v50

latestOpenAPI 3.0.3MITraw.githubusercontent.com2023-11-288093493.9 MB
orgs

Get the audit log for an organization

Gets the audit log for an organization. For more information, see "Reviewing the audit log for your organization."

To use this endpoint, you must be an organization owner, and you must use an access token with the admin:org scope. GitHub Apps must have the organization_administration read permission to use this endpoint.

By default, the response includes up to 30 events from the past three months. Use the phrase parameter to filter results and retrieve older events. For example, use the phrase parameter with the created qualifier to filter events based on when the events occurred. For more information, see "Reviewing the audit log for your organization."

Use pagination to retrieve fewer or more than 30 events. For more information, see "Using pagination in the REST API."

get/orgs/{org}/audit-log

Path parameters

orgstring required

The organization name. The name is not case sensitive.

Query parameters

phrasestring

A search phrase. For more information, see Searching the audit log.

include'web' | 'git' | 'all'

The event types to include:

  • web - returns web (non-Git) events.
  • git - returns Git events.
  • all - returns both web and Git events.

The default is web.

afterstring

A cursor, as given in the Link header. If specified, the query only searches for events after this cursor.

beforestring

A cursor, as given in the Link header. If specified, the query only searches for events before this cursor.

order'desc' | 'asc'

The order of audit log events. To list newest events first, specify desc. To list oldest events first, specify asc.

The default is desc.

per_pageinteger

The number of results per page (max 100).

pageinteger

Page number of the results to fetch.

Response

Response

@timestampinteger

The time the audit log event occurred, given as a Unix timestamp.

actionstring

The name of the action that was performed, for example user.login or repo.create.

activeboolean
active_wasboolean
actorstring

The actor who performed the action.

actor_idinteger

The id of the actor who performed the action.

dataobject
org_idinteger
user_idinteger
business_idinteger
blocked_userstring

The username of the account being blocked.

businessstring
configobject[]
config_wasobject[]
content_typestring
operation_typestring
created_atinteger

The time the audit log event was recorded, given as a Unix timestamp.

deploy_key_fingerprintstring
_document_idstring

A unique identifier for an audit event.

emojistring
eventsobject[]
events_wereobject[]
explanationstring
fingerprintstring
hook_idinteger
limited_availabilityboolean
messagestring
namestring
old_userstring
openssh_public_keystring
orgstring
previous_visibilitystring
read_onlyboolean
repostring

The name of the repository.

repositorystring

The name of the repository.

repository_publicboolean
target_loginstring
teamstring
transport_protocolinteger

The type of protocol (for example, HTTP or SSH) used to transfer Git data.

transport_protocol_namestring

A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.

userstring

The user that was affected by the action performed (if available).

visibilitystring

The repository visibility, for example public or private.