---
title: "Get the audit log for an enterprise"
method: GET
path: "/enterprises/{enterprise}/audit-log"
tags: ["enterprise-admin"]
---

# Get the audit log for an enterprise

`GET /enterprises/{enterprise}/audit-log`

Gets the audit log for an enterprise. To use this endpoint, you must be an enterprise admin, and you must use an access token with the `admin:enterprise` scope.

## Path parameters

- `enterprise` string, required

## Query parameters

- `phrase` string
- `include` 'web' | 'git' | 'all'
- `after` string
- `before` string
- `order` 'desc' | 'asc'
- `page` integer
- `per_page` integer

## Response `200`

Response

- AuditLogEvent[]
  - `@timestamp` integer — The time the audit log event occurred, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
  - `action` string — The name of the action that was performed, for example `user.login` or `repo.create`.
  - `active` boolean
  - `active_was` boolean
  - `actor` string — The actor who performed the action.
  - `actor_id` integer — The id of the actor who performed the action.
  - `actor_location` object
    - `country_name` string
  - `data` object
  - `org_id` integer
  - `user_id` integer
  - `business_id` integer
  - `blocked_user` string — The username of the account being blocked.
  - `business` string
  - `config` object[]
  - `config_was` object[]
  - `content_type` string
  - `operation_type` string
  - `created_at` integer — The time the audit log event was recorded, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
  - `deploy_key_fingerprint` string
  - `_document_id` string — A unique identifier for an audit event.
  - `emoji` string
  - `events` object[]
  - `events_were` object[]
  - `explanation` string
  - `fingerprint` string
  - `hook_id` integer
  - `limited_availability` boolean
  - `message` string
  - `name` string
  - `old_user` string
  - `openssh_public_key` string
  - `org` string
  - `previous_visibility` string
  - `read_only` boolean
  - `repo` string — The name of the repository.
  - `repository` string — The name of the repository.
  - `repository_public` boolean
  - `target_login` string
  - `team` string
  - `transport_protocol` integer — The type of protocol (for example, HTTP or SSH) used to transfer Git data.
  - `transport_protocol_name` string — A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.
  - `user` string — The user that was affected by the action performed (if available).
  - `visibility` string — The repository visibility, for example `public` or `private`.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-5.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-5/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-5/versions/50ae54440071/schema)