I was curious how this handled repositories that use are offered under more than one license, so I tried this out on the Rust repository:

  "license": {
    "key": "apache-2.0",
    "name": "Apache License 2.0",
    "url": "https://api.github.com/licenses/apache-2.0"
  }

Rust is offered under both MIT and Apache 2, and has corresponding LICENSE-MIT and LICENSE-APACHE files in its root directory. I'm assuming that Github simply searches alphabetically for all files that begin with LICEN[CS]E and eagerly terminates upon finding a single match.