Audit log events for your organization

Learn about audit log events recorded for your organization.

This article contains the events that may appear in your organization's audit log. For the events that can appear in a user account's security log or the audit log for an enterprise, see Security log events and Audit log events for your enterprise.

Webhooks might be a good alternative to the audit log or API polling for certain use cases. Webhooks are a way for GitHub to notify your server when specific events occur for a repository, organization, or enterprise. Compared to the API or searching the audit log, webhooks can be more efficient if you just want to learn and possibly log when certain events occur on your enterprise, organization, or repository. See Webhooks documentation.

About audit log events for your organization

The name for each audit log entry is composed of a category of events, followed by an operation type. For example, the repo.create entry refers to the create operation on the repo category. The reference information in this article is grouped by categories.

Action	Description
`advisory_credit.accept`	Credit was accepted for a security advisory.
`advisory_credit.create`	Someone was added to the credit section of a security advisory.
`advisory_credit.decline`	Credit was declined for a security advisory.
`advisory_credit.destroy`	Someone was removed from the credit section of a security advisory.

Action	Description
`auto_approve_personal_access_token_requests.disable`	Triggered when the organization must approve fine-grained personal access tokens before the tokens can access organization resources. See also: personal_access_token.auto_approve_grant_requests_disabled
`auto_approve_personal_access_token_requests.enable`	Triggered when fine-grained personal access tokens can access organization resources without prior approval. See also: personal_access_token.auto_approve_grant_requests_enabled

Action	Description
`billing.change_billing_type`	The way the account pays for GitHub was changed.
`billing.change_email`	The billing email address changed.

Action	Description
`checks.auto_trigger_disabled`	Automatic creation of check suites was disabled on a repository in the organization or enterprise.
`checks.auto_trigger_enabled`	Automatic creation of check suites was enabled on a repository in the organization or enterprise.
`checks.delete_logs`	Logs in a check suite were deleted.

Action	Description
`codespaces.allow_permissions`	A codespace using custom permissions from its devcontainer.json file was launched.
`codespaces.attempted_to_create_from_prebuild`	An attempt to create a codespace from a prebuild was made.
`codespaces.business_enablement_updated`	Enterprise setting for Codespaces ownership was updated.
`codespaces.connect`	Credentials for a codespace were refreshed.
`codespaces.create`	A codespace was created
`codespaces.destroy`	A user deleted a codespace.
`codespaces.export_environment`	A codespace was exported to a branch on GitHub.
`codespaces.policy_group_created`	Policies were applied to codespaces in an organization or enterprise.
`codespaces.policy_group_deleted`	Policies were removed from codespaces in an organization or enterprise.
`codespaces.policy_group_updated`	Policies were updated for codespaces in an organization or enterprise.
`codespaces.restore`	A codespace was restored.
`codespaces.start_environment`	A codespace was started.
`codespaces.suspend_environment`	A codespace was stopped.
`codespaces.trusted_repositories_access_update`	A personal account's access and security setting for Codespaces were updated.

Action	Description
`commit_comment.destroy`	A commit comment was deleted.
`commit_comment.update`	A commit comment was updated.

Action	Description
`copilot.access_revoked`	Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.
`copilot.cfb_org_settings_changed`	Copilot feature settings were changed at the organization level.
`copilot.cfb_seat_added`	A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.
`copilot.cfb_seat_assignment_created`	A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.
`copilot.cfb_seat_assignment_refreshed`	A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.
`copilot.cfb_seat_assignment_reused`	A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.
`copilot.cfb_seat_assignment_unassigned`	A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.
`copilot.cfb_seat_cancelled`	A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.
`copilot.cfb_seat_cancelled_by_staff`	A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.
`copilot.cfb_seat_management_changed`	The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.
`copilot.content_exclusion_changed`	The excluded paths for GitHub Copilot were updated.
`copilot.knowledge_base_created`	A knowledge base was created in the organization.
`copilot.knowledge_base_deleted`	A knowledge base was deleted from the organization.
`copilot.knowledge_base_updated`	A knowledge base was updated in the organization.
`copilot.plan_changed`	The plan for GitHub Copilot was updated.
`copilot.plan_downgrade_scheduled`	The plan for GitHub Copilot was scheduled to be downgraded.

Action	Description
`custom_property_definition.create`	A new custom property definition was created.
`custom_property_definition.destroy`	A custom property definition was deleted.
`custom_property_definition.update`	A custom property definition was updated.

Action	Description
`custom_property_value.create`	A repository's custom property value was manually set for the first time.
`custom_property_value.destroy`	A repository's custom property value was deleted.
`custom_property_value.update`	A repository's custom property value was updated.

Action	Description
`dependabot_alerts.disable`	Dependabot alerts were disabled for all existing repositories.
`dependabot_alerts.enable`	Dependabot alerts were enabled for all existing repositories.

Action	Description
`discussion_post.destroy`	Triggered when a team discussion post is deleted.
`discussion_post.update`	Triggered when a team discussion post is edited.

Action	Description
`discussion_post_reply.destroy`	Triggered when a reply to a team discussion post is deleted.
`discussion_post_reply.update`	Triggered when a reply to a team discussion post is edited.

Action	Description
`environment.add_protection_rule`	A GitHub Actions deployment protection rule was created via the API.
`environment.create_actions_secret`	A secret was created for a GitHub Actions environment.
`environment.create_actions_variable`	A variable was created for a GitHub Actions environment.
`environment.delete`	An environment was deleted.
`environment.remove_actions_secret`	A secret was deleted for a GitHub Actions environment.
`environment.remove_actions_variable`	A variable was deleted for a GitHub Actions environment.
`environment.remove_protection_rule`	A GitHub Actions deployment protection rule was deleted via the API.
`environment.update_actions_secret`	A secret was updated for a GitHub Actions environment.
`environment.update_actions_variable`	A variable was updated for a GitHub Actions environment.
`environment.update_protection_rule`	A GitHub Actions deployment protection rule was updated via the API.

Action	Description
`hook.active_changed`	A hook's active status was updated.
`hook.config_changed`	A hook's configuration was changed.
`hook.create`	A new hook was added.
`hook.destroy`	A hook was deleted.
`hook.events_changed`	A hook's configured events were changed.

Action	Description
`dependabot_alerts_new_repos.disable`	Dependabot alerts were disabled for all new repositories.
`dependabot_alerts_new_repos.enable`	Dependabot alerts were enabled for all new repositories.

Action	Description
`dependabot_security_updates.disable`	Dependabot security updates were disabled for all existing repositories.
`dependabot_security_updates.enable`	Dependabot security updates were enabled for all existing repositories.

Action	Description
`dependabot_security_updates_new_repos.disable`	Dependabot security updates were disabled for all new repositories.
`dependabot_security_updates_new_repos.enable`	Dependabot security updates were enabled for all new repositories.

Action	Description
`dependency_graph.disable`	The dependency graph was disabled for all existing repositories.
`dependency_graph.enable`	The dependency graph was enabled for all existing repositories.

Action	Description
`dependency_graph_new_repos.disable`	The dependency graph was disabled for all new repositories.
`dependency_graph_new_repos.enable`	The dependency graph was enabled for all new repositories.

Action	Description
`enterprise_installation.create`	The GitHub App associated with a GitHub Connect connection was created.
`enterprise_installation.destroy`	The GitHub App associated with a GitHub Connect connection was deleted.

Action	Description
`git.clone`	A repository was cloned.
`git.fetch`	Changes were fetched from a repository.
`git.push`	Changes were pushed to a repository.

Action	Description
`integration.create`	A GitHub App was created.
`integration.destroy`	A GitHub App was deleted.
`integration.manager_added`	A member of an enterprise or organization was added as a GitHub App manager.
`integration.manager_removed`	A member of an enterprise or organization was removed from being a GitHub App manager.
`integration.remove_client_secret`	A client secret for a GitHub App was removed.
`integration.revoke_all_tokens`	All user tokens for a GitHub App were requested to be revoked.
`integration.revoke_tokens`	Token(s) for a GitHub App were revoked.
`integration.suspend`	A GitHub App was suspended.
`integration.transfer`	Ownership of a GitHub App was transferred to another user or organization.
`integration.unsuspend`	A GitHub App was unsuspended.

Action	Description
`integration_installation.create`	A GitHub App was installed.
`integration_installation.destroy`	A GitHub App was uninstalled.
`integration_installation.repositories_added`	Repositories were added to a GitHub App.
`integration_installation.repositories_removed`	Repositories were removed from a GitHub App.
`integration_installation.suspend`	A GitHub App was suspended.
`integration_installation.unsuspend`	A GitHub App was unsuspended.
`integration_installation.version_updated`	Permissions for a GitHub App were updated.

Action	Description
`integration_installation_request.close`	A request to install a GitHub App was either approved or denied by an owner, or canceled by the member who opened the request.
`integration_installation_request.create`	A member requested that an owner install a GitHub App.

Audit log events for your organization

In this article

Action	Description
`ip_allow_list.disable`	An IP allow list was disabled.
`ip_allow_list.disable_for_installed_apps`	An IP allow list was disabled for installed GitHub Apps.
`ip_allow_list.enable`	An IP allow list was enabled.
`ip_allow_list.enable_for_installed_apps`	An IP allow list was enabled for installed GitHub Apps.

Action	Description
`ip_allow_list_entry.create`	An IP address was added to an IP allow list.
`ip_allow_list_entry.destroy`	An IP address was deleted from an IP allow list.
`ip_allow_list_entry.update`	An IP address or its description was changed.

Action	Description
`issue_comment.destroy`	A comment on an issue was deleted from the repository.
`issue_comment.update`	A comment on an issue (other than the initial one) changed.

Action	Description
`issue.destroy`	An issue was deleted from the repository.
`issue.pinned`	An issue was pinned to a repository.
`issue.transfer`	An issue was transferred to another repository.
`issue.unpinned`	An issue was unpinned from a repository.

Action	Description
`issues.deletes_disabled`	The ability for enterprise members to delete issues was disabled Members cannot delete issues in any organizations in an enterprise.
`issues.deletes_enabled`	The ability for enterprise members to delete issues was enabled Members can delete issues in any organizations in an enterprise.
`issues.deletes_policy_cleared`	An enterprise owner cleared the policy setting for allowing members to delete issues in an enterprise.

Action	Description
`marketplace_listing.approve`	A listing was approved for inclusion in GitHub Marketplace.
`marketplace_listing.change_category`	A category for a listing for an app in GitHub Marketplace was changed.
`marketplace_listing.create`	A listing for an app in GitHub Marketplace was created.
`marketplace_listing.delist`	A listing was removed from GitHub Marketplace.
`marketplace_listing.redraft`	A listing was sent back to draft state.
`marketplace_listing.reject`	A listing was not accepted for inclusion in GitHub Marketplace.

Action	Description
`members_can_create_pages.disable`	The ability for members to publish GitHub Pages sites was disabled.
`members_can_create_pages.enable`	The ability for members to publish GitHub Pages sites was enabled.

Action	Description
`members_can_create_private_pages.disable`	The ability for members to publish private GitHub Pages was disabled Members cannot publish private GitHub Pages in an organization.
`members_can_create_private_pages.enable`	The ability for members to publish private GitHub Pages was enabled Members can publish private GitHub Pages in an organization.

Action	Description
`members_can_create_public_pages.disable`	The ability for members to publish public GitHub Pages was disabled Members cannot publish public GitHub Pages in an organization.
`members_can_create_public_pages.enable`	The ability for members to publish public GitHub Pages was enabled Members can publish public GitHub Pages in an organization.

Action	Description
`members_can_delete_repos.clear`	An enterprise owner cleared the policy setting for deleting or transferring repositories in any organizations in an enterprise.
`members_can_delete_repos.disable`	The ability for enterprise members to delete repositories was disabled Members cannot delete or transfer repositories in any organizations in an enterprise.
`members_can_delete_repos.enable`	The ability for enterprise members to delete repositories was enabled Members can delete or transfer repositories in any organizations in an enterprise.