v56

latestOpenAPI 3.0.3MITraw.githubusercontent.com2026-08-011,4581,08113.3 MB

enterprise-admin

Get the audit log for an enterprise

Gets the audit log for an enterprise.

This endpoint has a rate limit of 1,750 queries per hour per user and IP address. If your integration receives a rate limit error (typically a 403 or 429 response), it should wait before making another request to the GitHub API. For more information, see "Rate limits for the REST API" and "Best practices for integrators."

The authenticated user must be an enterprise admin to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the read:audit_log scope to use this endpoint.

get/enterprises/{enterprise}/audit-log

Path parameters

enterprisestring required

The slug version of the enterprise name.

Query parameters

phrasestring

A search phrase. For more information, see Searching the audit log.

include'web' | 'git' | 'all'

The event types to include:

web - returns web (non-Git) events.
git - returns Git events.
all - returns both web and Git events.

The default is web.

afterstring

A cursor, as given in the Link header. If specified, the query only searches for events after this cursor.

beforestring

A cursor, as given in the Link header. If specified, the query only searches for events before this cursor.

order'desc' | 'asc'

The order of audit log events. To list newest events first, specify desc. To list oldest events first, specify asc.

The default is desc.

pageinteger

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

Response

@timestampinteger

The time the audit log event occurred, given as a Unix timestamp.

actionstring

The name of the action that was performed, for example user.login or repo.create.

activeboolean

active_wasboolean

actorstring

The actor who performed the action.

actor_idinteger

The id of the actor who performed the action.

dataobject

org_idinteger

user_idinteger

business_idinteger

blocked_userstring

The username of the account being blocked.

businessstring

configobject[]

config_wasobject[]

content_typestring

operation_typestring

created_atinteger

The time the audit log event was recorded, given as a Unix timestamp.

deploy_key_fingerprintstring

_document_idstring

A unique identifier for an audit event.

emojistring

eventsobject[]

events_wereobject[]

explanationstring

fingerprintstring

hook_idinteger

limited_availabilityboolean

messagestring

namestring

old_userstring

openssh_public_keystring

orgstring

previous_visibilitystring

read_onlyboolean

repostring

The name of the repository.

repositorystring

The name of the repository.

repository_publicboolean

target_loginstring

teamstring

transport_protocolinteger

The type of protocol (for example, HTTP or SSH) used to transfer Git data.

transport_protocol_namestring

A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.

userstring

The user that was affected by the action performed (if available).

visibilitystring

The repository visibility, for example public or private.