gh api has two parameter flags that look interchangeable and are not. '-f key=value' always sends a JSON string. '-F key=value' parses the value: true and false become booleans, an integer literal becomes a number, null becomes null, and a leading @ reads the value from a file, with '@-' meaning stdin.
The consequence is that 'gh api repos/OWNER/REPO -X PATCH -f private=true' sends the string "true", which most GitHub endpoints reject or silently ignore, while '-F private=true' sends the boolean. Endpoints expecting an integer, such as a milestone number or a team id, have the same problem.
For GraphQL, 'gh api graphql -f query=@query.graphql -F number=123' is the idiomatic form: the query itself is a string read from a file, and the variables are typed. Values passed with -F are also where you inject a heredoc or a file rather than fighting shell quoting. Add '--paginate' for REST collections; it follows the Link header until exhausted.