Audit log events for your enterprise

Notes:

This article contains the events available in the latest version of GitHub Enterprise Server. Some of the events may not be available in previous versions.
This article contains the events that may appear in the enterprise settings, specifically. The audit log in the site admin dashboard may contain additional events not listed here.
This article contains the events that may appear in the audit log for an enterprise. For the events that can appear in a user account's security log or the audit log for an organization, see "Security log events" and "Audit log events for your organization."

About audit log events for your enterprise

The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the repo.create entry refers to the create operation on the repo category. The reference information in this article is grouped by categories.

Action	Description
`business.add_admin`	An enterprise owner was added to an enterprise.
`business.add_organization`	An organization was added to an enterprise.
`business.advanced_security_policy_update`	An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.
`business.clear_actions_settings`	An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.
`business.clear_default_repository_permission`	An enterprise owner cleared the base repository permission policy setting for an enterprise.
`business.clear_members_can_create_repos`	An enterprise owner cleared a restriction on repository creation in organizations in the enterprise.
`business.create`	An enterprise was created.
`business.disable_source_ip_disclosure`	Display of IP addresses within audit log events for the enterprise was disabled.
`business.disable_two_factor_requirement`	The requirement for members to have two-factor authentication enabled to access an enterprise was disabled.
`business.enable_source_ip_disclosure`	Display of IP addresses within audit log events for the enterprise was enabled.
`business.enable_two_factor_requirement`	The requirement for members to have two-factor authentication enabled to access an enterprise was enabled.
`business.members_can_update_protected_branches.clear`	An enterprise owner unset a policy for whether members of an enterprise can update protected branches on repositories for individual organizations. Organization owners can choose whether to allow updating protected branches settings.
`business.members_can_update_protected_branches.disable`	The ability for enterprise members to update branch protection rules was disabled. Only enterprise owners can update protected branches.
`business.members_can_update_protected_branches.enable`	The ability for enterprise members to update branch protection rules was enabled. Enterprise owners and members can update protected branches.
`business.remove_admin`	An enterprise owner was removed from an enterprise.
`business.remove_organization`	An organization was removed from an enterprise.
`business.rename_slug`	The slug for the enterprise URL was renamed.
`business.set_actions_retention_limit`	The retention period for GitHub Actions artifacts and logs was changed for an enterprise.
`business.sso_response`	A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your enterprise. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`business.update_actions_settings`	An enterprise owner or site administrator updated GitHub Actions policy settings for an enterprise.
`business.update_default_repository_permission`	The base repository permission setting was updated for all organizations in an enterprise.
`business.update_member_repository_creation_permission`	The repository creation setting was updated for an enterprise.
`business.update_member_repository_invitation_permission`	The policy setting for enterprise members inviting outside collaborators to repositories was updated.

Action	Description
`business_advanced_security.disabled`	GitHub Advanced Security was disabled for your enterprise.
`business_advanced_security.disabled_for_new_repos`	GitHub Advanced Security was disabled for new repositories in your enterprise.
`business_advanced_security.enabled`	GitHub Advanced Security was enabled for your enterprise.
`business_advanced_security.enabled_for_new_repos`	GitHub Advanced Security was enabled for new repositories in your enterprise.

Action	Description
`business_dependabot_alerts_new_repos.disable`	Dependabot alerts were disabled for new repositories in your enterprise.
`business_dependabot_alerts_new_repos.enable`	Dependabot alerts were enabled for new repositories in your enterprise.

Action	Description
`business_secret_scanning.disable`	Secret scanning was disabled for your enterprise.
`business_secret_scanning.disabled_for_new_repos`	Secret scanning was disabled for new repositories in your enterprise.
`business_secret_scanning.enable`	Secret scanning was enabled for your enterprise.
`business_secret_scanning.enabled_for_new_repos`	Secret scanning was enabled for new repositories in your enterprise.

Action	Description
`business_secret_scanning_automatic_validity_checks.disabled`	Automatic partner validation checks have been disabled at the business level
`business_secret_scanning_automatic_validity_checks.enabled`	Automatic partner validation checks have been enabled at the business level

Action	Description
`business_secret_scanning_custom_pattern.create`	An enterprise-level custom pattern was created for secret scanning.
`business_secret_scanning_custom_pattern.delete`	An enterprise-level custom pattern was removed from secret scanning.
`business_secret_scanning_custom_pattern.publish`	An enterprise-level custom pattern was published for secret scanning.
`business_secret_scanning_custom_pattern.update`	Changes to an enterprise-level custom pattern were saved and a dry run was executed for secret scanning.

Action	Description
`business_secret_scanning_custom_pattern_push_protection.disabled`	Push protection for a custom pattern for secret scanning was disabled for your enterprise.
`business_secret_scanning_custom_pattern_push_protection.enabled`	Push protection for a custom pattern for secret scanning was enabled for your enterprise.

Action	Description
`business_secret_scanning_push_protection.disable`	Push protection for secret scanning was disabled for your enterprise.
`business_secret_scanning_push_protection.disabled_for_new_repos`	Push protection for secret scanning was disabled for new repositories in your enterprise.
`business_secret_scanning_push_protection.enable`	Push protection for secret scanning was enabled for your enterprise.
`business_secret_scanning_push_protection.enabled_for_new_repos`	Push protection for secret scanning was enabled for new repositories in your enterprise.

Action	Description
`business_secret_scanning_push_protection_custom_message.disable`	The custom message triggered by an attempted push to a push-protected repository was disabled for your enterprise.
`business_secret_scanning_push_protection_custom_message.enable`	The custom message triggered by an attempted push to a push-protected repository was enabled for your enterprise.
`business_secret_scanning_push_protection_custom_message.update`	The custom message triggered by an attempted push to a push-protected repository was updated for your enterprise.

Action	Description
`checks.auto_trigger_disabled`	Automatic creation of check suites was disabled on a repository in the organization or enterprise.
`checks.auto_trigger_enabled`	Automatic creation of check suites was enabled on a repository in the organization or enterprise.

Action	Description
`custom_property_value.create`	A repository's custom property value was manually set for the first time.
`custom_property_value.destroy`	A repository's custom property value was deleted.
`custom_property_value.update`	A repository's custom property value was updated.

Action	Description
`discussion_post.destroy`	Triggered when a team discussion post is deleted.
`discussion_post.update`	Triggered when a team discussion post is edited.

Action	Description
`discussion_post_reply.destroy`	Triggered when a reply to a team discussion post is deleted.
`discussion_post_reply.update`	Triggered when a reply to a team discussion post is edited.

Action	Description
`hook.config_changed`	A hook's configuration was changed.
`hook.create`	A new hook was added.
`hook.destroy`	A hook was deleted.
`hook.events_changed`	A hook's configured events were changed.

Action	Description
`custom_property_definition.create`	A new custom property definition was created.
`custom_property_definition.destroy`	A custom property definition was deleted.
`custom_property_definition.update`	A custom property definition was updated.

Action	Description
`enterprise.register_self_hosted_runner`	A new GitHub Actions self-hosted runner was registered.
`enterprise.remove_self_hosted_runner`	A GitHub Actions self-hosted runner was removed.
`enterprise.runner_group_created`	A GitHub Actions self-hosted runner group was created.
`enterprise.runner_group_removed`	A GitHub Actions self-hosted runner group was removed.
`enterprise.runner_group_runners_added`	A GitHub Actions self-hosted runner was added to a group.
`enterprise.runner_group_runners_updated`	A GitHub Actions runner group's list of members was updated.
`enterprise.runner_group_runner_removed`	The REST API was used to remove a GitHub Actions self-hosted runner from a group.
`enterprise.runner_group_updated`	The configuration of a GitHub Actions self-hosted runner group was changed.
`enterprise.self_hosted_runner_offline`	The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`enterprise.self_hosted_runner_online`	The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`enterprise.self_hosted_runner_updated`	The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.

Action	Description
`enterprise_announcement.create`	A global announcement banner was created for the enterprise.
`enterprise_announcement.destroy`	A global announcement banner was removed from the enterprise.
`enterprise_announcement.update`	A global announcement banner was updated for the enterprise.

Action	Description
`enterprise_domain.approve`	A domain was approved for an enterprise.
`enterprise_domain.create`	A domain was added to an enterprise.
`enterprise_domain.destroy`	A domain was removed from an enterprise.
`enterprise_domain.verify`	A domain was verified for an enterprise.

Action	Description
`git.clone`	A repository was cloned.
`git.fetch`	Changes were fetched from a repository.
`git.push`	Changes were pushed to a repository.

Action	Description
`integration.create`	An integration was created.
`integration.destroy`	An integration was deleted.
`integration.manager_added`	A member of an enterprise or organization was added as an integration manager.
`integration.manager_removed`	A member of an enterprise or organization was removed from being an integration manager.
`integration.transfer`	Ownership of an integration was transferred to another user or organization.

Action	Description
`integration_installation.create`	An integration was installed.
`integration_installation.destroy`	An integration was uninstalled.
`integration_installation.repositories_added`	Repositories were added to an integration.
`integration_installation.repositories_removed`	Repositories were removed from an integration.
`integration_installation.version_updated`	Permissions for an integration were updated.

Action	Description
`ip_allow_list.disable`	An IP allow list was disabled.
`ip_allow_list.disable_for_installed_apps`	An IP allow list was disabled for installed GitHub Apps.
`ip_allow_list.disable_user_level_enforcement`	IP allow list user level enforcement was disabled.
`ip_allow_list.enable`	An IP allow list was enabled.
`ip_allow_list.enable_for_installed_apps`	An IP allow list was enabled for installed GitHub Apps.
`ip_allow_list.enable_user_level_enforcement`	IP allow list user level enforcement was enabled.

Action	Description
`ip_allow_list_entry.create`	An IP address was added to an IP allow list.
`ip_allow_list_entry.destroy`	An IP address was deleted from an IP allow list.
`ip_allow_list_entry.update`	An IP address or its description was changed.

Action	Description
`oauth_application.create`	An OAuth application was created.
`oauth_application.destroy`	An OAuth application was deleted.
`oauth_application.reset_secret`	The secret key for an OAuth application was reset.
`oauth_application.revoke_tokens`	Token(s) for an OAuth application were revoked.
`oauth_application.transfer`	An OAuth application was transferred from one account to another.
`oauth_application.unsuspend`	An OAuth application was unsuspended for a user or organization account.

Audit log events for your enterprise

In this article

Action	Description
`oauth_authorization.create`	An authorization for an OAuth application was created.
`oauth_authorization.destroy`	An authorization for an OAuth application was deleted.
`oauth_authorization.update`	An authorization for an OAuth application was updated.

Action	Description
`org.accept_business_invitation`	An invitation sent to an organization to join an enterprise was accepted.
`org.add_billing_manager`	A billing manager was added to an organization.
`org.add_member`	A user joined an organization.
`org.advanced_security_disabled_for_new_repos`	GitHub Advanced Security was disabled for new repositories in an organization.
`org.advanced_security_disabled_on_all_repos`	GitHub Advanced Security was disabled for all repositories in an organization.
`org.advanced_security_enabled_for_new_repos`	GitHub Advanced Security was enabled for new repositories in an organization.
`org.advanced_security_enabled_on_all_repos`	GitHub Advanced Security was enabled for all repositories in an organization.
`org.advanced_security_policy_selected_member_disabled`	An enterprise owner prevented GitHub Advanced Security features from being enabled for repositories owned by the organization.
`org.advanced_security_policy_selected_member_enabled`	An enterprise owner allowed GitHub Advanced Security features to be enabled for repositories owned by the organization.
`org.async_delete`	A user initiated a background job to delete an organization.
`org.audit_log_export`	An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.
`org.block_user`	An organization owner blocked a user from accessing the organization's repositories.
`org.cancel_business_invitation`	An invitation for an organization to join an enterprise was revoked
`org.cancel_invitation`	An invitation sent to a user to join an organization was revoked.
`org.codeql_disabled`	Code scanning using the default setup was disabled for an organization.
`org.codeql_enabled`	Code scanning using the default setup was enabled for an organization.
`org.config.disable_collaborators_only`	The interaction limit for collaborators only for an organization was disabled.
`org.config.disable_contributors_only`	The interaction limit for prior contributors only for an organization was disabled.
`org.config.disable_sockpuppet_disallowed`	The interaction limit for existing users only for an organization was disabled.
`org.config.enable_collaborators_only`	The interaction limit for collaborators only for an organization was enabled.
`org.config.enable_contributors_only`	The interaction limit for prior contributors only for an organization was enabled.
`org.config.enable_sockpuppet_disallowed`	The interaction limit for existing users only for an organization was enabled.
`org.confirm_business_invitation`	An invitation for an organization to join an enterprise was confirmed.
`org.create`	An organization was created.
`org.delete`	An organization was deleted by a user-initiated background job.
`org.disable_member_team_creation_permission`	Team creation was limited to owners.
`org.disable_reader_discussion_creation_permission`	An organization owner limited discussion creation to users with at least triage permission in an organization.
`org.disable_saml`	SAML single sign-on was disabled for an organization.
`org.disable_two_factor_requirement`	A two-factor authentication requirement was disabled for the organization.
`org.display_commenter_full_name_disabled`	An organization owner disabled the display of a commenter's full name in an organization. Members cannot see a comment author's full name.
`org.display_commenter_full_name_enabled`	An organization owner enabled the display of a commenter's full name in an organization. Members can see a comment author's full name.
`org.enable_member_team_creation_permission`	Team creation by members was allowed.
`org.enable_reader_discussion_creation_permission`	An organization owner allowed users with read access to create discussions in an organization
`org.enable_saml`	SAML single sign-on was enabled for the organization.
`org.enable_two_factor_requirement`	Two-factor authentication is now required for the organization.
`org.integration_manager_added`	An organization owner granted a member access to manage all GitHub Apps owned by an organization.
`org.integration_manager_removed`	An organization owner removed access to manage all GitHub Apps owned by an organization from an organization member.
`org.invite_member`	A new user was invited to join an organization.
`org.invite_to_business`	An organization was invited to join an enterprise.
`org.members_can_update_protected_branches.disable`	The ability for enterprise members to update protected branches was disabled. Only enterprise owners can update protected branches.
`org.members_can_update_protected_branches.enable`	The ability for enterprise members to update protected branches was enabled. Members of an organization can update protected branches.
`org.recreate`	An organization was restored.
`org.register_self_hosted_runner`	A new self-hosted runner was registered.
`org.remove_billing_manager`	A billing manager was removed from an organization, either manually or due to a two-factor authentication requirement.
`org.remove_member`	A member was removed from an organization, either manually or due to a two-factor authentication requirement.
`org.remove_outside_collaborator`	An outside collaborator was removed from an organization, either manually or due to a two-factor authentication requirement.
`org.remove_self_hosted_runner`	A self-hosted runner was removed.
`org.rename`	An organization was renamed.
`org.restore_member`	An organization member was restored.
`org.runner_group_created`	A self-hosted runner group was created.
`org.runner_group_removed`	A self-hosted runner group was removed.
`org.runner_group_runners_added`	A self-hosted runner was added to a group.
`org.runner_group_runners_updated`	A runner group's list of members was updated.
`org.runner_group_runner_removed`	The REST API was used to remove a self-hosted runner from a group.
`org.runner_group_updated`	The configuration of a self-hosted runner group was changed.
`org.secret_scanning_custom_pattern_push_protection_disabled`	Push protection for a custom pattern for secret scanning was disabled for an organization.
`org.secret_scanning_custom_pattern_push_protection_enabled`	Push protection for a custom pattern for secret scanning was enabled for an organization.
`org.secret_scanning_push_protection_custom_message_disabled`	The custom message triggered by an attempted push to a push-protected repository was disabled for an organization.
`org.secret_scanning_push_protection_custom_message_enabled`	The custom message triggered by an attempted push to a push-protected repository was enabled for an organization.
`org.secret_scanning_push_protection_custom_message_updated`	The custom message triggered by an attempted push to a push-protected repository was updated for an organization.
`org.secret_scanning_push_protection_disable`	Push protection for secret scanning was disabled.
`org.secret_scanning_push_protection_enable`	Push protection for secret scanning was enabled.
`org.secret_scanning_push_protection_new_repos_disable`	Push protection for secret scanning was disabled for all new repositories in the organization.
`org.secret_scanning_push_protection_new_repos_enable`	Push protection for secret scanning was enabled for all new repositories in the organization.
`org.self_hosted_runner_offline`	The runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`org.self_hosted_runner_online`	The runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`org.self_hosted_runner_updated`	The runner application was updated. This event is not included in the JSON/CSV export.
`org.set_actions_retention_limit`	The retention period for GitHub Actions artifacts and logs in an organization was changed.
`org.sso_response`	A SAML single sign-on (SSO) response was generated when a member attempted to authenticate with your organization. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
`org.transform`	A user account was converted into an organization.
`org.unblock_user`	A user was unblocked from an organization.
`org.update_default_repository_permission`	The default repository permission level for organization members was changed.
`org.update_member_repository_creation_permission`	The create repository permission for organization members was changed.
`org.update_member_repository_invitation_permission`	An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.
`org.update_saml_provider_settings`	An organization's SAML provider settings were updated.
`org.update_terms_of_service`	An organization changed between the Standard Terms of Service and the GitHub Customer Agreement.

Action	Description
`organization_domain.approve`	A domain was approved for an organization.
`organization_domain.create`	A domain was added to an organization.
`organization_domain.destroy`	A domain was removed from an organization.
`organization_domain.verify`	A domain was verified for an organization.

Action	Description
`org_secret_scanning_automatic_validity_checks.disabled`	Automatic partner validation checks have been disabled at the organization level
`org_secret_scanning_automatic_validity_checks.enabled`	Automatic partner validation checks have been enabled at the organization level

Action	Description
`org_secret_scanning_custom_pattern.create`	A custom pattern was created for secret scanning in an organization.
`org_secret_scanning_custom_pattern.delete`	A custom pattern was removed from secret scanning in an organization.
`org_secret_scanning_custom_pattern.publish`	A custom pattern was published for secret scanning in an organization.
`org_secret_scanning_custom_pattern.update`	Changes to a custom pattern were saved and a dry run was executed for secret scanning in an organization.

Action	Description
`packages.package_deleted`	An entire package was deleted.
`packages.package_published`	A package was published or republished to an organization.
`packages.package_version_deleted`	A specific package version was deleted.
`packages.package_version_published`	A specific package version was published or republished to a package.

Action	Description
`protected_branch.authorized_users_teams`	The users, teams, or integrations allowed to bypass a branch protection were changed.
`protected_branch.branch_allowances`	A protected branch allowance was given to a specific user, team or integration.
`protected_branch.create`	Branch protection was enabled on a branch.
`protected_branch.destroy`	Branch protection was disabled on a branch.
`protected_branch.dismissal_restricted_users_teams`	Enforcement of restricting users and/or teams who can dismiss reviews was updated on a branch.
`protected_branch.dismiss_stale_reviews`	Enforcement of dismissing stale pull requests was updated on a branch.
`protected_branch.policy_override`	A branch protection requirement was overridden by a repository administrator.
`protected_branch.rejected_ref_update`	A branch update attempt was rejected.
`protected_branch.update_admin_enforced`	Branch protection was enforced for repository administrators.
`protected_branch.update_allow_deletions_enforcement_level`	Branch deletion was enabled or disabled for a protected branch.
`protected_branch.update_allow_force_pushes_enforcement_level`	Force pushes were enabled or disabled for a branch.
`protected_branch.update_ignore_approvals_from_contributors`	Ignoring of approvals from contributors to a pull request was enabled or disabled for a branch.
`protected_branch.update_linear_history_requirement_enforcement_level`	Required linear commit history was enabled or disabled for a branch.
`protected_branch.update_lock_allows_fetch_and_merge`	Fork syncing was enabled or disabled for a read-only branch
`protected_branch.update_lock_branch_enforcement_level`	The enforcement of a branch lock was updated.
`protected_branch.update_name`	A branch name pattern was updated for a branch.
`protected_branch.update_pull_request_reviews_enforcement_level`	Enforcement of required pull request reviews was updated for a branch. Can be 0 (deactivated), 1 (non-admins), or 2 (everyone).
`protected_branch.update_required_approving_review_count`	Enforcement of the required number of approvals before merging was updated on a branch.
`protected_branch.update_required_status_checks_enforcement_level`	Enforcement of required status checks was updated for a branch.
`protected_branch.update_require_code_owner_review`	Enforcement of required code owner review was updated for a branch.
`protected_branch.update_require_last_push_approval`	Someone other than the person who pushed the last code-modifying commit to the branch must approve pull requests for the branch.
`protected_branch.update_signature_requirement_enforcement_level`	Enforcement of required commit signing was updated for a branch.
`protected_branch.update_strict_required_status_checks_policy`	Enforcement of required status checks was updated for a branch.

Action	Description
`public_key.create`	An SSH key was added to a user account or a deploy key was added to a repository.
`public_key.delete`	An SSH key was removed from a user account or a deploy key was removed from a repository.
`public_key.unverification_failure`	A user account's SSH key or a repository's deploy key was unable to be unverified.
`public_key.unverify`	A user account's SSH key or a repository's deploy key was unverified.
`public_key.update`	A user account's SSH key or a repository's deploy key was updated.
`public_key.verification_failure`	A user account's SSH key or a repository's deploy key was unable to be verified.
`public_key.verify`	A user account's SSH key or a repository's deploy key was verified.

Action	Description
`pull_request.close`	A pull request was closed without being merged.
`pull_request.converted_to_draft`	A pull request was converted to a draft.
`pull_request.create`	A pull request was created.
`pull_request.create_review_request`	A review was requested on a pull request.
`pull_request.indirect_merge`	A pull request was considered merged because the pull request's commits were merged into the target branch.
`pull_request.in_progress`	A pull request was marked as in progress.
`pull_request.merge`	A pull request was merged.
`pull_request.ready_for_review`	A pull request was marked as ready for review.
`pull_request.remove_review_request`	A review request was removed from a pull request.
`pull_request.reopen`	A pull request was reopened after previously being closed.

Action	Description
`pull_request_review.delete`	A review on a pull request was deleted.
`pull_request_review.dismiss`	A review on a pull request was dismissed.
`pull_request_review.submit`	A review on a pull request was submitted.