You can search the audit log for a wide variety of actions.

Authentication

Name Description
oauth_access.create An OAuth access token was generated for a user account.
oauth_access.destroy An OAuth access token was deleted from a user account.
oauth_application.destroy An OAuth application was deleted from a user or organization account.
oauth_application.reset_secret An OAuth application's secret key was reset.
oauth_application.transfer An OAuth application was transferred from one user or organization account to another.
public_key.create An SSH key was added to a user account or a deploy key was added to a repository.
public_key.delete An SSH key was removed from a user account or a deploy key was removed from a repository.
public_key.update A user account's SSH key or a repository's deploy key was updated.
two_factor_authentication.enabled Two-factor authentication was enabled for a user account.
two_factor_authentication.disabled Two-factor authentication was disabled for a user account.

Hooks

Name Description
hook.create A new hook was added to a repository.
hook.config_changed A hook's configuration was changed.
hook.destroy A hook was deleted.
hook.events_changed A hook's configured events were changed.

Issues and pull requests

Name Description
issue.update An issue's body text (initial comment) changed.
issue_comment.update A comment on an issue (other than the initial one) changed.
pull_request_review_comment.delete A comment on a pull request was deleted.

Organizations

Name Description
org.async_delete A user initiated a background job to delete an organization.
org.delete An organization was deleted by a user-initiated background job.
org.transform A user account was converted into an organization. For more information, see Converting a user into an organization.

Protected branches

Name Description
protected_branch.create Branch protection is enabled on a branch.
protected_branch.destroy Branch protection is disabled on a branch.
protected_branch.update_admin_enforced Branch protection is enforced for repository administrators.
protected_branch.update_require_code_owner_review Enforcement of required Code Owner review is updated on a branch.
protected_branch.dismiss_stale_reviews Enforcement of dismissing stale pull requests is updated on a branch.
protected_branch.update_pull_request_reviews_enforcement_level Enforcement of required pull request reviews is updated on a branch.
protected_branch.update_required_status_checks_enforcement_level Enforcement of required status checks is updated on a branch.
protected_branch.rejected_ref_update A branch update attempt is rejected.
protected_branch.policy_override A branch protection requirement is overridden by a repository administrator.

Repositories

Name Description
repo.access A private repository was made public, or a public repository was made private.
repo.add_member A collaborator was added to a repository.
repo.config A site admin blocked force pushes. For more information, see Blocking force pushes to a repository to a repository.
repo.create A repository was created.
repo.destroy A repository was deleted.
repo.remove_member A collaborator was removed from a repository.
repo.rename A repository was renamed.
repo.transfer A user accepted a request to receive a transferred repository.
repo.transfer_start A user sent a request to transfer a repository to another user or organization.

Site admin tools

Name Description
staff.disable_repo A site admin disabled access to a repository and all of its forks.
staff.enable_repo A site admin re-enabled access to a repository and all of its forks.
staff.fake_login A site admin signed into GitHub Enterprise as another user.
staff.repo_unlock A site admin unlocked (temporarily gained full access to) one of a user's private repositories.
staff.unlock A site admin unlocked (temporarily gained full access to) all of a user's private repositories.

Teams

Name Description
team.create A user account or repository was added to a team.
team.delete A user account or repository was removed from a team.
team.destroy A team was deleted.

Users

Name Description
user.add_email An email address was added to a user account.
user.async_delete An asynchronous job was started to destroy a user account, eventually triggering user.delete.
user.change_password A user changed his or her password.
user.create A new user account was created.
user.delete A user account was destroyed by an asynchronous job.
user.demote A site admin was demoted to an ordinary user account.
user.destroy A user deleted his or her account, triggering user.async_delete.
user.failed_login A user tried to sign in with an incorrect username, password, or two-factor authentication code.
user.forgot_password A user requested a password reset via the sign-in page.
user.login A user signed in.
user.promote An ordinary user account was promoted to a site admin.
user.remove_email An email address was removed from a user account.
user.rename A username was changed.
user.suspend A user account was suspended by a site admin.
user.two_factor_requested A user was prompted for a two-factor authentication code.
user.unsuspend A user account was unsuspended by a site admin.