fixes. This turns CodeRabbit telemetry into first-class ROI dashboards alongside Jira and Git data. - **Sync internal documentation into CodeRabbit Learnings** — Developer portals and knowledge bases can push architectural decisions and coding standards into CodeRabbit's Learnings so the AI reviewer enforces the latest guidelines on every PR. Static documentation becomes active, enforced code gates. - **Unify AI security findings in ASPM dashboards** — ASPM and vulnerability management products can ingest CodeRabbit's Deep Scan findings — including reachability evidence — to correlate AI-detected code vulnerabilities with cloud and SAST risks. Security teams get one view across code and infrastructure. - **Automate CodeRabbit seat provisioning from IdP/HRIS** — Identity and lifecycle platforms can bulk-assign CodeRabbit seats and apply custom roles the moment an engineer is hired or changes teams. This prevents license overages and ensures RBAC stays aligned with HR source-of-truth. - **Surface MCP usage and audit trails in compliance tooling** — GRC and audit platforms can pull CodeRabbit audit logs and MCP metrics to prove which tools the AI reviewer invoked on each merged PR. This gives compliance teams a defensible trail for AI-assisted code changes. ## What you can build - **AI review ROI dashboard** — Visualize estimated review minutes saved, review iterations, and accepted vs. posted AI comments by severity and category per team. - **Learnings sync engine** — Push updates from your docs or wiki into CodeRabbit Learnings via create, update, and delete operations so AI reviews always reflect current standards. - **Deep Scan vulnerability importer** — Pull CodeRabbit security code findings with reachability evidence into your ASPM to triage AI-detected vulnerabilities alongside SAST and DAST results. - **Zero-touch seat lifecycle automation** — Bulk-assign and reassign seats and roles from your IdP or HRIS using provider user IDs or emails, including a configurable seat assignment mode. - **Custom role provisioning** — Programmatically create and update CodeRabbit roles with granular resource IDs and access types to mirror your customer's RBAC model. - **Compliance audit log stream** — Continuously ingest CodeRabbit audit logs and MCP metrics into your SIEM or GRC product to track reviewer actions and tool invocations on merged PRs. ## FAQs ### Which CodeRabbit resources can I access through Truto today? Truto exposes tools for users, seats, roles, review comments, review metrics, security code findings, learnings, MCP metrics, organizations, organization repositories, reports, and audit logs. If you need an endpoint that isn't listed, Truto can add it on request. ### How does authentication work for end users connecting their CodeRabbit account? Truto handles the CodeRabbit API token exchange and secure credential storage for you, so your end users connect their account once and your product calls CodeRabbit through Truto without you managing secrets. ### Can I bulk-manage CodeRabbit seats and roles from my product? Yes. Truto supports bulk seat assignment, bulk role changes, creating and updating custom roles, listing role permission options, and configuring a seat assignment mode — ideal for IdP, HRIS, and lifecycle automation flows. ### Can I programmatically update CodeRabbit Learnings to enforce new standards? Yes. You can list, update, and delete Learnings via Truto. Updating a learning refreshes its embedding in CodeRabbit, so the next PR is reviewed against the new guidance automatically. ### What review and security data can I pull for analytics? You can list review metrics, review comments, MCP metrics, and security code findings — including the reachability evidence and AI-generated context that make CodeRabbit's Deep Scan findings uniquely actionable. ### How do I keep data fresh — is there webhook support or do I poll? The current CodeRabbit tool set is request/response based, so most integrations use scheduled polling of metrics, findings, and audit logs. Truto normalizes pagination and rate-limit handling so you can poll efficiently without writing CodeRabbit-specific logic.