Notes:
- This article contains the events available in the latest version of GitHub Enterprise Server. Some of the events may not be available in previous versions.
- This article contains the events that may appear in your user account's security log. For the events that can appear in an organization's audit log or the audit log for an enterprise, see "Audit log events for your organization" and "Audit log events for your enterprise."
About security log events
The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the repo.create entry refers to the create operation on the repo category. The reference information in this article is grouped by categories.
business
| Action | Description |
|---|---|
business.set_actions_retention_limit | The retention period for GitHub Actions artifacts and logs was changed for an enterprise. |
checks
| Action | Description |
|---|---|
checks.auto_trigger_disabled | Automatic creation of check suites was disabled on a repository in the organization or enterprise. |
checks.auto_trigger_enabled | Automatic creation of check suites was enabled on a repository in the organization or enterprise. |
hook
| Action | Description |
|---|---|
hook.config_changed | A hook's configuration was changed. |
hook.create | A new hook was added. |
hook.destroy | A hook was deleted. |
hook.events_changed | A hook's configured events were changed. |
integration
| Action | Description |
|---|---|
integration.create | An integration was created. |
integration.destroy | An integration was deleted. |
integration.manager_added | A member of an enterprise or organization was added as an integration manager. |
integration.manager_removed | A member of an enterprise or organization was removed from being an integration manager. |
integration.transfer | Ownership of an integration was transferred to another user or organization. |
integration_installation
| Action | Description |
|---|---|
integration_installation.create | An integration was installed. |
integration_installation.destroy | An integration was uninstalled. |
integration_installation.repositories_added | Repositories were added to an integration. |
integration_installation.repositories_removed | Repositories were removed from an integration. |
integration_installation.version_updated | Permissions for an integration were updated. |
oauth_application
| Action | Description |
|---|---|
oauth_application.create | An OAuth application was created. |
oauth_application.destroy | An OAuth application was deleted. |
oauth_application.reset_secret | The secret key for an OAuth application was reset. |
oauth_application.revoke_tokens | Token(s) for an OAuth application were revoked. |
oauth_application.transfer | An OAuth application was transferred from one account to another. |
oauth_authorization
| Action | Description |
|---|---|
oauth_authorization.create | An authorization for an OAuth application was created. |
oauth_authorization.destroy | An authorization for an OAuth application was deleted. |
org
| Action | Description |
|---|---|
org.add_member | A user joined an organization. |
org.advanced_security_disabled_for_new_repos | GitHub Advanced Security was disabled for new repositories in an organization. |
org.advanced_security_disabled_on_all_repos | GitHub Advanced Security was disabled for all repositories in an organization. |
org.advanced_security_enabled_for_new_repos | GitHub Advanced Security was enabled for new repositories in an organization. |
org.advanced_security_enabled_on_all_repos | GitHub Advanced Security was enabled for all repositories in an organization. |
org.remove_member | A member was removed from an organization, either manually or due to a two-factor authentication requirement. |
org.set_actions_retention_limit | The retention period for GitHub Actions artifacts and logs in an organization was changed. |
org.update_member_repository_creation_permission | The create repository permission for organization members was changed. |
org.update_member_repository_invitation_permission | An organization owner changed the policy setting for organization members inviting outside collaborators to repositories. |
public_key
| Action | Description |
|---|---|
public_key.create | An SSH key was added to a user account or a deploy key was added to a repository. |
public_key.delete | An SSH key was removed from a user account or a deploy key was removed from a repository. |
public_key.unverification_failure | A user account's SSH key or a repository's deploy key was unable to be unverified. |
public_key.unverify | A user account's SSH key or a repository's deploy key was unverified. |
public_key.update | A user account's SSH key or a repository's deploy key was updated. |
public_key.verification_failure | A user account's SSH key or a repository's deploy key was unable to be verified. |
public_key.verify | A user account's SSH key or a repository's deploy key was verified. |
repo
| Action | Description |
|---|---|
repo.access | The visibility of a repository changed. |
repo.add_member | A collaborator was added to a repository. |
repo.add_topic | A topic was added to a repository. |
repo.advanced_security_disabled | GitHub Advanced Security was disabled for a repository. |
repo.advanced_security_enabled | GitHub Advanced Security was enabled for a repository. |
repo.archived | A repository was archived. |
repo.change_merge_setting | Pull request merge options were changed for a repository. |
repo.code_scanning_analysis_deleted | Code scanning analysis for a repository was deleted. |
repo.code_scanning_configuration_for_branch_deleted | A code scanning configuration for a branch of a repository was deleted. |
repo.config.disable_collaborators_only | The interaction limit for collaborators only was disabled. |
repo.config.disable_contributors_only | The interaction limit for prior contributors only was disabled in a repository. |
repo.config.disable_sockpuppet_disallowed | The interaction limit for existing users only was disabled in a repository. |
repo.config.enable_collaborators_only | The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration. |
repo.config.enable_contributors_only | The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration. |
repo.config.enable_sockpuppet_disallowed | The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository. |
repo.create | A repository was created. |
repo.destroy | A repository was deleted. |
repo.pages_cname | A GitHub Pages custom domain was modified in a repository. |
repo.pages_create | A GitHub Pages site was created. |
repo.pages_destroy | A GitHub Pages site was deleted. |
repo.pages_https_redirect_disabled | HTTPS redirects were disabled for a GitHub Pages site. |
repo.pages_https_redirect_enabled | HTTPS redirects were enabled for a GitHub Pages site. |
repo.pages_private | A GitHub Pages site visibility was changed to private. |
repo.pages_public | A GitHub Pages site visibility was changed to public. |
repo.pages_source | A GitHub Pages source was modified. |
repo.register_self_hosted_runner | A new self-hosted runner was registered. |
repo.remove_member | A collaborator was removed from a repository. |
repo.remove_self_hosted_runner | A self-hosted runner was removed. |
repo.remove_topic | A topic was removed from a repository. |
repo.rename | A repository was renamed. |
repo.set_actions_retention_limit | The retention period for GitHub Actions artifacts and logs in a repository was changed. |
repo.staff_unlock | An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository. |
repo.transfer | A user accepted a request to receive a transferred repository. |
repo.transfer_outgoing | A repository was transferred to another repository network. |
repo.transfer_start | A user sent a request to transfer a repository to another user or organization. |
repo.unarchived | A repository was unarchived. |
repo.update_actions_access_settings | The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed. |
repo.update_actions_settings | A repository administrator changed GitHub Actions policy settings for a repository. |
repo.update_member | A user's permission to a repository was changed. |
repository_invitation
| Action | Description |
|---|---|
repository_invitation.accept | An invitation to join a repository was accepted. |
repository_invitation.cancel | An invitation to join a repository was canceled. |
repository_invitation.create | An invitation to join a repository was sent. |
repository_invitation.reject | An invitation to join a repository was declined. |
repository_ruleset
| Action | Description |
|---|---|
repository_ruleset.create | A repository ruleset was created. |
repository_ruleset.destroy | A repository ruleset was deleted. |
repository_ruleset.update | A repository ruleset was edited. |
security_key
| Action | Description |
|---|---|
security_key.register | A security key was registered for an account. |
security_key.remove | A security key was removed from an account. |
two_factor_authentication
| Action | Description |
|---|---|
two_factor_authentication.add_factor | A secondary authentication factor was added to a user account. |
two_factor_authentication.disabled | Two-factor authentication was disabled for a user account. |
two_factor_authentication.enabled | Two-factor authentication was enabled for a user account. |
two_factor_authentication.password_reset_fallback_sms | A one-time password code was sent to a user account fallback phone number. |
two_factor_authentication.recovery_codes_regenerated | Two factor recovery codes were regenerated for a user account. |
two_factor_authentication.remove_factor | A secondary authentication factor was removed from a user account. |
two_factor_authentication.sign_in_fallback_sms | A one-time password code was sent to a user account fallback phone number. |
two_factor_authentication.update_fallback | The two-factor authentication fallback for a user account was changed. |
user
| Action | Description |
|---|---|
user.add_email | An email address was added to a user account. |
user.async_delete | An asynchronous job was started to destroy a user account, eventually triggering a user.delete event. |
user.block_user | A user was blocked by another user. |
user.change_password | A user changed their password. |
user.create | A new user account was created. |
user.creation_rate_limit_exceeded | The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly. |
user.delete | A user account was destroyed by an asynchronous job. |
user.demote | A site administrator was demoted to an ordinary user account. |
user.destroy | A user deleted his or her account, triggering user.async_delete. |
user.failed_login | A user tried to sign in with an incorrect username, password, or two-factor authentication code. |
user.forgot_password | A user requested a password reset. |
user.hide_private_contributions_count | A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden. |
user.login | A user signed in. |
user.logout | A user signed out. |
user.promote | An ordinary user account was promoted to a site administrator. |
user.recreate | A user's account was restored. |
user.remove_email | An email address was removed from a user account. |
user.rename | A username was changed. |
user.reset_password | A user reset their account password. |
user.show_private_contributions_count | A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown. |
user.sign_in_from_unrecognized_device | A user signed in from an unrecognized device. |
user.sign_in_from_unrecognized_device_and_location | A user signed in from an unrecognized device and location. |
user.suspend | A user account was suspended. |
user.two_factor_challenge_failure | A 2FA challenge issued for a user account failed. |
user.two_factor_challenge_success | A 2FA challenge issued for a user account succeeded. |
user.two_factor_recover | A user used their 2FA recovery codes. |
user.two_factor_recovery_codes_downloaded | A user downloaded 2FA recovery codes for their account. |
user.two_factor_recovery_codes_printed | A user printed 2FA recovery codes for their account. |
user.two_factor_recovery_codes_viewed | A user viewed 2FA recovery codes for their account. |
user.two_factor_requested | A user was prompted for a two-factor authentication code. |
user.unblock_user | A user was unblocked by another user. |
user.unsuspend | A user account was unsuspended. |
workflows
| Action | Description |
|---|---|
workflows.approve_workflow_job | A workflow job was approved. |
workflows.delete_workflow_run | A workflow run was deleted. |
workflows.disable_workflow | A workflow was disabled. |
workflows.enable_workflow | A workflow was enabled, after previously being disabled by disable_workflow. |
workflows.reject_workflow_job | A workflow job was rejected. |