You can search the audit log for a wide variety of actions.
- Authentication
- Hooks
- Issues and pull requests
- Organizations
- Protected branches
- Repositories
- Site admin tools
- Teams
- Users
Authentication
Name | Description |
---|---|
oauth_access.create |
An OAuth access token was generated for a user account. |
oauth_access.destroy |
An OAuth access token was deleted from a user account. |
oauth_application.destroy |
An OAuth application was deleted from a user or organization account. |
oauth_application.reset_secret |
An OAuth application's secret key was reset. |
oauth_application.transfer |
An OAuth application was transferred from one user or organization account to another. |
public_key.create |
An SSH key was added to a user account or a deploy key was added to a repository. |
public_key.delete |
An SSH key was removed from a user account or a deploy key was removed from a repository. |
public_key.update |
A user account's SSH key or a repository's deploy key was updated. |
two_factor_authentication.enabled |
Two-factor authentication was enabled for a user account. |
two_factor_authentication.disabled |
Two-factor authentication was disabled for a user account. |
Hooks
Name | Description |
---|---|
hook.create |
A new hook was added to a repository. |
hook.config_changed |
A hook's configuration was changed. |
hook.destroy |
A hook was deleted. |
hook.events_changed |
A hook's configured events were changed. |
Issues and pull requests
Name | Description |
---|---|
issue.update |
An issue's body text (initial comment) changed. |
issue_comment.update |
A comment on an issue (other than the initial one) changed. |
pull_request_review_comment.delete |
A comment on a pull request was deleted. |
Organizations
Name | Description |
---|---|
org.async_delete |
A user initiated a background job to delete an organization. |
org.delete |
An organization was deleted by a user-initiated background job. |
org.transform |
A user account was converted into an organization. For more information, see Converting a user into an organization. |
Protected branches
Name | Description |
---|---|
protected_branch.create |
Branch protection is enabled on a branch. |
protected_branch.destroy |
Branch protection is disabled on a branch. |
protected_branch.update_admin_enforced |
Branch protection is enforced for repository administrators. |
protected_branch.update_require_code_owner_review |
Enforcement of required Code Owner review is updated on a branch. |
protected_branch.dismiss_stale_reviews |
Enforcement of dismissing stale pull requests is updated on a branch. |
protected_branch.update_pull_request_reviews_enforcement_level |
Enforcement of required pull request reviews is updated on a branch. |
protected_branch.update_required_status_checks_enforcement_level |
Enforcement of required status checks is updated on a branch. |
protected_branch.rejected_ref_update |
A branch update attempt is rejected. |
protected_branch.policy_override |
A branch protection requirement is overridden by a repository administrator. |
Repositories
Name | Description |
---|---|
repo.access |
A private repository was made public, or a public repository was made private. |
repo.add_member |
A collaborator was added to a repository. |
repo.config |
A site admin blocked force pushes. For more information, see Blocking force pushes to a repository to a repository. |
repo.create |
A repository was created. |
repo.destroy |
A repository was deleted. |
repo.remove_member |
A collaborator was removed from a repository. |
repo.rename |
A repository was renamed. |
repo.transfer |
A user accepted a request to receive a transferred repository. |
repo.transfer_start |
A user sent a request to transfer a repository to another user or organization. |
Site admin tools
Name | Description |
---|---|
staff.disable_repo |
A site admin disabled access to a repository and all of its forks. |
staff.enable_repo |
A site admin re-enabled access to a repository and all of its forks. |
staff.fake_login |
A site admin signed into GitHub Enterprise as another user. |
staff.repo_unlock |
A site admin unlocked (temporarily gained full access to) one of a user's private repositories. |
staff.unlock |
A site admin unlocked (temporarily gained full access to) all of a user's private repositories. |
Teams
Name | Description |
---|---|
team.create |
A user account or repository was added to a team. |
team.delete |
A user account or repository was removed from a team. |
team.destroy |
A team was deleted. |
Users
Name | Description |
---|---|
user.add_email |
An email address was added to a user account. |
user.async_delete |
An asynchronous job was started to destroy a user account, eventually triggering user.delete . |
user.change_password |
A user changed his or her password. |
user.create |
A new user account was created. |
user.delete |
A user account was destroyed by an asynchronous job. |
user.demote |
A site admin was demoted to an ordinary user account. |
user.destroy |
A user deleted his or her account, triggering user.async_delete . |
user.failed_login |
A user tried to sign in with an incorrect username, password, or two-factor authentication code. |
user.forgot_password |
A user requested a password reset via the sign-in page. |
user.login |
A user signed in. |
user.promote |
An ordinary user account was promoted to a site admin. |
user.remove_email |
An email address was removed from a user account. |
user.rename |
A username was changed. |
user.suspend |
A user account was suspended by a site admin. |
user.two_factor_requested |
A user was prompted for a two-factor authentication code. |
user.unsuspend |
A user account was unsuspended by a site admin. |