Audited actions

You can search the audit log for a wide variety of actions.

Authentication

ActionDescription
oauth_access.createAn OAuth access token was generated for a user account.
oauth_access.destroyAn OAuth access token was deleted from a user account.
oauth_application.destroyAn OAuth application was deleted from a user or organization account.
oauth_application.reset_secretAn OAuth application's secret key was reset.
oauth_application.transferAn OAuth application was transferred from one user or organization account to another.
public_key.createAn SSH key was added to a user account or a deploy key was added to a repository.
public_key.deleteAn SSH key was removed from a user account or a deploy key was removed from a repository.
public_key.updateA user account's SSH key or a repository's deploy key was updated.

Hooks

ActionDescription
hook.createA new hook was added to a repository.
hook.config_changedA hook's configuration was changed.
hook.destroyA hook was deleted.
hook.events_changedA hook's configured events were changed.

Enterprise configuration settings

ActionDescription
business.clear_members_can_create_reposA site admin clears a restriction on repository creation in organizations in the enterprise. For more information, see "Enforcing repository management policies in your enterprise."
business.update_member_repository_creation_permissionA site admin restricts repository creation in organizations in the enterprise. For more information, see "Enforcing repository management policies in your enterprise."

IP allow lists

NameDescription
ip_allow_list_entry.createAn IP address was added to an IP allow list.
ip_allow_list_entry.updateAn IP address or its description was changed.
ip_allow_list_entry.destroyAn IP address was deleted from an IP allow list.
ip_allow_list.enableAn IP allow list was enabled.
ip_allow_list.enable_for_installed_appsAn IP allow list was enabled for installed GitHub Apps.
ip_allow_list.disableAn IP allow list was disabled.
ip_allow_list.disable_for_installed_appsAn IP allow list was disabled for installed GitHub Apps.

Issues

ActionDescription
issue.updateAn issue's body text (initial comment) changed.
issue_comment.updateA comment on an issue (other than the initial one) changed.
issue.destroyAn issue was deleted from the repository. For more information, see "Deleting an issue."

Organizations

ActionDescription
org.async_deleteA user initiated a background job to delete an organization.
org.deleteAn organization was deleted by a user-initiated background job.

Pull requests

ActionDescription
pull_request_review_comment.deleteA review comment on a pull request was deleted.

Protected branches

ActionDescription
protected_branch.create Branch protection is enabled on a branch.
protected_branch.destroyBranch protection is disabled on a branch.
protected_branch.update_admin_enforced Branch protection is enforced for repository administrators.
protected_branch.update_require_code_owner_review Enforcement of required code owner review is updated on a branch.
protected_branch.dismiss_stale_reviews Enforcement of dismissing stale pull requests is updated on a branch.
protected_branch.update_signature_requirement_enforcement_level Enforcement of required commit signing is updated on a branch.
protected_branch.update_pull_request_reviews_enforcement_level Enforcement of required pull request reviews is updated on a branch.
protected_branch.update_required_status_checks_enforcement_level Enforcement of required status checks is updated on a branch.
protected_branch.rejected_ref_update A branch update attempt is rejected.
protected_branch.policy_override A branch protection requirement is overridden by a repository administrator.

Repositories

ActionDescription
repo.accessThe visibility of a repository changed to private or internal.
repo.archivedA repository was archived. For more information, see "Archiving a GitHub repository."
repo.add_memberA collaborator was added to a repository.
repo.configA site admin blocked force pushes. For more information, see Blocking force pushes to a repository to a repository.
repo.createA repository was created.
repo.destroyA repository was deleted.
repo.remove_memberA collaborator was removed from a repository.
repo.renameA repository was renamed.
repo.transferA user accepted a request to receive a transferred repository.
repo.transfer_startA user sent a request to transfer a repository to another user or organization.
repo.unarchivedA repository was unarchived. For more information, see "Archiving a GitHub repository."

Site admin tools

ActionDescription
staff.disable_repoA site admin disabled access to a repository and all of its forks.
staff.enable_repoA site admin re-enabled access to a repository and all of its forks.
staff.fake_loginA site admin signed into GitHub AE as another user.
staff.repo_unlockA site admin unlocked (temporarily gained full access to) one of a user's private repositories.
staff.unlockA site admin unlocked (temporarily gained full access to) all of a user's private repositories.

Teams

ActionDescription
team.createA user account or repository was added to a team.
team.deleteA user account or repository was removed from a team.
team.demote_maintainerA user was demoted from a team maintainer to a team member.
team.destroyA team was deleted.
team.promote_maintainerA user was promoted from a team member to a team maintainer.

Users

ActionDescription
user.add_emailAn email address was added to a user account.
user.async_deleteAn asynchronous job was started to destroy a user account, eventually triggering user.delete.
user.createA new user account was created.
user.deleteA user account was destroyed by an asynchronous job.
user.demoteA site admin was demoted to an ordinary user account.
user.destroyA user deleted his or her account, triggering user.async_delete.
user.loginA user signed in.
user.mandatory_message_viewedA user views a mandatory message (see "Customizing user messages" for details)
user.promoteAn ordinary user account was promoted to a site admin.
user.remove_emailAn email address was removed from a user account.
user.renameA username was changed.
user.suspendA user account was suspended by a site admin.
user.unsuspendA user account was unsuspended by a site admin.

Did this doc help you?Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Or, learn how to contribute.