Get the audit log for an organization

Note: The audit log REST API is currently in beta and is subject to change.

Gets the audit log for an organization. For more information, see "Reviewing the audit log for your organization."

To use this endpoint, you must be an organization owner, and you must use an access token with the admin:org scope. GitHub Apps must have the organization_administration read permission to use this endpoint.

[ { "@timestamp": 0, "action": "string", "active": true, "active_was": true, "actor": "string", "blocked_user": "string", "business": "string", "config": [ null ], "config_was": [ null ], "content_type": "string", "created_at": 0, "deploy_key_fingerprint": "string", "emoji": "string", "events": [ null ], "events_were": [ null ], "explanation": "string", "fingerprint": "string", "hook_id": 0, "limited_availability": true, "message": "string", "name": "string", "old_user": "string", "openssh_public_key": "string", "org": "string", "previous_visibility": "string", "read_only": true, "repo": "string", "repository": "string", "repository_public": true, "target_login": "string", "team": "string", "transport_protocol": 0, "transport_protocol_name": "string", "user": "string", "visibility": "string" } ]

Request

Path Params

org

string

required

Query Params

phrase

string

optional

A search phrase. For more information, see Searching the audit log.

include

string

optional

The event types to include:

web - returns web (non-Git) events

git - returns Git events

all - returns both web and Git events

The default is web.

after

string

optional

A cursor, as given in the Link header. If specified, the query only searches for events after this cursor.

before

string

optional

A cursor, as given in the Link header. If specified, the query only searches for events before this cursor.

order

string

optional

The order of audit log events. To list newest events first, specify desc. To list oldest events first, specify asc.

The default is desc.

per_page

integer

optional

Results per page (max 100).

page

integer

optional

Page number of the results to fetch.

Responses

🟢200Response

application/json

Body

array of:

@timestamp

integer

optional

The time the audit log event occurred, given as a Unix timestamp.

action

string

optional

The name of the action that was performed, for example user.login or repo.create.

active

boolean

optional

active_was

boolean

optional

actor

string

optional

The actor who performed the action.

blocked_user

string

optional

The username of the account being blocked.

business

string

optional

config

array

optional

config_was

array

optional

content_type

string

optional

created_at

integer

optional

The time the audit log event was recorded, given as a Unix timestamp.

deploy_key_fingerprint

string

optional

emoji

string

optional

events

array

optional

events_were

array

optional

explanation

string

optional

fingerprint

string

optional

hook_id

integer

optional

limited_availability

boolean

optional

message

string

optional

name

string

optional

old_user

string

optional

openssh_public_key

string

optional

org

string

optional

previous_visibility

string

optional

read_only

boolean

optional

repo

string

optional

The name of the repository.

repository

string

optional

The name of the repository.

repository_public

boolean

optional

target_login

string

optional

team

string

optional

transport_protocol

integer

optional

The type of protocol (for example, HTTP or SSH) used to transfer Git data.

transport_protocol_name

string

optional

A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.

user

string

optional

The user that was affected by the action performed (if available).

visibility

string

optional

The repository visibility, for example public or private.