You can maintain compliance for your enterprise and secure your intellectual property by interacting with the audit log using the REST API. For more information about the specific events that you can access via the audit log API, see the following articles.
- "Audit log events for your enterprise"
- "Audit log events for your organization"
- "Security log events"
The audit log lists events triggered by activities that affect your enterprise. Audit logs for GitHub Enterprise Server are retained indefinitely, unless an enterprise owner configured a different retention period. For more information, see "Configuring the audit log for your enterprise."
By default, only events from the past three months are displayed. To view older events, you must specify a date range with the
created parameter. For more information, see "Understanding the search syntax."
Timestamps and date fields in the API response are measured in UTC epoch milliseconds.
You can use the
read:audit_log scope to access the audit log via the API.
You can use page-based pagination. For more information about pagination, see "Using pagination in the REST API."
The query below searches for audit log events created on Jan 1st, 2022 in the
avocado-corp enterprise, and return the first page with a maximum of 100 items per page using pagination. For more information about pagination, see "Using pagination in the REST API."
curl -H "Authorization: Bearer TOKEN" \ --request GET \ "https://api.github.com/enterprises/avocado-corp/audit-log?phrase=created:2022-01-01&page=1&per_page=100"
You can specify multiple search phrases, such as
actor, by separating them in your formed URL with the
+ symbol or ASCII character code
The query below searches for audit log events for pull requests, where the event occurred on or after Jan 1st, 2022 in the
avocado-corp enterprise, and the action was performed by the
curl -H "Authorization: Bearer TOKEN" \ --request GET \ "https://api.github.com/enterprises/avocado-corp/audit-log?phrase=action:pull_request+created:>=2022-01-01+actor:octocat"