Security log events

Note: This article contains the events that may appear in your user account's security log. For the events that can appear in an organization's audit log or the audit log for an enterprise, see "Audit log events for your organization" and "Audit log events for your enterprise."

About security log events

The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the repo.create entry refers to the create operation on the repo category. The reference information in this article is grouped by categories.

account

Action	Description
`account.plan_change`	The account's plan changed.

artifact

Action	Description
`artifact.destroy`	A workflow run artifact was manually deleted.

billing

Action	Description
`billing.change_billing_type`	The way the account pays for GitHub was changed.
`billing.change_email`	The billing email address changed.

business

Action	Description
`business.set_actions_fork_pr_approvals_policy`	The setting for requiring approvals for workflows from public forks was changed for an enterprise.
`business.set_actions_retention_limit`	The retention period for GitHub Actions artifacts and logs was changed for an enterprise.
`business.set_fork_pr_workflows_policy`	The policy for fork pull requests is changed.

checks

Action	Description
`checks.auto_trigger_disabled`	Automatic creation of check suites was disabled on a repository in the organization or enterprise.
`checks.auto_trigger_enabled`	Automatic creation of check suites was enabled on a repository in the organization or enterprise.
`checks.delete_logs`	Logs in a check suite were deleted.

codespaces

Action	Description
`codespaces.allow_permissions`	A codespace using custom permissions from its devcontainer.json file was launched.
`codespaces.connect`	A codespace was started.
`codespaces.create`	A codespace was created
`codespaces.destroy`	A user deleted a codespace.
`codespaces.trusted_repositories_access_update`	Triggered when you change your personal account's access and security setting for Codespaces.

copilot

Action	Description
`copilot.cfb_seat_added`	A seat was added to the Copilot for Business subscription for a user and they have received access to GitHub Copilot.
`copilot.cfb_seat_assignment_created`	A seat assignment was newly created for a user.
`copilot.cfb_seat_assignment_refreshed`	A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to GitHub Copilot.
`copilot.cfb_seat_assignment_reused`	A seat assignment was re-created for a user who already had a seat with no pending cancellation date.
`copilot.cfb_seat_assignment_unassigned`	A seat was unassigned from a user and they will lose access to GitHub Copilot at the end of the billing cycle.
`copilot.cfb_seat_cancelled`	A seat was canceled from the Copilot for Business subscription and the user no longer has access to GitHub Copilot.
`copilot.cfb_seat_cancelled_by_staff`	A seat was canceled from the Copilot for Business subscription manually by GitHub and the user no longer has access to GitHub Copilot.

dependabot_alerts

Action	Description
`dependabot_alerts.disable`	Dependabot alerts were disabled for all existing repositories.
`dependabot_alerts.enable`	Dependabot alerts were enabled for all existing repositories.

dependabot_alerts_new_repos

Action	Description
`dependabot_alerts_new_repos.disable`	Dependabot alerts were disabled for all new repositories.
`dependabot_alerts_new_repos.enable`	Dependabot alerts were enabled for all new repositories.

dependabot_repository_access

Action	Description
`dependabot_repository_access.repositories_updated`	The repositories that Dependabot can access were updated.

dependabot_security_updates

Action	Description
`dependabot_security_updates.disable`	Dependabot security updates were disabled for all existing repositories.
`dependabot_security_updates.enable`	Dependabot security updates were enabled for all existing repositories.

dependabot_security_updates_new_repos

Action	Description
`dependabot_security_updates_new_repos.disable`	Dependabot security updates were disabled for all new repositories.
`dependabot_security_updates_new_repos.enable`	Dependabot security updates were enabled for all new repositories.

dependency_graph

Action	Description
`dependency_graph.disable`	The dependency graph was disabled for all existing repositories.
`dependency_graph.enable`	The dependency graph was enabled for all existing repositories.

dependency_graph_new_repos

Action	Description
`dependency_graph_new_repos.disable`	The dependency graph was disabled for all new repositories.
`dependency_graph_new_repos.enable`	The dependency graph was enabled for all new repositories.

environment

Action	Description
`environment.add_protection_rule`	A GitHub Actions deployment protection rule was created via the API.
`environment.create_actions_secret`	A secret was created for a GitHub Actions environment.
`environment.delete`	An environment was deleted.
`environment.remove_actions_secret`	A secret was deleted for a GitHub Actions environment.
`environment.remove_protection_rule`	A GitHub Actions deployment protection rule was deleted via the API.
`environment.update_actions_secret`	A secret was updated for a GitHub Actions environment.
`environment.update_protection_rule`	A GitHub Actions deployment protection rule was updated via the API.

hook

Action	Description
`hook.active_changed`	A hook's active status was updated.
`hook.config_changed`	A hook's configuration was changed.
`hook.create`	A new hook was added.
`hook.destroy`	A hook was deleted.
`hook.events_changed`	A hook's configured events were changed.

integration

Action	Description
`integration.create`	An integration was created.
`integration.destroy`	An integration was deleted.
`integration.manager_added`	A member of an enterprise or organization was added as an integration manager.
`integration.manager_removed`	A member of an enterprise or organization was removed from being an integration manager.
`integration.remove_client_secret`	A client secret for an integration was removed.
`integration.revoke_all_tokens`	All user tokens for an integration were requested to be revoked.
`integration.revoke_tokens`	Token(s) for an integration were revoked.
`integration.transfer`	Ownership of an integration was transferred to another user or organization.

integration_installation

Action	Description
`integration_installation.create`	An integration was installed.
`integration_installation.destroy`	An integration was uninstalled.
`integration_installation.repositories_added`	Repositories were added to an integration.
`integration_installation.repositories_removed`	Repositories were removed from an integration.
`integration_installation.suspend`	An integration was suspended.
`integration_installation.unsuspend`	An integration was unsuspended.
`integration_installation.version_updated`	Permissions for an integration were updated.

marketplace_agreement_signature

Action	Description
`marketplace_agreement_signature.create`	The GitHub Marketplace Developer Agreement was signed.

marketplace_listing

Action	Description
`marketplace_listing.approve`	A listing was approved for inclusion in GitHub Marketplace.
`marketplace_listing.change_category`	A category for a listing for an app in GitHub Marketplace was changed.
`marketplace_listing.create`	A listing for an app in GitHub Marketplace was created.
`marketplace_listing.delist`	A listing was removed from GitHub Marketplace.
`marketplace_listing.redraft`	A listing was sent back to draft state.
`marketplace_listing.reject`	A listing was not accepted for inclusion in GitHub Marketplace.

migration

Action	Description
`migration.create`	A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.

oauth_application

Action	Description
`oauth_application.create`	An OAuth application was created.
`oauth_application.destroy`	An OAuth application was deleted.
`oauth_application.generate_client_secret`	An OAuth application's secret key was generated.
`oauth_application.remove_client_secret`	An OAuth application's secret key was deleted.
`oauth_application.reset_secret`	The secret key for an OAuth application was reset.
`oauth_application.revoke_all_tokens`	All user tokens for an OAuth application were requested to be revoked.
`oauth_application.revoke_tokens`	Token(s) for an OAuth application were revoked.
`oauth_application.transfer`	An OAuth application was transferred from one account to another.

org

Action	Description
`org.add_member`	A user joined an organization.
`org.advanced_security_disabled_for_new_repos`	GitHub Advanced Security was disabled for new repositories in an organization.
`org.advanced_security_disabled_on_all_repos`	GitHub Advanced Security was disabled for all repositories in an organization.
`org.advanced_security_enabled_for_new_repos`	GitHub Advanced Security was enabled for new repositories in an organization.
`org.advanced_security_enabled_on_all_repos`	GitHub Advanced Security was enabled for all repositories in an organization.
`org.remove_member`	A member was removed from an organization, either manually or due to a two-factor authentication requirement.
`org.set_actions_fork_pr_approvals_policy`	The setting for requiring approvals for workflows from public forks was changed for an organization.
`org.set_actions_retention_limit`	The retention period for GitHub Actions artifacts and logs in an organization was changed.
`org.set_fork_pr_workflows_policy`	The policy for workflows on private repository forks was changed.
`org.update_member`	A person's role was changed from owner to member or member to owner.
`org.update_member_repository_creation_permission`	The create repository permission for organization members was changed.
`org.update_member_repository_invitation_permission`	An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.

pages_protected_domain

Action	Description
`pages_protected_domain.create`	A GitHub Pages verified domain was created for an organization or enterprise.
`pages_protected_domain.delete`	A GitHub Pages verified domain was deleted from an organization or enterprise.
`pages_protected_domain.verify`	A GitHub Pages domain was verified for an organization or enterprise.

payment_method

Action	Description
`payment_method.create`	A new payment method was added, such as a new credit card or PayPal account.
`payment_method.remove`	A payment method was removed.
`payment_method.update`	An existing payment method was updated.

personal_access_token

Action	Description
`personal_access_token.access_granted`	A fine-grained personal access token was granted access to resources.
`personal_access_token.access_revoked`	A fine-grained personal access token was revoked. The token can still read public organization resources.
`personal_access_token.request_cancelled`	A pending request for a fine-grained personal access token to access organization resources was canceled.
`personal_access_token.request_created`	Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.
`personal_access_token.request_denied`	A request for a fine-grained personal access token to access organization resources was denied.

profile_picture

Action	Description
`profile_picture.update`	A profile picture was updated.

project

Action	Description
`project.access`	A project board visibility was changed.
`project.close`	A project board was closed.
`project.create`	A project board was created.
`project.delete`	A project board was deleted.
`project.link`	A repository was linked to a project board.
`project.open`	A project board was reopened.
`project.rename`	A project board was renamed.
`project.unlink`	A repository was unlinked from a project board.
`project.update_org_permission`	The project's base-level permission for all organization members was changed or removed.
`project.update_team_permission`	A team's project board permission level was changed or when a team was added or removed from a project board.
`project.update_user_permission`	A user was added to or removed from a project board or had their permission level changed.

project_field

Action	Description
`project_field.create`	A field was created in a project board.
`project_field.delete`	A field was deleted in a project board.

project_view

Action	Description
`project_view.create`	A view was created in a project board.
`project_view.delete`	A view was deleted in a project board.

public_key

Action	Description
`public_key.create`	An SSH key was added to a user account or a deploy key was added to a repository.
`public_key.delete`	An SSH key was removed from a user account or a deploy key was removed from a repository.
`public_key.unverification_failure`	A user account's SSH key or a repository's deploy key was unable to be unverified.
`public_key.unverify`	A user account's SSH key or a repository's deploy key was unverified.
`public_key.update`	A user account's SSH key or a repository's deploy key was updated.
`public_key.verification_failure`	A user account's SSH key or a repository's deploy key was unable to be verified.
`public_key.verify`	A user account's SSH key or a repository's deploy key was verified.

repo

Action	Description
`repo.access`	The visibility of a repository changed.
`repo.actions_enabled`	GitHub Actions was enabled for a repository. Can be viewed using the UI, This event is not included when you access the audit log using the REST API.
`repo.add_member`	A collaborator was added to a repository.
`repo.add_topic`	A topic was added to a repository.
`repo.advanced_security_disabled`	GitHub Advanced Security was disabled for a repository.
`repo.advanced_security_enabled`	GitHub Advanced Security was enabled for a repository.
`repo.archived`	A repository was archived.
`repo.change_merge_setting`	Pull request merge options were changed for a repository.
`repo.code_scanning_analysis_deleted`	Code scanning analysis for a repository was deleted.
`repo.code_scanning_configuration_for_branch_deleted`	A code scanning configuration for a branch of a repository was deleted.
`repo.config.disable_collaborators_only`	The interaction limit for collaborators only was disabled.
`repo.config.disable_contributors_only`	The interaction limit for prior contributors only was disabled in a repository.
`repo.config.disable_sockpuppet_disallowed`	The interaction limit for existing users only was disabled in a repository.
`repo.config.enable_collaborators_only`	The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.
`repo.config.enable_contributors_only`	The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.
`repo.config.enable_sockpuppet_disallowed`	The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.
`repo.create`	A repository was created.
`repo.create_actions_secret`	A GitHub Actions secret was created for a repository.
`repo.create_integration_secret`	An integration secret was created for a repository.
`repo.destroy`	A repository was deleted.
`repo.pages_cname`	A GitHub Pages custom domain was modified in a repository.
`repo.pages_create`	A GitHub Pages site was created.
`repo.pages_destroy`	A GitHub Pages site was deleted.
`repo.pages_https_redirect_disabled`	HTTPS redirects were disabled for a GitHub Pages site.
`repo.pages_https_redirect_enabled`	HTTPS redirects were enabled for a GitHub Pages site.
`repo.pages_private`	A GitHub Pages site visibility was changed to private.
`repo.pages_public`	A GitHub Pages site visibility was changed to public.
`repo.pages_source`	A GitHub Pages source was modified.
`repo.register_self_hosted_runner`	A new self-hosted runner was registered.
`repo.remove_actions_secret`	A GitHub Actions secret was deleted for a repository.
`repo.remove_integration_secret`	An integration secret was deleted for a repository.
`repo.remove_member`	A collaborator was removed from a repository.
`repo.remove_self_hosted_runner`	A self-hosted runner was removed.
`repo.remove_topic`	A topic was removed from a repository.
`repo.rename`	A repository was renamed.
`repo.set_actions_fork_pr_approvals_policy`	The setting for requiring approvals for workflows from public forks was changed for a repository.
`repo.set_actions_retention_limit`	The retention period for GitHub Actions artifacts and logs in a repository was changed.
`repo.set_fork_pr_workflows_policy`	Triggered when the policy for workflows on private repository forks is changed.
`repo.staff_unlock`	An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.
`repo.temporary_access_granted`	Temporary access was enabled for a repository.
`repo.transfer`	A user accepted a request to receive a transferred repository.
`repo.transfer_outgoing`	A repository was transferred to another repository network.
`repo.transfer_start`	A user sent a request to transfer a repository to another user or organization.
`repo.unarchived`	A repository was unarchived.
`repo.update_actions_access_settings`	The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.
`repo.update_actions_secret`	A GitHub Actions secret was updated.
`repo.update_actions_settings`	A repository administrator changed GitHub Actions policy settings for a repository.
`repo.update_default_branch`	The default branch for a repository was changed.
`repo.update_integration_secret`	An integration secret was updated for a repository.
`repo.update_member`	A user's permission to a repository was changed.

repository_image

Action	Description
`repository_image.create`	An image to represent a repository was uploaded.
`repository_image.destroy`	An image to represent a repository was deleted.

repository_invitation

Action	Description
`repository_invitation.accept`	An invitation to join a repository was accepted.
`repository_invitation.cancel`	An invitation to join a repository was canceled.
`repository_invitation.create`	An invitation to join a repository was sent.
`repository_invitation.reject`	An invitation to join a repository was declined.

workflows

Action	Description
`workflows.approve_workflow_job`	A workflow job was approved.
`workflows.delete_workflow_run`	A workflow run was deleted.
`workflows.disable_workflow`	A workflow was disabled.
`workflows.enable_workflow`	A workflow was enabled, after previously being disabled by disable_workflow.
`workflows.reject_workflow_job`	A workflow job was rejected.

Action	Description
`sponsors.agreement_sign`	A GitHub Sponsors agreement was signed on behalf of an organization.
`sponsors.custom_amount_settings_change`	Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.
`sponsors.fiscal_host_change`	The fiscal host for a GitHub Sponsors listing was updated.
`sponsors.repo_funding_links_file_action`	The FUNDING file in a repository was changed.
`sponsors.sponsored_developer_approve`	A GitHub Sponsors account was approved.
`sponsors.sponsored_developer_create`	A GitHub Sponsors account was created.
`sponsors.sponsored_developer_disable`	A GitHub Sponsors account was disabled.
`sponsors.sponsored_developer_profile_update`	The profile for GitHub Sponsors account was edited.
`sponsors.sponsored_developer_redraft`	A GitHub Sponsors account was returned to draft state from approved state.
`sponsors.sponsored_developer_request_approval`	An application for GitHub Sponsors was submitted for approval.
`sponsors.sponsored_developer_tier_description_update`	The description for a sponsorship tier was changed.
`sponsors.sponsor_sponsorship_cancel`	A sponsorship was canceled.
`sponsors.sponsor_sponsorship_create`	A sponsorship was created, by sponsoring an account.
`sponsors.sponsor_sponsorship_payment_complete`	After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.
`sponsors.sponsor_sponsorship_preference_change`	The option to receive email updates from a sponsored account was changed.
`sponsors.sponsor_sponsorship_tier_change`	A sponsorship was upgraded or downgraded.
`sponsors.update_tier_repository`	A GitHub Sponsors tier changed access for a repository.
`sponsors.update_tier_welcome_message`	The welcome message for a GitHub Sponsors tier for an organization was updated.
`sponsors.withdraw_agreement_signature`	A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.

Security log events

In this article