{% note %}

Note: {% data reusables.webhooks.webhooks-as-audit-log-alternative %}

{% endnote %}

The audit log lists events triggered by activities that affect your organization within the last 180 days. Only owners can access an organization's audit log.

{% data reusables.audit_log.only-three-months-displayed %}

{% data reusables.profile.access_org %} {% data reusables.profile.org_settings %} {% data reusables.audit_log.audit_log_sidebar_for_org_admins %}

{% data reusables.audit_log.audit-log-search %}

To search for specific events, use the action qualifier in your query. Actions listed in the audit log are grouped in different categories. For the full list of events in each category, see "AUTOTITLE."

You can search for specific sets of actions using these terms. For example:

• action:team finds all events grouped within the team category.
• -action:hook excludes all events in the webhook category.

Each category has a set of associated actions that you can filter on. For example:

• action:team.create finds all events where a team was created.
• -action:hook.events_changed excludes all events where the events on a webhook have been altered.

Use the created qualifier to filter events in the audit log based on when they occurred. {% data reusables.time_date.date_format %} {% data reusables.time_date.time_format %}

{% data reusables.search.date_gt_lt %}

For example:

• created:2014-07-08 finds all events that occurred on July 8th, 2014.
• created:>=2014-07-08 finds all events that occurred on or after July 8th, 2014.
• created:<=2014-07-08 finds all events that occurred on or before July 8th, 2014.
• created:2014-07-01..2014-07-31 finds all events that occurred in the month of July 2014.

{% note %}

Note: The audit log contains data for the last 180 days.

{% endnote %}

Using the qualifier country, you can filter events in the audit log based on the originating country. You can use a country's two-letter short code or its full name. Keep in mind that countries with spaces in their name will need to be wrapped in quotation marks. For example:

• country:de finds all events that occurred in Germany.
• country:Mexico finds all events that occurred in Mexico.
• country:"United States" all finds events that occurred in the United States.

{% ifversion ghec %}

You can identify all events that were performed by a specific access token. For more information, see "AUTOTITLE."

{% endif %}

{% ifversion fpt or ghec %}

{% data reusables.audit_log.export-log %}

{% data reusables.audit_log.git-events-export-limited %}

{% data reusables.audit_log.exported-log-keys-and-values %} {% endif %}

{% ifversion fpt %}

Organizations that use {% data variables.product.prodname_ghe_cloud %} can interact with the audit log using the GraphQL API and REST API. For more information, see the {% data variables.product.prodname_ghe_cloud %} documentation.

{% else %}

You can interact with the audit log using the GraphQL API{% ifversion fpt or ghec %} or the REST API{% endif %}.{% ifversion read-audit-scope %} You can use the read:audit_log scope to access the audit log via the APIs.{% endif %}

{% ifversion ghec %}

{% note %}

Note: To use the audit log API, your organization must use {% data variables.product.prodname_ghe_cloud %}. {% data reusables.enterprise.link-to-ghec-trial %}

{% endnote %}

{% endif %}

To ensure your intellectual property is secure, and you maintain compliance for your organization, you can use the audit log GraphQL API to keep copies of your audit log data and monitor: {% data reusables.audit_log.audit-log-api-info %}

{% ifversion ghec %} Note that you can't retrieve Git events using the GraphQL API. To retrieve Git events, use the REST API instead. For more information, see "git category actions." {% endif %}

The GraphQL response can include data for up to 90 to 120 days.

For example, you can make a GraphQL request to see all the new organization members added to your organization. For more information, see the "AUTOTITLE."

{% ifversion ghec %}

To ensure your intellectual property is secure, and you maintain compliance for your organization, you can use the audit log REST API to keep copies of your audit log data. For more information about the specific events you can access using the REST API, see "AUTOTITLE."

{% data reusables.audit_log.audit-log-git-events-retention %}

By default, only events from the past three months are returned. To include older events, you must specify a timestamp in your query.

{% ifversion ghec %}

When you use the REST API to request Git events, events that were initiated via the web browser or the REST or GraphQL APIs are not included. For example, when you merge a pull request in the web browser, changes are pushed to the base branch, but the Git event for that push is not included in the response.

{% endif %}

For more information about the audit log REST API, see "AUTOTITLE."

{% endif %} {% endif %}

• "AUTOTITLE" {%- ifversion fpt or ghec %}
• "AUTOTITLE"{% endif %}