> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Automate user access to Copilot

export const RecipeBadges = ({badges = []}) => {
  const map = {
    "recipe": {
      label: "Recipe",
      color: "#A86400"
    },
    "ai-excellence": {
      label: "AI excellence",
      color: "#653EE8"
    },
    "production-readiness": {
      label: "Production readiness",
      color: "#226686"
    },
    "incident-mgmt": {
      label: "Incident management",
      color: "#86198F"
    },
    "migrations": {
      label: "Migrations",
      color: "#0E7C66"
    },
    "compliance": {
      label: "Compliance",
      color: "#475569"
    },
    "dora": {
      label: "DORA metrics",
      color: "#1D4ED8"
    },
    "security": {
      label: "Security",
      color: "#B42318"
    },
    "operational-readiness": {
      label: "Operational readiness",
      color: "#B54708"
    },
    "dev-onboarding": {
      label: "Developer onboarding",
      color: "#C11574"
    }
  };
  const items = badges.map(key => map[key]).filter(Boolean);
  if (items.length === 0) return null;
  return <div className="not-prose flex flex-wrap gap-2 mb-6">
      {items.map(b => <span key={b.label} className="rounded-lg px-2 py-1 text-xs font-medium" style={{
    backgroundColor: b.color,
    color: b.textColor || "#FFFFFF"
  }}>
          {b.label}
        </span>)}
    </div>;
};

<RecipeBadges badges={["recipe", "dev-onboarding"]} />

This Workflow automatically sets up developers with access to GitHub Copilot.

In this example, approval from a specific team is required. Depending on your organization's requirements, you may want to configure a [User input](/streamline/workflows/blocks#configuring-a-core-block) block instead, effectively allowing users to self-serve access to GitHub Copilot without needing approval from a specific team.

### Prerequisites

Before getting started:

* Before calling the GitHub API endpoint in the Async HTTP request block, your organization must already be on Copilot Business or Enterprise and have seat management policies configured.
* You must [create a secret in Cortex](/configure/settings/api-keys/secrets).
  * In this example, the secret in Cortex must be named `GITHUB_COPILOT_TOKEN`.

### Step 1: Start creating the Workflow

Follow the steps in the documentation to [create a Workflow](/streamline/workflows/create) and [configure its basic settings](/streamline/workflows/create#creating-a-workflow).

Note that Cortex has a pre-built template for this Workflow that contains the [Async HTTP request](/guides/dev-onboarding/automate-user-access-to-copilot#step-2-add-blocks-to-the-workflow) block. The example on this page includes an additional [Manual approval](/guides/dev-onboarding/automate-user-access-to-copilot#step-2-add-blocks-to-the-workflow) block that allows you to designate an approving team. Also in this example, the payload of the Async HTTP block includes `approver": "{{actions.manual-approval.outputs.actor}}`, which references the output of the Manual approval block. This reference is not included in the pre-built Workflow template.

### Step 2: Add blocks to the Workflow

The instructions on this page describe how to create this Workflow in the Cortex UI, but it is also possible to copy the Workflow YAML and add it to your workspace via the [Cortex CLI](https://pypi.org/project/cortexapps-cli/). This allows you to quickly set up the example configuration then iterate on it for your own use case. Expand the tile below to learn more.

<Accordion title="Workflow YAML instructions">
  To upload the Workflow example YAML into your workspace:

  1. Save the Workflow example YAML file below:

  ```yaml theme={null}
  name: Approve access to GitHub Copilot
  tag: copilot-access
  description: "Get approval from the Platform team, then provision a seat in Copilot\
    \ for the user who initiates the Workflow run."
  isDraft: true
  filter:
    type: GLOBAL
  runResponseTemplate: "Successfully provisioned GitHub Copilot for {{context.initiatedBy.email}}"
  failedRunResponseTemplate: "Failed to add a seat to GitHub Copilot for {{context.initiatedBy.email}}"
  restrictActionCompletionToRunnerUser: false
  actions:
  - name: Manual approval
    slug: manual-approval
    schema:
      approvingTeamIds:
      - en319eca313083ac36
      approverDescription: null
      type: MANUAL_APPROVAL
    outgoingActions:
    - asynchronous-http-request
    isRootAction: true
  - name: Asynchronous HTTP request
    slug: asynchronous-http-request
    schema:
      headers:
        Authorization: "Bearer {{ context.secrets.GITHUB_COPILOT_TOKEN }}"
      httpMethod: POST
      payload: |-
        {
        "inputs": {"email": "{{context.initiatedBy.email}}", "approver": "{{actions.manual-approval.outputs.actor}}", "callback": "{{callbackUrl}}", "github_user": "{{context.initiatedBy.identityMappings.github}}"  },
        "ref": "main"
        }
      url: https://api.github.com/orgs/cortexapps/copilot/billing/selected_users
      timeoutInSeconds: null
      type: HTTP_REQUEST_ASYNC
    outgoingActions: []
    isRootAction: false
  runRestrictionPolicies: []
  iconTag: null
  variables: []
  ```

  2. Use the [Cortex CLI](https://pypi.org/project/cortexapps-cli/) to run this command, using the path to your Workflow YAML file:<br />
     `cortex workflows create -f <path-to-your-workflow.yaml>`
</Accordion>

Expand the tiles below to learn about each block in this Workflow and how to configure them in the Cortex UI:

<AccordionGroup>
  <Accordion title="Manual approval">
    In this block, you select which team has to give approval for the user to access GitHub Copilot.

    1. Click **+** in the center of the page. In the block library modal, choose **Manual approval**.
    2. In the block configuration side panel, enter a name and unique slug for this block.
       * In this example, we use the name `Manual approval` and the slug `manual-approval`.
    3. Under **Teams allowed to approve**, select the teams authorized to approve access to GitHub Copilot.
    4. Save the block.
  </Accordion>

  <Accordion title="Async HTTP request">
    This block looks at the initiating user's [identity mapping](/configure/settings/managing-users/identity-mapping) in Cortex for GitHub, then calls the GitHub API to grant access to Copilot for that user.

    1. Click **+** in the center of the page. In the block library modal, choose **Async HTTP request**.
    2. In the block configuration side panel, enter a name and unique slug for this block.
       * In this example, we use the name `Grant access to Copilot` and the slug `copilot-access`.
    3. Configure the block:
       * **HTTP method**: `POST`
       * **URL**: Enter a URL for the request.
         * In this example, we call the GitHub endpoint that adds users to your org's Copilot subscription: `https://api.github.com/orgs/<your-org>/copilot/billing/selected_users`
       * **Headers**: `Authorization: Bearer {{ context.secrets.GITHUB_COPILOT_TOKEN }}`
         * The token you configure must have [permissions to manage Copilot seats](https://docs.github.com/en/rest/copilot/copilot-user-management).
         * In this example, the secret in Cortex must be named `GITHUB_COPILOT_TOKEN`.
       * **Payload**:

    ```json theme={null}
    {
    "inputs": {"email": "{{context.initiatedBy.email}}", "approver": "{{actions.manual-approval.outputs.actor}}", "callback": "{{callbackUrl}}", "github_user": "{{context.initiatedBy.identityMappings.github}}"  },
    "ref": "main"
    }
    ```

    4. Save the block.
  </Accordion>
</AccordionGroup>

### Step 3: Run the Workflow

When you run the Workflow, the following events happen:

* The Workflow pauses to collect a response from a member of one of the teams specified during the Manual approval block.
* After a user gives their approval, the Async HTTP request block runs. It uses the initiator of the Workflow as the GitHub user, then makes a call to the GitHub API to provision access to Copilot for that user.


## Related topics

- [Automate user access to GitHub, PagerDuty, and Jira](/guides/dev-onboarding/automate-user-access-to-github-pagerduty-and-jira.md)
- [Workflows](/guides/product-areas/workflows.md)
- [AI impact dashboard for GitHub Copilot](/improve/eng-intelligence/dashboards/ai-impact.md)