The Wayback Machine - https://web.archive.org/web/20200705072609/https://docs.github.com/en/github/setting-up-and-managing-organizations-and-teams/reviewing-the-audit-log-for-your-organization
👋 We've unified all of GitHub's product documentation in one place! Check out the content for
REST API,
GraphQL API,
and Developers.
Learn more on the GitHub blog.
The audit log allows organization admins to quickly review the actions performed by members of your organization. It includes details such as who performed the action, what the action was, and when it was performed.
The log lists the following information about each action:
Which repository an action was performed in
The user that performed the action
The action that was performed
Which country the action took place in
The date and time the action occurred
Note that you cannot search for entries using text. You can, however, construct search queries using a variety of filters. Many operators used when querying the log, such as -, >, or <, match the same format as searching across GitHub. For more information, see "Searching on GitHub."
Use the repo qualifier to limit actions to a specific repository. For example:
repo:my-org/our-repo finds all events that occurred for the our-repo repository in the my-org organization.
repo:my-org/our-repo repo:my-org/another-repo finds all events that occurred for both the our-repo and another-repo repositories in the my-org organization.
-repo:my-org/not-this-repo excludes all events that occurred for the not-this-repo repository in the my-org organization.
Note that you must include the account name within the repo qualifier; searching for just repo:our-repo will not work.
Triggered when an organization member requests that an organization owner install an integration for use in the organization.
close
Triggered when a request to install an integration for use in an organization is either approved or denied by an organization owner, or canceled by the organization member who opened the request.
Triggered when an organization admin creates an export of the organization audit log. If the export included a query, the log will list the query used and the number of audit log entries matching that query.
Triggered when an owner disables a two-factor authentication requirement for all members, billing managers, and outside collaborators in an organization.
Triggered when an owner changes the default repository permission level for organization members.
update_member
Triggered when an owner changes a person's role from owner to member or member to owner.
update_member_repository_creation_permission
Triggered when an owner changes the create repository permission for organization members.
update_saml_provider_settings
Triggered when an organization's SAML provider settings are updated.
update_terms_of_service
Triggered when an organization changes between the Standard Terms of Service and the Corporate Terms of Service. For more information, see "Upgrading to the Corporate Terms of Service."
Use the created qualifier to filter actions in the audit log based on when they occurred. Date formatting must follow the ISO8601 standard, which is YYYY-MM-DD (year-month-day). You can also add optional time information THH:MM:SS+00:00 after the date, to search by the hour, minute, and second. That's T, followed by HH:MM:SS (hour-minutes-seconds), and a UTC offset (+00:00).
Using the qualifier country, you can filter actions in the audit log based on the originating country. You can use a country's two-letter short code or its full name. Keep in mind that countries with spaces in their name will need to be wrapped in quotation marks. For example:
country:de finds all events that occurred in Germany.
country:Mexico finds all events that occurred in Mexico.
country:"United States" all finds events that occurred in the United States.
Note: The Audit log API is available for organizations using GitHub Enterprise. For more information, see "GitHub's products."
To ensure a secure IP and maintain compliance for your organization, you can use the Audit log API to keep copies of your audit log data and monitor:
Access to your organization or repository settings.
Changes in permissions.
Added or removed users in an organization, repository, or team.
Users being promoted to admin.
Changes to permissions of a GitHub App.
The GraphQL response can include data for up to 90 to 120 days.
For example, you can make a GraphQL request to see all the new organization members added to your organization. For more information, see the "GraphQL API Audit Log."
