GitHub Log API

openapi: 3.2.0
info:
  version: 1.1.4
  title: GitHub Org Log API
  description: Use the REST API to control and manage all your GitHub organizations.
  license:
    name: MIT
    url: https://spdx.org/licenses/MIT
  termsOfService: https://docs.github.com/articles/github-terms-of-service
  contact:
    name: Support
    url: https://support.github.com/contact?tags=dotcom-rest-api
  x-github-plan: ghes
  x-github-release: 3.9
servers:
- url: '{protocol}://{hostname}/api/v3'
  variables:
    hostname:
      description: Self-hosted Enterprise Server hostname
      default: HOSTNAME
    protocol:
      description: Self-hosted Enterprise Server protocol
      default: http
tags:
- name: Log
paths:
  /orgs/{org}/audit-log:
    get:
      summary: GitHub Get the Audit Log for an Organization
      description: 'Gets the audit log for an organization. For more information, see "[Reviewing the audit log for your organization](https://docs.github.com/enterprise-server@3.9/github/setting-up-and-managing-organizations-and-teams/reviewing-the-audit-log-for-your-organization)."


        By default, the response includes up to 30 events from the past three months. Use the `phrase` parameter to filter results and retrieve older events. For example, use the `phrase` parameter with the `created` qualifier to filter events based on when the events occurred. For more information, see "[Reviewing the audit log for your organization](https://docs.github.com/enterprise-server@3.9/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#searching-the-audit-log)."


        Use pagination to retrieve fewer or more than 30 events. For more information, see "[Using pagination in the REST API](https://docs.github.com/enterprise-server@3.9/rest/guides/using-pagination-in-the-rest-api)."


        The authenticated user must be an organization owner to use this endpoint.


        OAuth app tokens and personal access tokens (classic) need the `read:audit_log` scope to use this endpoint.'
      operationId: getTheAuditLogForAnOrganization
      tags:
      - Log
      externalDocs:
        description: API method documentation
        url: https://docs.github.com/enterprise-server@3.9/rest/orgs/orgs#get-the-audit-log-for-an-organization
      parameters:
      - $ref: '#/components/parameters/org'
      - $ref: '#/components/parameters/audit-log-phrase'
      - $ref: '#/components/parameters/audit-log-include'
      - $ref: '#/components/parameters/audit-log-after'
      - $ref: '#/components/parameters/audit-log-before'
      - $ref: '#/components/parameters/audit-log-order'
      - $ref: '#/components/parameters/per-page'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          description: Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/audit-log-event'
              examples:
                default:
                  $ref: '#/components/examples/audit-log'
      x-github:
        githubCloudOnly: true
        enabledForGitHubApps: true
        category: orgs
        subcategory: orgs
      security:
      - bearerHttpAuthentication: []
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  examples:
    audit-log:
      value:
      - actor_ip: 88.123.45.123
        from: pull_requests#merge
        device_cookie: null
        actor: mona-admin
        actor_id: 7
        repo: octo-org/octo-repo
        repo_id: 17
        business: github
        business_id: 1
        org: octo-org
        org_id: 8
        action: pull_request.merge
        '@timestamp': 1635940599755
        created_at: 1635940599755
        operation_type: modify
        actor_location:
          country_code: GB
          country_name: United Kingdom
          region: ENG
          region_name: England
          city: Louth
          postal_code: LN11
          location:
            lat: 53.4457
            lon: 0.141
        data:
          user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...
          method: POST
          request_id: e4dabc4d-ba16-4bca-1234-649be7ae1188
          server_id: 5d17aab5-fd9f-abcd-a820-16bed246441b
          request_category: other
          controller_action: merge
          url: https://example.com/octo-org/octo-repo/pull/1/merge
          client_id: 322299977.1635936
          referrer: https://example.com/octo-org/octo-repo/pull/1
          actor_session: 1
          pull_request_id: 1
          category_type: Resource Management
      - actor_ip: 88.123.45.123
        from: pull_request_review_events#create
        device_cookie: null
        actor: mona-admin
        actor_id: 7
        business_id: 1
        org_id: 8
        action: pull_request_review.submit
        '@timestamp': 1635940593079
        created_at: 1635940593079
        operation_type: modify
        actor_location:
          country_code: GB
          country_name: United Kingdom
          region: ENG
          region_name: England
          city: Louth
          postal_code: LN11
          location:
            lat: 53.4457
            lon: 0.141
        data:
          user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...
          method: PUT
          request_id: c0f63bb7-17b6-4796-940c-12345c5a581b
          server_id: 2abc1234-f651-43e3-9696-e942ad5f8c89
          request_category: other
          controller_action: create
          url: https://example.com/octo-org/octo-repo/pull/1/reviews
          client_id: 322299977.1635936
          referrer: https://example.com/octo-org/octo-repo/pull/1/files
          actor_session: 1
          spammy: false
          pull_request_id: 1
          body: null
          allowed: true
          id: 1
          state: 40
          issue_id: 1
          review_id: 1
          category_type: Resource Management
      - actor_ip: 88.123.45.123
        from: pull_requests#create
        device_cookie: null
        actor: mona
        actor_id: 9
        user_id: 9
        repo: octo-org/octo-repo
        repo_id: 17
        business: github
        business_id: 1
        org: octo-org
        org_id: 8
        action: pull_request.create
        '@timestamp': 1635940554161
        created_at: 1635940554161
        operation_type: create
        actor_location:
          country_code: GB
          country_name: United Kingdom
          region: ENG
          region_name: England
          city: Louth
          postal_code: LN11
          location:
            lat: 53.4457
            lon: 0.141
        data:
          user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...
          method: POST
          request_id: 2773abeb-477f-4ebf-a017-f8e8a206c305
          server_id: 796e3115-4ce8-4606-8fd0-99ea57a2e12b
          request_category: other
          controller_action: create
          url: https://example.com/octo-org/octo-repo/pull/create?base=octo-org%3Amain&head=mona%3Apatch-1
          client_id: 386351111.163594
          referrer: https://example.com/octo-org/octo-repo/compare/main...mona:patch-1
          actor_session: 2
          pull_request_id: 1
          category_type: Resource Management
  parameters:
    audit-log-after:
      name: after
      description: A cursor, as given in the [Link header](https://docs.github.com/enterprise-server@3.9/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for events after this cursor.
      in: query
      required: false
      schema:
        type: string
    audit-log-include:
      name: include
      description: 'The event types to include:


        - `web` - returns web (non-Git) events.

        - `git` - returns Git events.

        - `all` - returns both web and Git events.


        The default is `web`.'
      in: query
      required: false
      schema:
        type: string
        enum:
        - web
        - git
        - all
    per-page:
      name: per_page
      description: The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/enterprise-server@3.9/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
      in: query
      schema:
        type: integer
        default: 30
    audit-log-phrase:
      name: phrase
      description: A search phrase. For more information, see [Searching the audit log](https://docs.github.com/enterprise-server@3.9/github/setting-up-and-managing-organizations-and-teams/reviewing-the-audit-log-for-your-organization#searching-the-audit-log).
      in: query
      required: false
      schema:
        type: string
    audit-log-before:
      name: before
      description: A cursor, as given in the [Link header](https://docs.github.com/enterprise-server@3.9/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for events before this cursor.
      in: query
      required: false
      schema:
        type: string
    org:
      name: org
      description: The organization name. The name is not case sensitive.
      in: path
      required: true
      schema:
        type: string
    audit-log-order:
      name: order
      description: 'The order of audit log events. To list newest events first, specify `desc`. To list oldest events first, specify `asc`.


        The default is `desc`.'
      in: query
      required: false
      schema:
        type: string
        enum:
        - desc
        - asc
    page:
      name: page
      description: The page number of the results to fetch. For more information, see "[Using pagination in the REST API](https://docs.github.com/enterprise-server@3.9/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
      in: query
      schema:
        type: integer
        default: 1
  schemas:
    audit-log-event:
      type: object
      properties:
        '@timestamp':
          type: integer
          description: The time the audit log event occurred, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
          example: 42
        action:
          type: string
          description: The name of the action that was performed, for example `user.login` or `repo.create`.
          example: example_value
        active:
          type: boolean
          example: true
        active_was:
          type: boolean
          example: true
        actor:
          type: string
          description: The actor who performed the action.
          example: example_value
        actor_id:
          type: integer
          description: The id of the actor who performed the action.
          example: 42
        actor_location:
          type: object
          properties:
            country_name:
              type: string
        data:
          type: object
          additionalProperties: true
        org_id:
          type: integer
          example: 42
        user_id:
          type: integer
          example: 42
        business_id:
          type: integer
          example: 42
        blocked_user:
          type: string
          description: The username of the account being blocked.
          example: example_value
        business:
          type: string
          example: example_value
        config:
          type: array
          items:
            type: object
        config_was:
          type: array
          items:
            type: object
        content_type:
          type: string
          example: User
        operation_type:
          type: string
          example: User
        created_at:
          type: integer
          description: The time the audit log event was recorded, given as a [Unix timestamp](http://en.wikipedia.org/wiki/Unix_time).
          example: 42
        deploy_key_fingerprint:
          type: string
          example: example_value
        _document_id:
          type: string
          description: A unique identifier for an audit event.
          example: '12345678'
        emoji:
          type: string
        events:
          type: array
          items:
            type: object
        events_were:
          type: array
          items:
            type: object
        explanation:
          type: string
        fingerprint:
          type: string
        hook_id:
          type: integer
        limited_availability:
          type: boolean
        message:
          type: string
        name:
          type: string
        old_user:
          type: string
        openssh_public_key:
          type: string
        org:
          type: string
        previous_visibility:
          type: string
        read_only:
          type: boolean
        repo:
          type: string
          description: The name of the repository.
        repository:
          type: string
          description: The name of the repository.
        repository_public:
          type: boolean
        target_login:
          type: string
        team:
          type: string
        transport_protocol:
          type: integer
          description: The type of protocol (for example, HTTP or SSH) used to transfer Git data.
        transport_protocol_name:
          type: string
          description: A human readable name for the protocol (for example, HTTP or SSH) used to transfer Git data.
        user:
          type: string
          description: The user that was affected by the action performed (if available).
        visibility:
          type: string
          description: The repository visibility, for example `public` or `private`.
  securitySchemes:
    bearerHttpAuthentication:
      description: Bearer Token
      type: http
      scheme: Bearer
externalDocs:
  description: GitHub Enterprise Developer Docs
  url: https://docs.github.com/enterprise-server@3.9/rest/