---
title: "Get the audit log for an organization"
method: GET
path: "/orgs/{org}/audit-log"
tags: ["orgs"]
---

# Get the audit log for an organization

`GET /orgs/{org}/audit-log`

Gets the audit log for an organization. For more information, see "[Reviewing the audit log for your organization](https://docs.github.com/enterprise-cloud@latest/github/setting-up-and-managing-organizations-and-teams/reviewing-the-audit-log-for-your-organization)."

By default, the response includes up to 30 events from the past three months. Use the `phrase` parameter to filter results and retrieve older events. For example, use the `phrase` parameter with the `created` qualifier to filter events based on when the events occurred. For more information, see "[Reviewing the audit log for your organization](https://docs.github.com/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#searching-the-audit-log)."

Use pagination to retrieve fewer or more than 30 events. For more information, see "[Using pagination in the REST API](https://docs.github.com/enterprise-cloud@latest/rest/guides/using-pagination-in-the-rest-api)."

This endpoint has a rate limit of 1,750 queries per hour per user and IP address.  If your integration receives a rate limit error (typically a 403 or 429 response), it should wait before making another request to the GitHub API. For more information, see "[Rate limits for the REST API](https://docs.github.com/enterprise-cloud@latest/rest/using-the-rest-api/rate-limits-for-the-rest-api)" and "[Best practices for integrators](https://docs.github.com/enterprise-cloud@latest/rest/guides/best-practices-for-integrators)."

The authenticated user must be an organization owner to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `read:audit_log` scope to use this endpoint.

## Path parameters

- `org` string, required

## Query parameters

- `phrase` string
- `include` 'web' | 'git' | 'all'
- `after` string
- `before` string
- `order` 'desc' | 'asc'
- `per_page` integer

## Response `200`

Response

- AuditLogEvent[]
  - `@timestamp` integer — The time the audit log event occurred, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
  - `action` string — The name of the action that was performed, for example `user.login` or `repo.create`.
  - `active` boolean
  - `active_was` boolean
  - `actor` string — The actor who performed the action.
  - `actor_id` integer — The id of the actor who performed the action.
  - `actor_location` object
    - `country_name` string
  - `data` object
  - `org_id` integer
  - `user_id` integer
  - `business_id` integer
  - `blocked_user` string — The username of the account being blocked.
  - `business` string
  - `config` object[]
  - `config_was` object[]
  - `content_type` string
  - `operation_type` string
  - `created_at` integer — The time the audit log event was recorded, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
  - `deploy_key_fingerprint` string
  - `_document_id` string — A unique identifier for an audit event.
  - `emoji` string
  - `events` object[]
  - `events_were` object[]
  - `explanation` string
  - `fingerprint` string
  - `hook_id` integer
  - `limited_availability` boolean
  - `message` string
  - `name` string
  - `old_user` string
  - `openssh_public_key` string
  - `org` string
  - `previous_visibility` string
  - `read_only` boolean
  - `repo` string — The name of the repository.
  - `repository` string — The name of the repository.
  - `repository_public` boolean
  - `target_login` string
  - `team` string
  - `transport_protocol` integer — The type of protocol (for example, HTTP or SSH) used to transfer Git data.
  - `transport_protocol_name` string — A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.
  - `user` string — The user that was affected by the action performed (if available).
  - `visibility` string — The repository visibility, for example `public` or `private`.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)