src/audit-logs/data/ghec/user.json

[
  {
    "action": "account.billing_date_change",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "org",
      "@timestamp",
      "operation_type",
      "user_agent",
      "_document_id",
      "created_at",
      "action",
      "request_id",
      "actor",
      "actor_id",
      "org_id"
    ]
  },
  {
    "action": "account.plan_change",
    "description": "The account's plan changed.",
    "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans",
    "fields": [
      "actor",
      "operation_type",
      "_document_id",
      "user_agent",
      "created_at",
      "actor_id",
      "request_id",
      "@timestamp",
      "user",
      "action",
      "user_id",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "How GitHub billing works"
  },
  {
    "action": "account_recovery_token.confirm",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "action",
      "request_id",
      "@timestamp",
      "user_agent",
      "created_at",
      "_document_id",
      "token_id",
      "user_id",
      "user",
      "actor",
      "operation_type"
    ]
  },
  {
    "action": "account_recovery_token.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "action",
      "created_at",
      "token_id",
      "user",
      "request_id",
      "_document_id",
      "user_agent",
      "actor",
      "user_id",
      "actor_id",
      "operation_type",
      "@timestamp"
    ]
  },
  {
    "action": "account_recovery_token.recover",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "@timestamp",
      "actor_id",
      "operation_type",
      "created_at",
      "actor",
      "user_agent",
      "request_id",
      "action",
      "_document_id",
      "user_id",
      "token_id"
    ]
  },
  {
    "action": "actions_cache.delete",
    "description": "A GitHub Actions cache was deleted using the REST API.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "user_id",
      "user",
      "repo_id",
      "repo",
      "org",
      "org_id",
      "actions_cache_id",
      "actions_cache_key",
      "actions_cache_version",
      "actions_cache_scope",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "artifact.destroy",
    "description": "A workflow run artifact was manually deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "action",
      "actor",
      "user_agent",
      "actor_id",
      "repo",
      "repo_id",
      "request_id",
      "@timestamp",
      "created_at",
      "_document_id",
      "operation_type",
      "programmatic_access_type"
    ]
  },
  {
    "action": "billing.budget_create",
    "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "customer_id",
      "target_amount",
      "target_type",
      "target_id",
      "alert_enabled",
      "status",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "pricing_target_type",
      "pricing_target_id",
      "budget_limit_type",
      "alert_recipient_user_ids"
    ]
  },
  {
    "action": "billing.budget_delete",
    "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "customer_id",
      "uuid",
      "status",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "billing.budget_update",
    "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "customer_id",
      "target_amount",
      "target_type",
      "target_id",
      "alert_enabled",
      "status",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header",
      "old_target_amount",
      "old_budget_limit_type",
      "old_alert_enabled",
      "old_target_id",
      "old_pricing_target_type",
      "old_pricing_target_id"
    ]
  },
  {
    "action": "billing.change_billing_type",
    "description": "The way the account pays for GitHub was changed.",
    "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method",
    "fields": [
      "actor_id",
      "user",
      "@timestamp",
      "actor",
      "user_id",
      "action",
      "created_at",
      "operation_type",
      "_document_id",
      "user_agent",
      "request_id"
    ],
    "docs_reference_titles": "Managing your payment and billing information"
  },
  {
    "action": "billing.change_email",
    "description": "The billing email address changed.",
    "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email",
    "fields": [
      "actor",
      "operation_type",
      "actor_id",
      "org_id",
      "@timestamp",
      "user_agent",
      "request_id",
      "created_at",
      "_document_id",
      "org",
      "email",
      "action",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing your payment and billing information"
  },
  {
    "action": "billing_customer.azure_subscription_linked",
    "description": "Azure subscription has been linked on this account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "billing_customer.azure_subscription_unlinked",
    "description": "Azure subscription has been unlinked on this account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "billing.lock",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "oauth_application_id",
      "@timestamp",
      "actor_id",
      "operation_type",
      "_document_id",
      "request_id",
      "actor",
      "user",
      "user_id",
      "user_agent",
      "created_at",
      "action"
    ]
  },
  {
    "action": "billing.overage_policy_updated",
    "description": "The premium request paid usage policy for your GitHub account was changed.",
    "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage"
  },
  {
    "action": "billing.unlock",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "user",
      "operation_type",
      "user_agent",
      "created_at",
      "user_id",
      "request_id",
      "actor",
      "action",
      "@timestamp",
      "_document_id",
      "programmatic_access_type"
    ]
  },
  {
    "action": "billing.update_bill_cycle_day",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "business.security_center_export_code_scanning_metrics",
    "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "start_date",
      "end_date",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "business.security_center_export_coverage",
    "description": "A CSV export was requested on the \"Coverage\" page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "business.security_center_export_overview_dashboard",
    "description": "A CSV export was requested on the \"Overview Dashboard\" page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "start_date",
      "end_date",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "business.security_center_export_risk",
    "description": "A CSV export was requested on the \"Risk\" page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "business_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "business.set_actions_cache_retention_policy",
    "description": "The cache retention policy for GitHub Actions was set for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "name",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_actions_cache_storage_policy",
    "description": "The cache storage policy for GitHub Actions was set for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "name",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_actions_fork_pr_approvals_policy",
    "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "policy",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_actions_private_fork_pr_approvals_policy",
    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "policy",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_actions_retention_limit",
    "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "limit",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_default_workflow_permissions",
    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_fork_pr_workflows_policy",
    "description": "The policy for fork pull request workflows was changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "policy",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "business.set_workflow_permission_can_approve_pr",
    "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.",
    "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise"
  },
  {
    "action": "checks.auto_trigger_disabled",
    "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.",
    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
    "fields": [
      "visibility",
      "user_agent",
      "user",
      "@timestamp",
      "repo",
      "actor_id",
      "user_id",
      "action",
      "created_at",
      "actor",
      "operation_type",
      "request_id",
      "repo_id",
      "_document_id"
    ],
    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
  },
  {
    "action": "checks.auto_trigger_enabled",
    "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.",
    "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "repo",
      "repo_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo"
    ],
    "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites"
  },
  {
    "action": "checks.delete_logs",
    "description": "Logs in a check suite were deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "actor",
      "actor_id",
      "operation_type",
      "repo_id",
      "action",
      "created_at",
      "_document_id",
      "user_agent",
      "request_id",
      "repo",
      "programmatic_access_type"
    ]
  },
  {
    "action": "codespaces.allow_permissions",
    "description": "A codespace using custom permissions from its devcontainer.json file was launched.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "origin_repository",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "codespaces.connect",
    "description": "Credentials for a codespace were refreshed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repository_id",
      "repository",
      "pull_request_id",
      "user_id",
      "org_id",
      "owner",
      "name",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot",
      "machine_type",
      "devcontainer_path"
    ]
  },
  {
    "action": "codespaces.create",
    "description": "A codespace was created",
    "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repository_id",
      "repository",
      "pull_request_id",
      "owner",
      "name",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot",
      "machine_type",
      "devcontainer_path"
    ],
    "docs_reference_titles": "Creating a codespace for a repository"
  },
  {
    "action": "codespaces.destroy",
    "description": "A user deleted a codespace.",
    "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repository_id",
      "repository",
      "pull_request_id",
      "owner",
      "name",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Deleting a codespace"
  },
  {
    "action": "codespaces.export_environment",
    "description": "A codespace was exported to a branch on GitHub.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "owner",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "public_repo"
    ]
  },
  {
    "action": "codespaces.restore",
    "description": "A codespace was restored.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "owner",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "codespaces.start_environment",
    "description": "A codespace was started.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "org",
      "owner",
      "pull_request_id",
      "machine_type",
      "user_id",
      "user",
      "devcontainer_path",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "codespaces.suspend_environment",
    "description": "A codespace was stopped.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "owner",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "codespaces.trusted_repositories_access_update",
    "description": "A personal account's access and security setting for Codespaces were updated.",
    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "business",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Managing access to other repositories within your codespace"
  },
  {
    "action": "copilot.cfb_seat_added",
    "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "token_id",
      "hashed_token",
      "programmatic_access_type",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "copilot.cfb_seat_assignment_created",
    "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.",
    "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "What is GitHub Copilot?"
  },
  {
    "action": "copilot.cfb_seat_assignment_refreshed",
    "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "hashed_token",
      "programmatic_access_type",
      "actor",
      "actor_id",
      "token_id",
      "token_scopes",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "copilot.cfb_seat_assignment_reused",
    "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "copilot.cfb_seat_assignment_unassigned",
    "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "copilot.cfb_seat_cancelled",
    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "seat_assignment",
      "request_access_security_header"
    ]
  },
  {
    "action": "copilot.cfb_seat_cancelled_by_staff",
    "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user_id",
      "user",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id"
    ]
  },
  {
    "action": "copilot.swe_agent_repo_disabled",
    "description": "Specific repositories were disabled from using Copilot coding agent.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "org_id",
      "owner_type",
      "actor_id",
      "owner",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id"
    ]
  },
  {
    "action": "copilot.swe_agent_repo_enabled",
    "description": "Specific repositories were enabled to use Copilot coding agent.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "org_id",
      "owner_type",
      "owner",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "copilot.swe_agent_repo_enablement_updated",
    "description": "Copilot coding agent access was updated for the organization's or user's repositories.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "new_access",
      "old_access",
      "org_id",
      "owner_type",
      "owner",
      "org",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "custom_hosted_runner.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "runner_group_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "custom_hosted_runner.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "custom_hosted_runner.update",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "runner_group_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "dependabot_alerts.disable",
    "description": "Dependabot alerts were disabled for all existing repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
  },
  {
    "action": "dependabot_alerts.enable",
    "description": "Dependabot alerts were enabled for all existing repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories"
  },
  {
    "action": "dependabot_alerts_new_repos.disable",
    "description": "Dependabot alerts were disabled for all new repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
  },
  {
    "action": "dependabot_alerts_new_repos.enable",
    "description": "Dependabot alerts were enabled for all new repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added"
  },
  {
    "action": "dependabot_repository_access.repositories_updated",
    "description": "The repositories that Dependabot can access were updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "dependabot_security_updates.disable",
    "description": "Dependabot security updates were disabled for all existing repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
  },
  {
    "action": "dependabot_security_updates.enable",
    "description": "Dependabot security updates were enabled for all existing repositories.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ]
  },
  {
    "action": "dependabot_security_updates_new_repos.disable",
    "description": " Dependabot security updates were disabled for all new repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
  },
  {
    "action": "dependabot_security_updates_new_repos.enable",
    "description": "Dependabot security updates were enabled for all new repositories.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "dependency_graph.disable",
    "description": "The dependency graph was disabled for all existing repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
  },
  {
    "action": "dependency_graph.enable",
    "description": "The dependency graph was enabled for all existing repositories.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ]
  },
  {
    "action": "dependency_graph_new_repos.disable",
    "description": "The dependency graph was disabled for all new repositories.",
    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"
  },
  {
    "action": "dependency_graph_new_repos.enable",
    "description": "The dependency graph was enabled for all new repositories.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "environment.add_protection_rule",
    "description": "A GitHub Actions deployment protection rule was created via the API.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "programmatic_access_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "environment_name",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "environment.create_actions_secret",
    "description": "A secret was created for a GitHub Actions environment.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "key",
      "visibility",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.create_actions_variable",
    "description": "A variable was created for a GitHub Actions environment.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "environment_name",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "environment.delete",
    "description": "An environment was deleted.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.remove_actions_secret",
    "description": "A secret was deleted for a GitHub Actions environment.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "key",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id",
      "public_repo",
      "token_scopes",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.remove_actions_variable",
    "description": "A variable was deleted for a GitHub Actions environment.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "environment_name",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "environment.remove_protection_rule",
    "description": "A GitHub Actions deployment protection rule was deleted via the API.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.update_actions_secret",
    "description": "A secret was updated for a GitHub Actions environment.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "key",
      "visibility",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "environment.update_actions_variable",
    "description": "A variable was updated for a GitHub Actions environment.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "environment_name",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "environment.update_protection_rule",
    "description": "A GitHub Actions deployment protection rule was updated via the API.",
    "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "@timestamp",
      "_document_id",
      "new_value",
      "approvers_was",
      "approvers",
      "programmatic_access_type",
      "can_admins_bypass",
      "prevent_self_review"
    ],
    "docs_reference_titles": "Managing environments for deployment"
  },
  {
    "action": "gist.create",
    "description": "A gist was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "user_id",
      "user",
      "gist_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "user_agent",
      "actor",
      "actor_id",
      "visibility",
      "action",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "gist.destroy",
    "description": "A gist was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "gist_id",
      "visibility",
      "created_at",
      "_document_id",
      "user",
      "request_id",
      "operation_type",
      "actor",
      "actor_id",
      "action",
      "user_agent",
      "@timestamp",
      "programmatic_access_type"
    ]
  },
  {
    "action": "gist.visibility_change",
    "description": "The visibility of a gist was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "action",
      "operation_type",
      "@timestamp",
      "user_agent",
      "actor",
      "user",
      "gist_id",
      "actor_id",
      "request_id",
      "visibility",
      "user_id",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "git_signing_ssh_public_key.create",
    "description": "An SSH key was added to a user account as a Git commit signing key.",
    "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "key",
      "fingerprint",
      "user_id",
      "user",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "token_scopes",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
  },
  {
    "action": "git_signing_ssh_public_key.delete",
    "description": "An SSH key was removed from a user account as a Git commit signing key.",
    "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "key",
      "fingerprint",
      "user_id",
      "explanation",
      "user",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "token_scopes",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key"
  },
  {
    "action": "github_hosted_runner.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "runner_group_id",
      "business",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "github_hosted_runner.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "business",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "github_hosted_runner.update",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "runner_group_id",
      "business",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "gpg_key.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor_id",
      "created_at",
      "user_id",
      "@timestamp",
      "user",
      "operation_type",
      "_document_id",
      "actor",
      "action",
      "user_agent",
      "request_access_security_header"
    ]
  },
  {
    "action": "gpg_key.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "operation_type",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "action",
      "created_at",
      "_document_id",
      "user_agent",
      "@timestamp",
      "request_access_security_header"
    ]
  },
  {
    "action": "hook.active_changed",
    "description": "A hook's active status was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "name",
      "events",
      "active",
      "active_was",
      "hook_id",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id",
      "programmatic_access_type"
    ]
  },
  {
    "action": "hook.config_changed",
    "description": "A hook's configuration was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "operation_type",
      "@timestamp",
      "_document_id",
      "actor",
      "name",
      "org",
      "user_agent",
      "request_id",
      "hook_id",
      "repo",
      "repo_id",
      "created_at",
      "oauth_application_id",
      "action",
      "events",
      "org_id",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "hook.create",
    "description": "A new hook was added.",
    "docs_reference_links": "/get-started/exploring-integrations/about-webhooks",
    "fields": [
      "oauth_application",
      "_document_id",
      "user_agent",
      "actor",
      "actor_id",
      "oauth_application_id",
      "repo_id",
      "request_id",
      "hook_id",
      "events",
      "repo",
      "@timestamp",
      "operation_type",
      "name",
      "action",
      "created_at",
      "org_id",
      "org",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "About webhooks"
  },
  {
    "action": "hook.destroy",
    "description": "A hook was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "events",
      "repo",
      "created_at",
      "org",
      "name",
      "request_id",
      "actor_id",
      "repo_id",
      "org_id",
      "action",
      "operation_type",
      "oauth_application_id",
      "user_agent",
      "hook_id",
      "@timestamp",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "hook.events_changed",
    "description": "A hook's configured events were changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "events",
      "repo",
      "operation_type",
      "action",
      "_document_id",
      "actor_id",
      "name",
      "events_were",
      "@timestamp",
      "created_at",
      "hook_id",
      "repo_id",
      "org_id",
      "org",
      "user_agent",
      "request_id",
      "oauth_application_id",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "integration.create",
    "description": "A GitHub App was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "action",
      "operation_type",
      "@timestamp",
      "actor",
      "user_agent",
      "actor_id",
      "request_id",
      "name",
      "user_id",
      "_document_id",
      "integration",
      "created_at",
      "programmatic_access_type",
      "request_access_security_header",
      "application_client_id"
    ]
  },
  {
    "action": "integration.destroy",
    "description": "A GitHub App was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "user_id",
      "actor_id",
      "request_id",
      "@timestamp",
      "name",
      "integration",
      "user",
      "_document_id",
      "action",
      "operation_type",
      "created_at",
      "user_agent"
    ]
  },
  {
    "action": "integration.generate_client_secret",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "integration",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "programmatic_access_type",
      "request_access_security_header",
      "application_client_id"
    ]
  },
  {
    "action": "integration_installation.create",
    "description": "A GitHub App was installed.",
    "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps",
    "fields": [
      "operation_type",
      "@timestamp",
      "name",
      "request_id",
      "repository_selection",
      "user_id",
      "action",
      "user_agent",
      "user",
      "created_at",
      "integration",
      "_document_id",
      "programmatic_access_type",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps"
  },
  {
    "action": "integration_installation.destroy",
    "description": "A GitHub App was uninstalled.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
    "fields": [
      "@timestamp",
      "request_id",
      "actor",
      "created_at",
      "_document_id",
      "repository_selection",
      "integration",
      "user_id",
      "user",
      "action",
      "operation_type",
      "name",
      "actor_id",
      "user_agent",
      "programmatic_access_type",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
  },
  {
    "action": "integration_installation.repositories_added",
    "description": "Repositories were added to a GitHub App.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
    "fields": [
      "user_id",
      "repository_selection",
      "name",
      "user",
      "request_id",
      "integration",
      "operation_type",
      "actor_id",
      "action",
      "repositories_added",
      "created_at",
      "_document_id",
      "@timestamp",
      "actor",
      "user_agent",
      "token_scopes",
      "repositories_added_names",
      "programmatic_access_type",
      "actor_is_bot",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
  },
  {
    "action": "integration_installation.repositories_removed",
    "description": "Repositories were removed from a GitHub App.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access",
    "fields": [
      "user",
      "operation_type",
      "user_agent",
      "actor",
      "repository_selection",
      "repositories_removed",
      "integration",
      "user_id",
      "created_at",
      "_document_id",
      "request_id",
      "@timestamp",
      "name",
      "action",
      "actor_id",
      "repositories_removed_names",
      "programmatic_access_type",
      "actor_is_bot",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access"
  },
  {
    "action": "integration_installation.suspend",
    "description": "A GitHub App was suspended.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
    "fields": [
      "user_agent",
      "request_id",
      "name",
      "repository_selection",
      "actor_id",
      "integration",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
  },
  {
    "action": "integration_installation.unsuspend",
    "description": "A GitHub App was unsuspended.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access",
    "fields": [
      "user_agent",
      "request_id",
      "name",
      "repository_selection",
      "actor_id",
      "integration",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access"
  },
  {
    "action": "integration_installation.version_updated",
    "description": "Permissions for a GitHub App were updated.",
    "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app",
    "fields": [
      "integration",
      "user_id",
      "user_agent",
      "name",
      "user",
      "operation_type",
      "actor_id",
      "action",
      "_document_id",
      "request_id",
      "created_at",
      "repository_selection",
      "@timestamp",
      "actor",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app"
  },
  {
    "action": "integration.manager_added",
    "description": "A member of an enterprise or organization was added as a GitHub App manager.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization",
    "fields": [
      "created_at",
      "action",
      "_document_id",
      "name",
      "org_id",
      "manager",
      "operation_type",
      "actor",
      "integration",
      "org",
      "@timestamp",
      "actor_id",
      "request_id",
      "user_agent"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization"
  },
  {
    "action": "integration.manager_removed",
    "description": "A member of an enterprise or organization was removed from being a GitHub App manager.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor_id",
      "org",
      "operation_type",
      "integration",
      "org_id",
      "_document_id",
      "action",
      "actor",
      "name",
      "created_at",
      "manager",
      "@timestamp"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization"
  },
  {
    "action": "integration.remove_client_secret",
    "description": "A client secret for a GitHub App was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "integration",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "integration.revoke_all_tokens",
    "description": "All user tokens for a GitHub App were requested to be revoked.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "integration",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "application_client_id"
    ]
  },
  {
    "action": "integration.revoke_tokens",
    "description": "Token(s) for a GitHub App were revoked.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "integration",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "application_client_id"
    ]
  },
  {
    "action": "integration.suspend",
    "description": "A GitHub App was suspended.",
    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "integration",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
  },
  {
    "action": "integration.transfer",
    "description": "Ownership of a GitHub App was transferred to another user or organization.",
    "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app",
    "fields": [
      "@timestamp",
      "user_id",
      "name",
      "transfer_to_id",
      "user",
      "requester",
      "action",
      "requester_id",
      "actor_id",
      "created_at",
      "_document_id",
      "user_agent",
      "transfer_to",
      "operation_type",
      "request_id",
      "actor",
      "integration",
      "transfer_from",
      "transfer_from_id",
      "transfer_from_type",
      "transfer_to_type"
    ],
    "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
  },
  {
    "action": "integration.unsuspend",
    "description": "A GitHub App was unsuspended.",
    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "integration",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "application_client_id"
    ],
    "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
  },
  {
    "action": "issue_dependencies.blocked_by_add",
    "description": "An issue was marked as blocked by another issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "issue_dependencies.blocked_by_remove",
    "description": "The blocked by relationship between an issue and another issue was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "title",
      "org",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "issue_dependencies.blocking_add",
    "description": "An issue was marked as blocking another issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "issue_dependencies.blocking_remove",
    "description": "The blocking relationship between an issue and another issue was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "marketplace_agreement_signature.create",
    "description": "The GitHub Marketplace Developer Agreement was signed.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor",
      "actor_id",
      "@timestamp",
      "_document_id",
      "user_agent",
      "operation_type",
      "created_at",
      "action",
      "user",
      "user_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "marketplace_listing.approve",
    "description": "A listing was approved for inclusion in GitHub Marketplace.",
    "docs_reference_links": "N/A",
    "fields": [
      "secondary_category",
      "actor",
      "primary_category",
      "user",
      "@timestamp",
      "_document_id",
      "user_id",
      "user_agent",
      "operation_type",
      "created_at",
      "request_id",
      "actor_id",
      "marketplace_listing",
      "integration",
      "action"
    ]
  },
  {
    "action": "marketplace_listing.change_category",
    "description": "A category for a listing for an app in GitHub Marketplace was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "primary_category",
      "user_agent",
      "request_id",
      "actor",
      "marketplace_listing",
      "@timestamp",
      "integration",
      "org_id",
      "action",
      "org",
      "secondary_category",
      "operation_type",
      "created_at",
      "actor_id",
      "_document_id"
    ]
  },
  {
    "action": "marketplace_listing.create",
    "description": "A listing for an app in GitHub Marketplace was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "primary_category",
      "_document_id",
      "user",
      "created_at",
      "user_agent",
      "oauth_application",
      "action",
      "request_id",
      "marketplace_listing",
      "user_id",
      "secondary_category",
      "oauth_application_id",
      "actor",
      "actor_id",
      "operation_type",
      "@timestamp"
    ]
  },
  {
    "action": "marketplace_listing.delist",
    "description": "A listing was removed from GitHub Marketplace.",
    "docs_reference_links": "N/A",
    "fields": [
      "org",
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org_id",
      "created_at",
      "secondary_category",
      "operation_type",
      "marketplace_listing",
      "action",
      "@timestamp",
      "_document_id",
      "primary_category",
      "integration"
    ]
  },
  {
    "action": "marketplace_listing_plan.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "created_at",
      "actor",
      "action",
      "operation_type",
      "marketplace_listing",
      "has_free_trial",
      "user_agent",
      "request_id",
      "actor_id",
      "yearly_price_in_cents",
      "description",
      "bullets",
      "monthly_price_in_cents",
      "marketplace_listing_plan",
      "_document_id"
    ]
  },
  {
    "action": "marketplace_listing_plan.publish",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "marketplace_listing_plan",
      "marketplace_listing",
      "description",
      "bullets",
      "has_free_trial",
      "created_at",
      "actor_id",
      "operation_type",
      "_document_id",
      "action",
      "user_agent",
      "request_id",
      "actor",
      "monthly_price_in_cents",
      "yearly_price_in_cents",
      "@timestamp"
    ]
  },
  {
    "action": "marketplace_listing_plan.retire",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "marketplace_listing_plan",
      "_document_id",
      "request_id",
      "description",
      "yearly_price_in_cents",
      "@timestamp",
      "created_at",
      "actor_id",
      "bullets",
      "has_free_trial",
      "marketplace_listing",
      "user_agent",
      "monthly_price_in_cents",
      "action",
      "operation_type"
    ]
  },
  {
    "action": "marketplace_listing_plan.update",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "monthly_price_in_cents",
      "marketplace_listing",
      "_document_id",
      "action",
      "description",
      "bullets",
      "yearly_price_in_cents",
      "request_id",
      "actor_id",
      "has_free_trial",
      "marketplace_listing_plan",
      "user_agent",
      "@timestamp",
      "operation_type",
      "actor",
      "created_at"
    ]
  },
  {
    "action": "marketplace_listing.redraft",
    "description": "A listing was sent back to draft state.",
    "docs_reference_links": "N/A",
    "fields": [
      "_document_id",
      "secondary_category",
      "oauth_application_id",
      "@timestamp",
      "action",
      "user_agent",
      "user_id",
      "operation_type",
      "oauth_application",
      "actor",
      "created_at",
      "marketplace_listing",
      "request_id",
      "actor_id",
      "primary_category",
      "user"
    ]
  },
  {
    "action": "marketplace_listing.reject",
    "description": "A listing was not accepted for inclusion in GitHub Marketplace.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "primary_category",
      "secondary_category",
      "marketplace_listing",
      "oauth_application",
      "oauth_application_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "merge_queue.pull_request_dequeued",
    "description": "A pull request was removed from a merge queue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "repo_id",
      "public_repo",
      "repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "merge_queue.pull_request_queue_jump",
    "description": "A pull request was moved ahead in a merge queue.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "hashed_token",
      "programmatic_access_type",
      "actor",
      "actor_id",
      "oauth_application_id",
      "token_id",
      "token_scopes",
      "repo_id",
      "public_repo",
      "repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "merge_queue.queue_cleared",
    "description": "A merge queue was cleared.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "repo_id",
      "public_repo",
      "repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "merge_queue.update_settings",
    "description": "The settings for a merge queue were updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "max_entries_to_build",
      "min_entries_to_merge",
      "repo_id",
      "public_repo",
      "repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "metered_billing_configuration.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "@timestamp",
      "_document_id",
      "user_id",
      "action",
      "operation_type",
      "created_at",
      "request_access_security_header"
    ]
  },
  {
    "action": "metered_billing_configuration.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id"
    ]
  },
  {
    "action": "metered_billing_configuration.update",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "action",
      "org",
      "created_at",
      "operation_type",
      "org_id",
      "@timestamp",
      "_document_id",
      "user_agent",
      "request_id",
      "actor",
      "request_access_security_header"
    ]
  },
  {
    "action": "migration.create",
    "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.",
    "docs_reference_links": "N/A",
    "fields": [
      "repo",
      "org_id",
      "_document_id",
      "org",
      "repo_id",
      "action",
      "actor",
      "created_at",
      "operation_type",
      "@timestamp",
      "user_agent",
      "request_id",
      "actor_id",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "oauth_access.create",
    "description": "An OAuth access token was generated.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token",
    "fields": [
      "_document_id",
      "operation_type",
      "user_agent",
      "actor",
      "@timestamp",
      "user",
      "user_id",
      "created_at",
      "action",
      "actor_id",
      "request_id",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header",
      "oauth_application_name"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens"
  },
  {
    "action": "oauth_access.destroy",
    "description": "An OAuth access token was deleted.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps",
    "fields": [
      "@timestamp",
      "user_agent",
      "action",
      "operation_type",
      "_document_id",
      "actor",
      "created_at",
      "user",
      "user_id",
      "request_id",
      "explanation",
      "hashed_token",
      "actor_id",
      "token_scopes",
      "oauth_application_name"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps"
  },
  {
    "action": "oauth_access.regenerate",
    "description": "An OAuth access token was regenerated.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "user_id",
      "_document_id",
      "created_at",
      "@timestamp",
      "operation_type",
      "action",
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "token_scopes",
      "programmatic_access_type",
      "oauth_application_name"
    ]
  },
  {
    "action": "oauth_access.revoke",
    "description": "An OAuth access token was revoked.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "request_access_security_header",
      "hashed_token",
      "token_id",
      "token_scopes",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "oauth_access.update",
    "description": "An OAuth access token was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor_id",
      "actor",
      "operation_type",
      "_document_id",
      "user_id",
      "created_at",
      "action",
      "@timestamp",
      "user",
      "user_agent",
      "request_access_security_header"
    ]
  },
  {
    "action": "oauth_application.create",
    "description": "An OAuth application was created.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "org",
      "created_at",
      "oauth_application_id",
      "operation_type",
      "user_agent",
      "actor_id",
      "org_id",
      "action",
      "actor",
      "oauth_application",
      "@timestamp",
      "_document_id",
      "request_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.destroy",
    "description": "An OAuth application was deleted.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "created_at",
      "oauth_application_id",
      "user_id",
      "operation_type",
      "@timestamp",
      "user_agent",
      "oauth_application",
      "_document_id",
      "actor",
      "actor_id",
      "request_id",
      "action",
      "user",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.generate_client_secret",
    "description": "An OAuth application's secret key was generated.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application",
      "oauth_application_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.remove_client_secret",
    "description": "An OAuth application's secret key was deleted.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application",
      "oauth_application_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.reset_secret",
    "description": "The secret key for an OAuth application was reset.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "user",
      "user_id",
      "action",
      "oauth_application",
      "operation_type",
      "request_id",
      "actor_id",
      "_document_id",
      "created_at",
      "actor",
      "oauth_application_id",
      "@timestamp",
      "user_agent"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.revoke_all_tokens",
    "description": "All user tokens for an OAuth application were requested to be revoked.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application",
      "oauth_application_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.revoke_tokens",
    "description": "Token(s) for an OAuth application were revoked.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "oauth_application_id",
      "oauth_application",
      "actor_id",
      "user_agent",
      "@timestamp",
      "request_id",
      "user_id",
      "action",
      "_document_id",
      "actor",
      "user",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_application.transfer",
    "description": "An OAuth application was transferred from one account to another.",
    "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app",
    "fields": [
      "actor",
      "operation_type",
      "created_at",
      "user_agent",
      "oauth_application",
      "actor_id",
      "oauth_application_id",
      "@timestamp",
      "user_id",
      "_document_id",
      "request_id",
      "user",
      "action"
    ],
    "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app"
  },
  {
    "action": "oauth_authorization.create",
    "description": "An authorization for an OAuth application was created.",
    "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
    "fields": [
      "operation_type",
      "user_agent",
      "user_id",
      "actor",
      "org_id",
      "_document_id",
      "request_id",
      "action",
      "@timestamp",
      "created_at",
      "actor_id",
      "user",
      "business",
      "business_id",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot",
      "request_access_security_header",
      "oauth_application_name"
    ],
    "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
  },
  {
    "action": "oauth_authorization.destroy",
    "description": "An authorization for an OAuth application was deleted.",
    "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations",
    "fields": [
      "user_agent",
      "_document_id",
      "request_id",
      "operation_type",
      "@timestamp",
      "actor",
      "created_at",
      "explanation",
      "user",
      "user_id",
      "org_id",
      "action",
      "actor_id",
      "token_scopes",
      "actor_is_bot",
      "oauth_application_name"
    ],
    "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps"
  },
  {
    "action": "oauth_authorization.update",
    "description": "An authorization for an OAuth application was updated.",
    "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps",
    "fields": [
      "org_id",
      "request_id",
      "user_id",
      "actor",
      "actor_id",
      "user_agent",
      "@timestamp",
      "operation_type",
      "action",
      "user",
      "created_at",
      "_document_id",
      "actor_is_bot",
      "request_access_security_header",
      "oauth_application_name"
    ],
    "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps"
  },
  {
    "action": "org.add_member",
    "description": "A user joined an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "permission",
      "_document_id",
      "org",
      "operation_type",
      "request_id",
      "actor",
      "user",
      "@timestamp",
      "created_at",
      "user_agent",
      "org_id",
      "user_id",
      "actor_id",
      "action",
      "programmatic_access_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "org.add_outside_collaborator",
    "description": "An outside collaborator was added to a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "inviter",
      "org",
      "org_id",
      "repo",
      "repo_id",
      "public_repo",
      "permission",
      "invitee",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "org.advanced_security_disabled_for_new_repos",
    "description": "GitHub Advanced Security was disabled for new repositories in an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id",
      "token_scopes"
    ]
  },
  {
    "action": "org.advanced_security_disabled_on_all_repos",
    "description": "GitHub Advanced Security was disabled for all repositories in an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes"
    ]
  },
  {
    "action": "org.advanced_security_enabled_for_new_repos",
    "description": "GitHub Advanced Security was enabled for new repositories in an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id",
      "token_scopes"
    ]
  },
  {
    "action": "org.advanced_security_enabled_on_all_repos",
    "description": "GitHub Advanced Security was enabled for all repositories in an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes"
    ]
  },
  {
    "action": "org.remove_member",
    "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.",
    "docs_reference_links": "N/A",
    "fields": [
      "_document_id",
      "request_id",
      "actor_id",
      "user_agent",
      "actor",
      "action",
      "user_id",
      "@timestamp",
      "created_at",
      "user",
      "operation_type",
      "org_id",
      "org",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "org.security_center_export_code_scanning_metrics",
    "description": "A CSV export was requested on the CodeQL pull request alerts page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "start_date",
      "end_date",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot"
    ]
  },
  {
    "action": "org.security_center_export_coverage",
    "description": "A CSV export was requested on the Coverage page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "org.security_center_export_overview_dashboard",
    "description": "A CSV export was requested on the Overview Dashboard page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "start_date",
      "end_date",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "org.security_center_export_risk",
    "description": "A CSV export was requested on the Risk page.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "user",
      "user_id",
      "query",
      "filename",
      "requested_at",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "org.set_actions_cache_retention_policy",
    "description": "The cache retention policy for GitHub Actions was set for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
  },
  {
    "action": "org.set_actions_cache_storage_policy",
    "description": "The cache storage policy for GitHub Actions was set for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization"
  },
  {
    "action": "org.set_actions_fork_pr_approvals_policy",
    "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "policy",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks"
  },
  {
    "action": "org.set_actions_private_fork_pr_approvals_policy",
    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "policy",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
  },
  {
    "action": "org.set_actions_retention_limit",
    "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.",
    "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "limit",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization"
  },
  {
    "action": "org.set_default_workflow_permissions",
    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization"
  },
  {
    "action": "org.set_fork_pr_workflows_policy",
    "description": "The policy for workflows on private repository forks was changed.",
    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "policy",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks"
  },
  {
    "action": "org.set_workflow_permission_can_approve_pr",
    "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.",
    "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests"
  },
  {
    "action": "org.update_member",
    "description": "A person's role was changed from owner to member or member to owner.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "org_id",
      "created_at",
      "_document_id",
      "user",
      "user_id",
      "action",
      "request_id",
      "actor_id",
      "old_permission",
      "permission",
      "actor",
      "user_agent",
      "operation_type",
      "org"
    ]
  },
  {
    "action": "org.update_member_repository_creation_permission",
    "description": "The create repository permission for organization members was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "action",
      "@timestamp",
      "request_id",
      "actor_id",
      "permission",
      "created_at",
      "user_agent",
      "org",
      "org_id",
      "_document_id",
      "visibility",
      "operation_type"
    ]
  },
  {
    "action": "org.update_member_repository_invitation_permission",
    "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.",
    "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators",
    "fields": [
      "actor_id",
      "permission",
      "action",
      "org_id",
      "actor",
      "created_at",
      "_document_id",
      "business_id",
      "operation_type",
      "org",
      "user_agent",
      "request_id",
      "business",
      "@timestamp"
    ],
    "docs_reference_titles": "Setting permissions for adding outside collaborators"
  },
  {
    "action": "pages_protected_domain.create",
    "description": "A GitHub Pages verified domain was created for an organization or enterprise.",
    "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "owner",
      "owner_type",
      "domain",
      "state",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
  },
  {
    "action": "pages_protected_domain.delete",
    "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.",
    "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "owner",
      "owner_type",
      "domain",
      "state",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
  },
  {
    "action": "pages_protected_domain.verify",
    "description": "A GitHub Pages domain was verified for an organization or enterprise.",
    "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "owner",
      "owner_type",
      "domain",
      "state",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages"
  },
  {
    "action": "passkey.register",
    "description": "A new passkey was added.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "nickname",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "passkey.remove",
    "description": "A new passkey was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "nickname",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "payment_method.create",
    "description": "A new payment method was added, such as a new credit card or PayPal account.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "user",
      "operation_type",
      "user_id",
      "_document_id",
      "action",
      "actor",
      "actor_id",
      "@timestamp",
      "created_at",
      "request_access_security_header"
    ]
  },
  {
    "action": "payment_method.remove",
    "description": "A payment method was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "created_at",
      "actor_id",
      "@timestamp",
      "user_id",
      "action",
      "operation_type",
      "actor",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "payment_method.update",
    "description": "An existing payment method was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "request_id",
      "org_id",
      "created_at",
      "actor_id",
      "@timestamp",
      "action",
      "actor",
      "org",
      "user_agent",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "personal_access_token.access_granted",
    "description": "A fine-grained personal access token was granted access to resources.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_id",
      "user_programmatic_access_name",
      "repository_selection",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
  },
  {
    "action": "personal_access_token.access_revoked",
    "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_id",
      "user_programmatic_access_name",
      "repository_selection",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization"
  },
  {
    "action": "personal_access_token.create",
    "description": "Triggered when you create a fine-grained personal access token.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_name",
      "user",
      "user_id",
      "repository_selection",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "personal_access_token.credential_regenerated",
    "description": "Triggered when you regenerate a fine-grained personal access token.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_name",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "personal_access_token.credential_revoked",
    "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.",
    "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users",
    "fields": [
      "user_programmatic_access_name",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users"
  },
  {
    "action": "personal_access_token.destroy",
    "description": "Triggered when you delete a fine-grained personal access token.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_name",
      "user",
      "user_id",
      "explanation",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "personal_access_token.request_cancelled",
    "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_name",
      "org",
      "org_id",
      "repository_selection",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "user_programmatic_access_request_id"
    ]
  },
  {
    "action": "personal_access_token.request_created",
    "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_id",
      "user_programmatic_access_name",
      "user",
      "user_id",
      "repository_selection",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "user_programmatic_access_request_id"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
  },
  {
    "action": "personal_access_token.request_denied",
    "description": "A request for a fine-grained personal access token to access organization resources was denied.",
    "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user_programmatic_access_name",
      "org",
      "org_id",
      "repository_selection",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "user_programmatic_access_request_id"
    ],
    "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization"
  },
  {
    "action": "personal_access_token.update",
    "description": "A fine-grained personal access token was updated.",
    "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user_programmatic_access_name",
      "user",
      "user_id",
      "repository_selection",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens"
  },
  {
    "action": "premium_runner.create",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "runner_group_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "premium_runner.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "premium_runner.update",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "name",
      "runner_group_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "private_vulnerability_reporting.disable",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "private_vulnerability_reporting.enable",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "private_vulnerability_reporting_new_repos.disable",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "private_vulnerability_reporting_new_repos.enable",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "profile_picture.update",
    "description": "A profile picture was updated.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile",
    "fields": [
      "user",
      "actor_id",
      "user_id",
      "@timestamp",
      "created_at",
      "owner",
      "action",
      "_document_id",
      "request_id",
      "user_agent",
      "actor",
      "operation_type"
    ],
    "docs_reference_titles": "Personalize your profile"
  },
  {
    "action": "project.access",
    "description": "A project board visibility was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "actor",
      "user_agent",
      "operation_type",
      "user",
      "created_at",
      "user_id",
      "action",
      "request_id",
      "_document_id",
      "@timestamp"
    ]
  },
  {
    "action": "project.close",
    "description": "A project board was closed.",
    "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board",
    "fields": [
      "org_id",
      "user_agent",
      "request_id",
      "operation_type",
      "@timestamp",
      "created_at",
      "repo_id",
      "org",
      "_document_id",
      "project_id",
      "action",
      "actor",
      "actor_id",
      "repo",
      "project_kind"
    ],
    "docs_reference_titles": "Closing a project (classic)"
  },
  {
    "action": "project_collaborator.add",
    "description": "A collaborator was added to a project.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "collaborator_type",
      "org",
      "org_id",
      "collaborator",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "public_project",
      "project_name",
      "project_role",
      "old_project_role",
      "request_access_security_header"
    ]
  },
  {
    "action": "project_collaborator.remove",
    "description": "A collaborator was removed from a project.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "collaborator_type",
      "user",
      "user_id",
      "collaborator",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "project_collaborator.update",
    "description": "A project collaborator's permission level was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "public_project",
      "project_name",
      "collaborator_type",
      "project_role",
      "old_project_role",
      "project_id",
      "user",
      "user_id",
      "collaborator",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "project.create",
    "description": "A project board was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "user",
      "_document_id",
      "request_id",
      "user_id",
      "user_agent",
      "@timestamp",
      "actor_id",
      "action",
      "created_at",
      "actor"
    ]
  },
  {
    "action": "project.delete",
    "description": "A project board was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "action",
      "actor_id",
      "operation_type",
      "actor",
      "user_id",
      "@timestamp",
      "created_at",
      "_document_id",
      "user_agent",
      "user"
    ]
  },
  {
    "action": "project_field.create",
    "description": "A field was created in a project board.",
    "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields"
  },
  {
    "action": "project_field.delete",
    "description": "A field was deleted in a project board.",
    "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields"
  },
  {
    "action": "project.link",
    "description": "A repository was linked to a project board.",
    "docs_reference_links": "N/A",
    "fields": [
      "repo_id",
      "action",
      "actor_id",
      "org_id",
      "user_agent",
      "request_id",
      "actor",
      "operation_type",
      "@timestamp",
      "_document_id",
      "created_at",
      "org",
      "repo"
    ]
  },
  {
    "action": "project.open",
    "description": "A project board was reopened.",
    "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board",
    "fields": [
      "actor",
      "request_id",
      "actor_id",
      "action",
      "user_id",
      "project_id",
      "_document_id",
      "user_agent",
      "operation_type",
      "user",
      "@timestamp",
      "created_at",
      "project_kind",
      "project_name"
    ],
    "docs_reference_titles": "Reopening a closed project (classic)"
  },
  {
    "action": "project.rename",
    "description": "A project board was renamed.",
    "docs_reference_links": "N/A",
    "fields": [
      "action",
      "created_at",
      "request_id",
      "actor_id",
      "old_name",
      "operation_type",
      "@timestamp",
      "repo",
      "_document_id",
      "user_agent",
      "org_id",
      "business_id",
      "actor",
      "repo_id",
      "org",
      "business"
    ]
  },
  {
    "action": "project.unlink",
    "description": "A repository was unlinked from a project board.",
    "docs_reference_links": "N/A",
    "fields": [
      "repo",
      "repo_id",
      "operation_type",
      "actor",
      "action",
      "created_at",
      "actor_id",
      "_document_id",
      "request_id",
      "@timestamp",
      "user_agent",
      "org",
      "org_id"
    ]
  },
  {
    "action": "project.update_org_permission",
    "description": "The project's base-level permission for all organization members was changed or removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "org",
      "@timestamp",
      "_document_id",
      "operation_type",
      "created_at",
      "request_id",
      "actor_id",
      "action",
      "org_id",
      "user_agent"
    ]
  },
  {
    "action": "project.update_team_permission",
    "description": "A team's project board permission level was changed or when a team was added or removed from a project board.",
    "docs_reference_links": "N/A",
    "fields": [
      "created_at",
      "org_id",
      "operation_type",
      "org",
      "actor_id",
      "_document_id",
      "request_id",
      "team",
      "@timestamp",
      "action",
      "user_agent",
      "actor"
    ]
  },
  {
    "action": "project.update_user_permission",
    "description": "A user was added to or removed from a project board or had their permission level changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "user_id",
      "operation_type",
      "@timestamp",
      "actor_id",
      "user",
      "user_agent",
      "actor",
      "created_at",
      "org",
      "_document_id",
      "org_id",
      "action",
      "programmatic_access_type"
    ]
  },
  {
    "action": "project_view.create",
    "description": "A view was created in a project board.",
    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
  },
  {
    "action": "project_view.delete",
    "description": "A view was deleted in a project board.",
    "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views"
  },
  {
    "action": "project.visibility_private",
    "description": "A project's visibility was changed from public to private.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "project_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "project_kind",
      "project_name"
    ]
  },
  {
    "action": "project.visibility_public",
    "description": "A project's visibility was changed from private to public.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "project_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "project_kind",
      "project_name",
      "request_access_security_header"
    ]
  },
  {
    "action": "protected_branch.update_merge_queue_enforcement_level",
    "description": "Enforcement of the merge queue was modified for a branch.",
    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "merge_queue_enforcement_level",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue"
  },
  {
    "action": "public_key.create",
    "description": "An SSH key was added to a user account or a deploy key was added to a repository.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account",
    "fields": [
      "read_only",
      "user_agent",
      "actor_id",
      "operation_type",
      "created_at",
      "_document_id",
      "key",
      "fingerprint",
      "actor",
      "action",
      "user",
      "user_id",
      "@timestamp",
      "request_id",
      "title",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account"
  },
  {
    "action": "public_key.delete",
    "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.",
    "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys",
    "fields": [
      "fingerprint",
      "user_agent",
      "read_only",
      "explanation",
      "repo",
      "@timestamp",
      "action",
      "key",
      "operation_type",
      "_document_id",
      "actor",
      "title",
      "request_id",
      "actor_id",
      "repo_id",
      "created_at",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys"
  },
  {
    "action": "public_key.unverification_failure",
    "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
    "fields": [
      "user_agent",
      "request_id",
      "title",
      "key",
      "fingerprint",
      "read_only",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "token_scopes"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
  },
  {
    "action": "public_key.unverify",
    "description": "A user account's SSH key or a repository's deploy key was unverified.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
    "fields": [
      "created_at",
      "operation_type",
      "_document_id",
      "title",
      "request_id",
      "key",
      "action",
      "actor",
      "read_only",
      "explanation",
      "repo_id",
      "@timestamp",
      "actor_id",
      "repo",
      "user_agent",
      "fingerprint"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
  },
  {
    "action": "public_key.update",
    "description": "A user account's SSH key or a repository's deploy key was updated.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
    "fields": [
      "actor",
      "user_agent",
      "key",
      "fingerprint",
      "read_only",
      "repo_id",
      "operation_type",
      "created_at",
      "actor_id",
      "repo",
      "action",
      "_document_id",
      "request_id",
      "title",
      "@timestamp",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
  },
  {
    "action": "public_key.verification_failure",
    "description": "A user account's SSH key or a repository's deploy key was unable to be verified.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
    "fields": [
      "repo_id",
      "actor",
      "key",
      "fingerprint",
      "@timestamp",
      "request_id",
      "actor_id",
      "oauth_application_id",
      "title",
      "action",
      "user_agent",
      "created_at",
      "repo",
      "read_only",
      "operation_type",
      "_document_id",
      "user",
      "user_id",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
  },
  {
    "action": "public_key.verify",
    "description": "A user account's SSH key or a repository's deploy key was verified.",
    "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys",
    "fields": [
      "operation_type",
      "user",
      "@timestamp",
      "_document_id",
      "action",
      "created_at",
      "key",
      "fingerprint",
      "actor_id",
      "actor",
      "title",
      "user_agent",
      "user_id",
      "request_id",
      "read_only",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys"
  },
  {
    "action": "repo.access",
    "description": "The visibility of a repository changed.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility",
    "fields": [
      "repo_id",
      "user",
      "request_id",
      "operation_type",
      "@timestamp",
      "actor_id",
      "user_id",
      "created_at",
      "user_agent",
      "actor",
      "action",
      "repo",
      "visibility",
      "_document_id",
      "previous_visibility",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility"
  },
  {
    "action": "repo.actions_enabled",
    "description": "GitHub Actions was enabled for a repository.",
    "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api"
  },
  {
    "action": "repo.add_member",
    "description": "A collaborator was added to a repository.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository",
    "fields": [
      "visibility",
      "repo",
      "created_at",
      "user_agent",
      "operation_type",
      "@timestamp",
      "_document_id",
      "actor",
      "actor_id",
      "repo_id",
      "user",
      "request_id",
      "action",
      "user_id",
      "oauth_application_id",
      "org",
      "org_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Inviting collaborators to a personal repository"
  },
  {
    "action": "repo.add_topic",
    "description": "A topic was added to a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics",
    "fields": [
      "action",
      "user_agent",
      "actor",
      "repo",
      "repo_id",
      "user",
      "org",
      "org_id",
      "request_id",
      "actor_id",
      "topic",
      "@timestamp",
      "_document_id",
      "user_id",
      "created_at",
      "operation_type",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics"
  },
  {
    "action": "repo.advanced_security_disabled",
    "description": "GitHub Advanced Security was disabled for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "repository",
      "repository_id",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "programmatic_access_type",
      "actor_is_bot",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
  },
  {
    "action": "repo.advanced_security_enabled",
    "description": "GitHub Advanced Security was enabled for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "repository",
      "repository_id",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository"
  },
  {
    "action": "repo.archived",
    "description": "A repository was archived.",
    "docs_reference_links": "/repositories/archiving-a-github-repository",
    "fields": [
      "repo_id",
      "user_agent",
      "user_id",
      "created_at",
      "@timestamp",
      "repo",
      "user",
      "operation_type",
      "visibility",
      "action",
      "actor_id",
      "actor",
      "_document_id",
      "request_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/repositories/archiving-a-github-repository"
  },
  {
    "action": "repo.change_merge_setting",
    "description": "Pull request merge options were changed for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "oauth_application_id",
      "user_agent",
      "request_id",
      "created_at",
      "@timestamp",
      "_document_id",
      "actor_id",
      "operation_type",
      "action",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "repo.code_scanning_analysis_deleted",
    "description": "Code scanning analysis for a repository was deleted.",
    "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "tool",
      "category",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository"
  },
  {
    "action": "repo.code_scanning_configuration_for_branch_deleted",
    "description": "A code scanning configuration for a branch of a repository was deleted.",
    "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "tool",
      "branch",
      "category",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "Resolving code scanning alerts"
  },
  {
    "action": "repo.config.disable_collaborators_only",
    "description": "The interaction limit for collaborators only was disabled.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "user_agent",
      "actor",
      "actor_id",
      "repo_id",
      "_document_id",
      "action",
      "created_at",
      "repo",
      "operation_type",
      "@timestamp",
      "request_id"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.config.disable_contributors_only",
    "description": "The interaction limit for prior contributors only was disabled in a repository.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "repo",
      "@timestamp",
      "request_id",
      "actor",
      "_document_id",
      "user_agent",
      "actor_id",
      "repo_id",
      "action",
      "operation_type",
      "created_at"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.config.disable_sockpuppet_disallowed",
    "description": "The interaction limit for existing users only was disabled in a repository.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "actor",
      "request_id",
      "repo_id",
      "action",
      "user_agent",
      "_document_id",
      "@timestamp",
      "created_at",
      "actor_id",
      "repo",
      "operation_type"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.config.enable_collaborators_only",
    "description": "The interaction limit for collaborators only was enabled in a repository  Users that are not collaborators or organization members were unable to interact with a repository for a set duration.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "actor",
      "oauth_application_id",
      "created_at",
      "action",
      "request_id",
      "repo_id",
      "repo",
      "@timestamp",
      "_document_id",
      "user_agent",
      "actor_id",
      "operation_type"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.config.enable_contributors_only",
    "description": "The interaction limit for prior contributors only was enabled in a repository  Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "user_agent",
      "request_id",
      "operation_type",
      "created_at",
      "actor",
      "org",
      "action",
      "actor_id",
      "repo",
      "repo_id",
      "org_id",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.config.enable_sockpuppet_disallowed",
    "description": "The interaction limit for existing users was enabled in a repository  New users aren't able to interact with a repository for a set duration  Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.",
    "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository",
    "fields": [
      "actor",
      "operation_type",
      "created_at",
      "user_agent",
      "request_id",
      "action",
      "actor_id",
      "repo",
      "repo_id",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository"
  },
  {
    "action": "repo.configure_self_hosted_jit_runner",
    "description": "A new just-in-time GitHub Actions self-hosted runner was configured",
    "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "hashed_token",
      "programmatic_access_type",
      "actor",
      "actor_id",
      "oauth_application_id",
      "token_id",
      "token_scopes",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository"
  },
  {
    "action": "repo.create",
    "description": "A repository was created.",
    "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository",
    "fields": [
      "repo",
      "user_id",
      "visibility",
      "repo_id",
      "user",
      "request_id",
      "actor_id",
      "action",
      "operation_type",
      "request_category",
      "@timestamp",
      "created_at",
      "_document_id",
      "actor",
      "user_agent",
      "org",
      "oauth_application_id",
      "org_id",
      "request_method",
      "business",
      "business_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository"
  },
  {
    "action": "repo.create_actions_secret",
    "description": "A GitHub Actions secret was created for a repository.",
    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "key",
      "repo",
      "repo_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Using secrets in GitHub Actions"
  },
  {
    "action": "repo.create_actions_variable",
    "description": "A GitHub Actions variable was created for a repository.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "repo.create_integration_secret",
    "description": "A Codespaces or Dependabot secret was created for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "key",
      "visibility",
      "integration",
      "repo",
      "repo_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.destroy",
    "description": "A repository was deleted.",
    "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository",
    "fields": [
      "repo",
      "_document_id",
      "user_agent",
      "user_id",
      "actor",
      "action",
      "user",
      "repo_id",
      "operation_type",
      "request_category",
      "actor_id",
      "visibility",
      "request_id",
      "created_at",
      "@timestamp",
      "request_method",
      "oauth_application_id",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository"
  },
  {
    "action": "repo.pages_cname",
    "description": "A GitHub Pages custom domain was modified in a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "@timestamp",
      "visibility",
      "repo",
      "repo_id",
      "user",
      "request_id",
      "actor_id",
      "cname",
      "user_agent",
      "user_id",
      "created_at",
      "_document_id",
      "action",
      "operation_type",
      "old_cname",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repo.pages_create",
    "description": "A GitHub Pages site was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "user",
      "_document_id",
      "user_id",
      "visibility",
      "action",
      "user_agent",
      "operation_type",
      "repo_id",
      "created_at",
      "@timestamp",
      "request_id",
      "actor",
      "repo",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repo.pages_destroy",
    "description": "A GitHub Pages site was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "created_at",
      "user_id",
      "action",
      "request_id",
      "user",
      "repo",
      "user_agent",
      "_document_id",
      "actor_id",
      "@timestamp",
      "actor",
      "visibility",
      "operation_type",
      "repo_id",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repo.pages_https_redirect_disabled",
    "description": "HTTPS redirects were disabled for a GitHub Pages site.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "actor_id",
      "repo_id",
      "_document_id",
      "user_agent",
      "actor",
      "visibility",
      "user_id",
      "request_id",
      "repo",
      "@timestamp",
      "operation_type",
      "action",
      "created_at",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.pages_https_redirect_enabled",
    "description": "HTTPS redirects were enabled for a GitHub Pages site.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "@timestamp",
      "user_agent",
      "user_id",
      "created_at",
      "visibility",
      "actor",
      "actor_id",
      "user",
      "operation_type",
      "repo_id",
      "action",
      "repo",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.pages_private",
    "description": "A GitHub Pages site visibility was changed to private.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "repo.pages_public",
    "description": "A GitHub Pages site visibility was changed to public.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.pages_soft_delete",
    "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.pages_soft_delete_restore",
    "description": "A GitHub Pages site that was previously soft-deleted was restored.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.pages_source",
    "description": "A GitHub Pages source was modified.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "actor_id",
      "operation_type",
      "user_agent",
      "actor",
      "@timestamp",
      "repo_id",
      "user",
      "_document_id",
      "request_id",
      "visibility",
      "repo",
      "created_at",
      "action",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repo.register_self_hosted_runner",
    "description": "A new self-hosted runner was registered.",
    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository",
    "fields": [
      "actor_id",
      "repo",
      "operation_type",
      "action",
      "@timestamp",
      "actor",
      "user_agent",
      "created_at",
      "_document_id",
      "request_id",
      "repo_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Adding self-hosted runners"
  },
  {
    "action": "repo.remove_actions_secret",
    "description": "A GitHub Actions secret was deleted for a repository.",
    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "key",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Using secrets in GitHub Actions"
  },
  {
    "action": "repo.remove_actions_variable",
    "description": "A GitHub Actions variable was deleted for a repository.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "repo.remove_integration_secret",
    "description": "A Codespaces or Dependabot secret was deleted for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "key",
      "integration",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.remove_member",
    "description": "A collaborator was removed from a repository.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository",
    "fields": [
      "request_id",
      "user",
      "business",
      "action",
      "actor_id",
      "org",
      "org_id",
      "actor",
      "created_at",
      "repo_id",
      "user_agent",
      "business_id",
      "user_id",
      "operation_type",
      "@timestamp",
      "_document_id",
      "visibility",
      "repo",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Removing a collaborator from a personal repository"
  },
  {
    "action": "repo.remove_self_hosted_runner",
    "description": "A self-hosted runner was removed.",
    "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository",
    "fields": [
      "request_id",
      "actor_id",
      "repo_id",
      "@timestamp",
      "_document_id",
      "repo",
      "org_id",
      "action",
      "operation_type",
      "user_agent",
      "actor",
      "created_at",
      "org",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Removing self-hosted runners"
  },
  {
    "action": "repo.remove_topic",
    "description": "A topic was removed from a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "action",
      "repo_id",
      "user_agent",
      "topic",
      "operation_type",
      "user_id",
      "org",
      "org_id",
      "actor",
      "business",
      "request_id",
      "repo",
      "@timestamp",
      "created_at",
      "_document_id",
      "actor_id",
      "business_id",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repo.rename",
    "description": "A repository was renamed.",
    "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository",
    "fields": [
      "user_agent",
      "@timestamp",
      "request_id",
      "actor_id",
      "actor",
      "old_name",
      "repo",
      "user_id",
      "created_at",
      "user",
      "action",
      "operation_type",
      "visibility",
      "repo_id",
      "_document_id",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository"
  },
  {
    "action": "repo.restore",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "repo",
      "action",
      "_document_id",
      "actor_id",
      "user",
      "operation_type",
      "user_agent",
      "request_id",
      "repo_id",
      "@timestamp",
      "created_at",
      "actor",
      "user_id"
    ]
  },
  {
    "action": "repo.set_actions_cache_retention_policy",
    "description": "The cache retention policy for GitHub Actions was set for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
  },
  {
    "action": "repo.set_actions_cache_storage_policy",
    "description": "The cache storage policy for GitHub Actions was set for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository"
  },
  {
    "action": "repo.set_actions_fork_pr_approvals_policy",
    "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "policy",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "public_repo"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks"
  },
  {
    "action": "repo.set_actions_private_fork_pr_approvals_policy",
    "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "visibility",
      "policy",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories"
  },
  {
    "action": "repo.set_actions_retention_limit",
    "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "limit",
      "repo",
      "repo_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository"
  },
  {
    "action": "repo.set_default_workflow_permissions",
    "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository"
  },
  {
    "action": "repo.set_fork_pr_workflows_policy",
    "description": "Triggered when the policy for workflows on private repository forks is changed.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "policy",
      "repo",
      "repo_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks"
  },
  {
    "action": "repo.set_workflow_permission_can_approve_pr",
    "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests"
  },
  {
    "action": "repo.staff_unlock",
    "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "_document_id",
      "user_agent",
      "actor_id",
      "created_at",
      "actor",
      "repo_id",
      "action",
      "org",
      "org_id",
      "request_id",
      "repo",
      "operation_type"
    ]
  },
  {
    "action": "repo.temporary_access_granted",
    "description": "Temporary access was enabled for a repository.",
    "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "repo",
      "repo_id",
      "public_repo",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id"
    ],
    "docs_reference_titles": "Accessing user-owned repositories in your enterprise"
  },
  {
    "action": "repo.transfer",
    "description": "A user accepted a request to receive a transferred repository.",
    "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository",
    "fields": [
      "@timestamp",
      "user_id",
      "_document_id",
      "request_id",
      "actor_id",
      "repo_id",
      "owner",
      "user",
      "old_user",
      "action",
      "operation_type",
      "created_at",
      "user_agent",
      "repo",
      "visibility",
      "repo_was",
      "actor"
    ],
    "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository"
  },
  {
    "action": "repo.transfer_outgoing",
    "description": "A repository was transferred to another repository network.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repo",
      "repo_id",
      "new_nwo",
      "visibility",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "public_repo",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.transfer_start",
    "description": "A user sent a request to transfer a repository to another user or organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "_document_id",
      "operation_type",
      "user_id",
      "request_id",
      "user",
      "action",
      "user_agent",
      "created_at",
      "actor",
      "visibility",
      "repo_id",
      "actor_id",
      "repo",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.unarchived",
    "description": "A repository was unarchived.",
    "docs_reference_links": "/repositories/archiving-a-github-repository",
    "fields": [
      "actor",
      "request_id",
      "actor_id",
      "repo",
      "operation_type",
      "created_at",
      "_document_id",
      "repo_id",
      "user",
      "@timestamp",
      "visibility",
      "user_agent",
      "user_id",
      "action",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "/repositories/archiving-a-github-repository"
  },
  {
    "action": "repo.update_actions_access_settings",
    "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "policy",
      "old_policy",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id"
    ]
  },
  {
    "action": "repo.update_actions_secret",
    "description": "A GitHub Actions secret was updated for a repository.",
    "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "oauth_application_id",
      "key",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "business",
      "business_id",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Using secrets in GitHub Actions"
  },
  {
    "action": "repo.update_actions_settings",
    "description": "A repository administrator changed GitHub Actions policy settings for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "new_policy",
      "old_policy",
      "updated_access_policy",
      "programmatic_access_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "repo.update_actions_variable",
    "description": "A GitHub Actions variable was updated for a repository.",
    "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Store information in variables"
  },
  {
    "action": "repo.update_default_branch",
    "description": "The default branch for a repository was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "visibility",
      "repo",
      "repo_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "repo.update_integration_secret",
    "description": "A Codespaces or Dependabot secret was updated for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "key",
      "visibility",
      "integration",
      "repo",
      "repo_id",
      "org",
      "org_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "repo.update_member",
    "description": "A user's permission to a repository was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "action",
      "_document_id",
      "actor",
      "repo_id",
      "created_at",
      "oauth_application_id",
      "user",
      "@timestamp",
      "repo",
      "operation_type",
      "request_id",
      "org_id",
      "actor_id",
      "visibility",
      "old_permission",
      "org",
      "user_id",
      "old_base_role",
      "old_repo_permission",
      "old_repo_base_role",
      "new_repo_base_role",
      "new_repo_permission",
      "token_scopes",
      "programmatic_access_type",
      "actor_is_bot"
    ]
  },
  {
    "action": "repository_image.create",
    "description": "An image to represent a repository was uploaded.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "operation_type",
      "created_at",
      "actor_id",
      "repo_id",
      "action",
      "request_id",
      "actor",
      "content_type",
      "repo",
      "@timestamp",
      "_document_id",
      "user",
      "user_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "repository_image.destroy",
    "description": "An image to represent a repository was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "content_type",
      "created_at",
      "actor_id",
      "user_id",
      "operation_type",
      "request_id",
      "_document_id",
      "actor",
      "repo_id",
      "user_agent",
      "repo",
      "user",
      "action",
      "@timestamp",
      "request_access_security_header"
    ]
  },
  {
    "action": "repository_invitation.accept",
    "description": "An invitation to join a repository was accepted.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "created_at",
      "request_id",
      "repo",
      "invitee",
      "operation_type",
      "actor",
      "repo_id",
      "_document_id",
      "action",
      "user_agent",
      "inviter",
      "@timestamp",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repository_invitation.cancel",
    "description": "An invitation to join a repository was canceled.",
    "docs_reference_links": "N/A",
    "fields": [
      "inviter",
      "action",
      "operation_type",
      "_document_id",
      "repo_id",
      "repo",
      "@timestamp",
      "user_agent",
      "invitee",
      "created_at",
      "request_id",
      "actor",
      "actor_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "repository_invitation.create",
    "description": "An invitation to join a repository was sent.",
    "docs_reference_links": "N/A",
    "fields": [
      "_document_id",
      "actor",
      "actor_id",
      "@timestamp",
      "invitee",
      "action",
      "request_id",
      "inviter",
      "repo",
      "created_at",
      "user_agent",
      "repo_id",
      "operation_type",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "repository_invitation.reject",
    "description": "An invitation to join a repository was declined.",
    "docs_reference_links": "N/A",
    "fields": [
      "repo",
      "_document_id",
      "actor",
      "invitee",
      "action",
      "@timestamp",
      "request_id",
      "actor_id",
      "operation_type",
      "created_at",
      "inviter",
      "user_agent",
      "repo_id"
    ]
  },
  {
    "action": "repository_ruleset.create",
    "description": "A repository ruleset was created.",
    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "ruleset_id",
      "ruleset_name",
      "ruleset_enforcement",
      "ruleset_source_type",
      "ruleset_rules",
      "ruleset_conditions",
      "ruleset_bypass_actors",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"
  },
  {
    "action": "repository_ruleset.destroy",
    "description": "A repository ruleset was deleted.",
    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "name",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "ruleset_id",
      "ruleset_name",
      "ruleset_enforcement",
      "ruleset_source_type",
      "ruleset_rules",
      "ruleset_bypass_actors",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset"
  },
  {
    "action": "repository_ruleset.update",
    "description": "A repository ruleset was edited.",
    "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "old_name",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "ruleset_id",
      "ruleset_name",
      "ruleset_enforcement",
      "ruleset_source_type",
      "ruleset_rules_updated",
      "ruleset_conditions_added",
      "ruleset_conditions_deleted",
      "ruleset_old_enforcement",
      "ruleset_rules_added",
      "ruleset_rules_deleted",
      "ruleset_old_name",
      "ruleset_conditions_updated",
      "ruleset_bypass_actors_added",
      "ruleset_bypass_actors_deleted",
      "ruleset_bypass_actors_updated",
      "actor_is_bot"
    ],
    "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset"
  },
  {
    "action": "security_key.register",
    "description": "A security key was registered for an account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "user",
      "created_at",
      "user_id",
      "action",
      "operation_type",
      "request_id",
      "@timestamp",
      "_document_id",
      "actor",
      "user_agent",
      "request_access_security_header"
    ]
  },
  {
    "action": "security_key.remove",
    "description": "A security key was removed from an account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "user_id",
      "operation_type",
      "_document_id",
      "user_agent",
      "@timestamp",
      "request_id",
      "actor_id",
      "action",
      "created_at",
      "user",
      "request_access_security_header"
    ]
  },
  {
    "action": "social_identity.linked",
    "description": "A user linked a social identity to their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "request_access_security_header",
      "user_id",
      "action",
      "actor_id",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "social_identity.unlinked",
    "description": "A user unlinked a social identity from their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "social_identity.unlinked_all",
    "description": "A user unlinked all social identities from their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "request_access_security_header",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sponsors.agreement_sign",
    "description": "A GitHub Sponsors agreement was signed on behalf of an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "sponsors_listing_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sponsors.custom_amount_settings_change",
    "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "sponsors_listing_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
  },
  {
    "action": "sponsors.fiscal_host_change",
    "description": "The fiscal host for a GitHub Sponsors listing was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "org",
      "org_id",
      "sponsors_listing_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sponsors.repo_funding_links_file_action",
    "description": "The FUNDING file in a repository was changed.",
    "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository",
    "fields": [
      "@timestamp",
      "action",
      "created_at",
      "_document_id",
      "request_id",
      "repository",
      "repository_id",
      "actor",
      "user_agent",
      "actor_id",
      "operation_type"
    ],
    "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository"
  },
  {
    "action": "sponsors.sponsor_sponsorship_cancel",
    "description": "A sponsorship was canceled.",
    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
    "fields": [
      "operation_type",
      "_document_id",
      "created_at",
      "actor",
      "user",
      "action",
      "actor_id",
      "user_id",
      "@timestamp"
    ],
    "docs_reference_titles": "Downgrading a sponsorship"
  },
  {
    "action": "sponsors.sponsor_sponsorship_create",
    "description": "A sponsorship was created, by sponsoring an account.",
    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
    "fields": [
      "actor",
      "user_id",
      "action",
      "@timestamp",
      "user_agent",
      "request_id",
      "user",
      "operation_type",
      "created_at",
      "actor_id",
      "_document_id"
    ],
    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
  },
  {
    "action": "sponsors.sponsor_sponsorship_payment_complete",
    "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.",
    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes",
    "fields": [
      "active",
      "user",
      "user_id",
      "actor",
      "actor_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes"
  },
  {
    "action": "sponsors.sponsor_sponsorship_preference_change",
    "description": "The option to receive email updates from a sponsored account was changed.",
    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship",
    "fields": [
      "actor_id",
      "action",
      "@timestamp",
      "request_id",
      "user_id",
      "created_at",
      "user",
      "_document_id",
      "user_agent",
      "actor",
      "operation_type"
    ],
    "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship"
  },
  {
    "action": "sponsors.sponsor_sponsorship_tier_change",
    "description": "A sponsorship was upgraded or downgraded.",
    "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship",
    "fields": [
      "user_id",
      "actor",
      "actor_id",
      "action",
      "user",
      "operation_type",
      "@timestamp",
      "_document_id",
      "created_at"
    ],
    "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship"
  },
  {
    "action": "sponsors.sponsored_developer_approve",
    "description": "A GitHub Sponsors account was approved.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
    "fields": [
      "user_id",
      "action",
      "user_agent",
      "request_id",
      "actor",
      "user",
      "operation_type",
      "@timestamp",
      "created_at",
      "actor_id",
      "_document_id"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
  },
  {
    "action": "sponsors.sponsored_developer_create",
    "description": "A GitHub Sponsors account was created.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
    "fields": [
      "user_id",
      "operation_type",
      "request_id",
      "actor_id",
      "@timestamp",
      "_document_id",
      "user",
      "action",
      "created_at",
      "user_agent",
      "actor"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
  },
  {
    "action": "sponsors.sponsored_developer_disable",
    "description": "A GitHub Sponsors account was disabled.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "sponsors_listing_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "sponsors.sponsored_developer_profile_update",
    "description": "The profile for GitHub Sponsors account was edited.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors",
    "fields": [
      "@timestamp",
      "actor_id",
      "operation_type",
      "created_at",
      "user_agent",
      "request_id",
      "actor",
      "action",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors"
  },
  {
    "action": "sponsors.sponsored_developer_redraft",
    "description": "A GitHub Sponsors account was returned to draft state from approved state.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "created_at",
      "request_id",
      "user",
      "action",
      "user_agent",
      "operation_type",
      "_document_id",
      "actor",
      "actor_id",
      "user_id"
    ]
  },
  {
    "action": "sponsors.sponsored_developer_request_approval",
    "description": "An application for GitHub Sponsors was submitted for approval.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
    "fields": [
      "user_agent",
      "user",
      "@timestamp",
      "actor_id",
      "user_id",
      "request_id",
      "_document_id",
      "actor",
      "action",
      "operation_type",
      "created_at"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
  },
  {
    "action": "sponsors.sponsored_developer_tier_description_update",
    "description": "The description for a sponsorship tier was changed.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers",
    "fields": [
      "operation_type",
      "request_id",
      "actor",
      "user_id",
      "action",
      "@timestamp",
      "_document_id",
      "user_agent",
      "actor_id",
      "user",
      "created_at"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers"
  },
  {
    "action": "sponsors.sponsored_developer_update_newsletter_send",
    "description": "Triggered when you send an email update to your sponsors.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors",
    "fields": [
      "request_id",
      "actor",
      "action",
      "user_agent",
      "operation_type",
      "_document_id",
      "created_at",
      "actor_id",
      "user",
      "user_id",
      "@timestamp"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors"
  },
  {
    "action": "sponsors.sponsors_patreon_user_create",
    "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "patreon_email",
      "patreon_username",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account"
  },
  {
    "action": "sponsors.sponsors_patreon_user_destroy",
    "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.",
    "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "patreon_email",
      "patreon_username",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ],
    "docs_reference_titles": "Unlinking your Patreon account from GitHub"
  },
  {
    "action": "sponsors.update_tier_repository",
    "description": "A GitHub Sponsors tier changed access for a repository.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "sponsors_listing_id",
      "repo",
      "repo_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sponsors.update_tier_welcome_message",
    "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "sponsors_listing_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sponsors.waitlist_join",
    "description": "You join the waitlist to join GitHub Sponsors.",
    "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account",
    "fields": [
      "request_id",
      "actor",
      "user_id",
      "user_agent",
      "actor_id",
      "action",
      "operation_type",
      "created_at",
      "user",
      "@timestamp",
      "_document_id"
    ],
    "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account"
  },
  {
    "action": "sponsors.withdraw_agreement_signature",
    "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "sponsors_listing_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "sub_issues.parent_issue_add",
    "description": "A parent issue was added to an issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "sub_issues.parent_issue_remove",
    "description": "A parent issue was removed from an issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "sub_issues.sub_issue_add",
    "description": "A sub-issue was added to an issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "sub_issues.sub_issue_remove",
    "description": "A sub-issue was removed from an issue.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "title",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "successor_invitation.accept",
    "description": "Triggered when you accept a succession invitation.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
  },
  {
    "action": "successor_invitation.cancel",
    "description": "Triggered when you cancel a succession invitation.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
  },
  {
    "action": "successor_invitation.create",
    "description": "Triggered when you create a succession invitation.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
  },
  {
    "action": "successor_invitation.decline",
    "description": "Triggered when you decline a succession invitation.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
  },
  {
    "action": "successor_invitation.destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "successor_invitation.revoke",
    "description": "Triggered when you revoke a succession invitation.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories"
  },
  {
    "action": "trusted_device.register",
    "description": "A new trusted device was added.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "trusted_device.remove",
    "description": "A trusted device was removed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "two_factor_account_recovery.abort",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "created_at",
      "action",
      "request_id",
      "user_id",
      "@timestamp",
      "_document_id",
      "user",
      "user_agent",
      "operation_type"
    ]
  },
  {
    "action": "two_factor_account_recovery.complete",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "@timestamp",
      "created_at",
      "user_id",
      "operation_type",
      "user",
      "_document_id",
      "user_agent",
      "action"
    ]
  },
  {
    "action": "two_factor_account_recovery.ignore",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "_document_id",
      "created_at",
      "user_id",
      "operation_type",
      "@timestamp",
      "user",
      "action"
    ]
  },
  {
    "action": "two_factor_account_recovery.staff_approve",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "created_at",
      "actor",
      "actor_id",
      "@timestamp",
      "request_id",
      "user",
      "user_id",
      "user_agent",
      "operation_type",
      "action",
      "_document_id"
    ]
  },
  {
    "action": "two_factor_account_recovery.staff_decline",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "actor",
      "action",
      "@timestamp",
      "user_agent",
      "operation_type",
      "user",
      "created_at",
      "request_id",
      "actor_id",
      "_document_id"
    ]
  },
  {
    "action": "two_factor_account_recovery.start",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "operation_type",
      "@timestamp",
      "user_agent",
      "request_id",
      "created_at",
      "user_id",
      "action",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "two_factor_account_recovery.two_factor_destroy",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "user_id",
      "action",
      "@timestamp",
      "created_at",
      "user_agent",
      "user",
      "_document_id",
      "request_id"
    ]
  },
  {
    "action": "two_factor_authentication.add_factor",
    "description": "A secondary authentication factor was added to a user account.",
    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
  },
  {
    "action": "two_factor_authentication.disabled",
    "description": "Two-factor authentication was disabled for a user account.",
    "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account",
    "fields": [
      "actor",
      "action",
      "_document_id",
      "user_agent",
      "user",
      "user_id",
      "actor_id",
      "created_at",
      "operation_type",
      "request_id",
      "@timestamp",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Disabling two-factor authentication for your personal account"
  },
  {
    "action": "two_factor_authentication.enabled",
    "description": "Two-factor authentication was enabled for a user account.",
    "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
    "fields": [
      "actor",
      "operation_type",
      "user_agent",
      "action",
      "created_at",
      "actor_id",
      "@timestamp",
      "request_id",
      "user",
      "user_id",
      "_document_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Configuring two-factor authentication"
  },
  {
    "action": "two_factor_authentication.password_reset_fallback_sms",
    "description": "A one-time password code was sent to a user account fallback phone number.",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "created_at",
      "user",
      "user_id",
      "action",
      "@timestamp",
      "request_id",
      "_document_id",
      "user_agent"
    ]
  },
  {
    "action": "two_factor_authentication.recovery_codes_regenerated",
    "description": "Two factor recovery codes were regenerated for a user account.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor",
      "operation_type",
      "_document_id",
      "user_id",
      "action",
      "user",
      "user_agent",
      "actor_id",
      "@timestamp",
      "created_at"
    ]
  },
  {
    "action": "two_factor_authentication.remove_factor",
    "description": "A secondary authentication factor was removed from a user account.",
    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication"
  },
  {
    "action": "two_factor_authentication.sign_in_fallback_sms",
    "description": "A one-time password code was sent to a user account fallback phone number.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "operation_type",
      "user_id",
      "user",
      "user_agent",
      "created_at",
      "_document_id",
      "action",
      "@timestamp"
    ]
  },
  {
    "action": "two_factor_authentication.update_fallback",
    "description": "The two-factor authentication fallback for a user account was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "created_at",
      "_document_id",
      "user",
      "user_id",
      "operation_type",
      "user_agent",
      "action",
      "request_id",
      "actor",
      "actor_id"
    ]
  },
  {
    "action": "user.add_email",
    "description": "An email address was added to a user account.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account",
    "fields": [
      "action",
      "request_id",
      "user",
      "user_id",
      "user_agent",
      "operation_type",
      "_document_id",
      "actor_id",
      "actor",
      "email",
      "@timestamp",
      "created_at",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Adding an email address to your GitHub account"
  },
  {
    "action": "user.async_delete",
    "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "user_id",
      "created_at",
      "user",
      "@timestamp",
      "_document_id",
      "request_id",
      "actor_id",
      "operation_type",
      "user_agent",
      "action",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.audit_log_export",
    "description": "Audit log entries were exported.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "user",
      "action",
      "request_id",
      "actor",
      "@timestamp",
      "_document_id",
      "user_agent",
      "user_id",
      "operation_type",
      "created_at"
    ]
  },
  {
    "action": "user.block_user",
    "description": "A user was blocked by another user.",
    "docs_reference_links": "N/A",
    "fields": [
      "action",
      "actor",
      "user_id",
      "_document_id",
      "actor_id",
      "@timestamp",
      "user_agent",
      "user",
      "request_id",
      "blocked_user",
      "operation_type",
      "created_at",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.change_password",
    "description": "A user changed their password.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "@timestamp",
      "user_agent",
      "actor_id",
      "operation_type",
      "actor",
      "user",
      "user_id",
      "action",
      "created_at",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.codespaces_trusted_repo_access_granted",
    "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.",
    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Managing access to other repositories within your codespace"
  },
  {
    "action": "user.codespaces_trusted_repo_access_revoked",
    "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.",
    "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ],
    "docs_reference_titles": "Managing access to other repositories within your codespace"
  },
  {
    "action": "user.create",
    "description": "A new user account was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "email",
      "user_id",
      "operation_type",
      "@timestamp",
      "request_id",
      "user",
      "created_at",
      "_document_id",
      "user_agent",
      "actor",
      "actor_id",
      "action",
      "programmatic_access_type"
    ]
  },
  {
    "action": "user.create_integration_secret",
    "description": "A user secret for Codespaces was created.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "integration",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.creation_rate_limit_exceeded",
    "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "created_at",
      "user_agent",
      "_document_id",
      "operation_type",
      "oauth_application_id",
      "action",
      "actor",
      "actor_id",
      "request_id",
      "user_id",
      "@timestamp",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "user.delete",
    "description": "A user account was destroyed by an asynchronous job.",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "created_at",
      "user_agent",
      "action",
      "request_id",
      "user_id",
      "actor",
      "actor_id",
      "user",
      "@timestamp",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.demote",
    "description": "A site administrator was demoted to an ordinary user account.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "oauth_application_id",
      "action",
      "user",
      "created_at",
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "operation_type",
      "_document_id",
      "user_id",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.destroy",
    "description": "A user deleted his or her account, triggering user.async_delete.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor",
      "user",
      "_document_id",
      "created_at",
      "user_agent",
      "user_id",
      "operation_type",
      "actor_id",
      "action",
      "@timestamp",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.device_verification_failure",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "actor",
      "created_at",
      "_document_id",
      "@timestamp",
      "user",
      "user_agent",
      "user_id",
      "actor_id",
      "action",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.device_verification_requested",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "user_id",
      "actor",
      "operation_type",
      "created_at",
      "_document_id",
      "@timestamp",
      "user",
      "actor_id",
      "action",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.device_verification_success",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "user",
      "_document_id",
      "action",
      "operation_type",
      "user_agent",
      "created_at",
      "request_id",
      "actor",
      "actor_id",
      "user_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.disable_collaborators_only",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user.disable_contributors_only",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user.disable_sockpuppet_disallowed",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user_email.confirm_claim",
    "description": "An enterprise managed user claimed an email address.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "user_email.mark_as_unclaimed",
    "description": "N/A",
    "docs_reference_links": "An enterprise managed user unclaimed an email address.",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "business",
      "business_id",
      "actor_is_bot",
      "request_access_security_header"
    ],
    "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address."
  },
  {
    "action": "user.enable_collaborators_only",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user.enable_contributors_only",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user.enable_sockpuppet_disallowed",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id"
    ]
  },
  {
    "action": "user.failed_login",
    "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "action",
      "operation_type",
      "request_id",
      "created_at",
      "_document_id",
      "@timestamp",
      "user",
      "org_id",
      "actor",
      "actor_id",
      "user_agent"
    ]
  },
  {
    "action": "user.forgot_password",
    "description": "A user requested a password reset.",
    "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials",
    "fields": [
      "action",
      "_document_id",
      "user_agent",
      "request_id",
      "user",
      "operation_type",
      "@timestamp",
      "email",
      "created_at",
      "user_id",
      "request_access_security_header"
    ],
    "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials"
  },
  {
    "action": "user.grant_github_developer",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "action",
      "created_at",
      "user_agent",
      "@timestamp",
      "_document_id",
      "user",
      "user_id",
      "actor",
      "operation_type",
      "request_id"
    ]
  },
  {
    "action": "user.hide_private_contributions_count",
    "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Manage visibility settings for private contributions"
  },
  {
    "action": "user.login",
    "description": "A user signed in.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "user_id",
      "actor_id",
      "@timestamp",
      "user",
      "action",
      "operation_type",
      "_document_id",
      "request_id",
      "created_at",
      "actor",
      "passkey_nickname",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.logout",
    "description": "A user signed out.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.new_device_used",
    "description": "A user signed in from a new device.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "user_id",
      "actor",
      "operation_type",
      "created_at",
      "user_agent",
      "actor_id",
      "action",
      "@timestamp",
      "_document_id",
      "request_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.promote",
    "description": "An ordinary user account was promoted to a site administrator.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "action",
      "actor",
      "actor_id",
      "user",
      "@timestamp",
      "created_at",
      "user_agent",
      "oauth_application_id",
      "request_id",
      "operation_type",
      "_document_id",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.recreate",
    "description": "A user's account was restored.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "user",
      "action",
      "actor_id",
      "@timestamp",
      "_document_id",
      "request_id",
      "user_id",
      "created_at",
      "actor",
      "operation_type"
    ]
  },
  {
    "action": "user.remove_email",
    "description": "An email address was removed from a user account.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "action",
      "@timestamp",
      "_document_id",
      "request_id",
      "user",
      "user_id",
      "operation_type",
      "actor",
      "actor_id",
      "created_at",
      "email",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "user.remove_integration_secret",
    "description": "A user secret for Codespaces was deleted.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "integration",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.rename",
    "description": "A username was changed.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "action",
      "request_id",
      "actor_id",
      "old_login",
      "created_at",
      "_document_id",
      "actor",
      "user_id",
      "@timestamp",
      "operation_type",
      "user_agent",
      "token_scopes",
      "programmatic_access_type"
    ]
  },
  {
    "action": "user.reset_password",
    "description": "A user reset their account password.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "action",
      "user_agent",
      "user",
      "request_id",
      "user_id",
      "created_at",
      "@timestamp",
      "_document_id",
      "actor",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user_session.country_change",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "created_at",
      "request_id",
      "user_id",
      "action",
      "@timestamp",
      "_document_id",
      "actor",
      "actor_id",
      "user",
      "user_agent",
      "operation_type"
    ]
  },
  {
    "action": "user.show_private_contributions_count",
    "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile",
    "fields": [
      "@timestamp",
      "_document_id",
      "request_id",
      "user_id",
      "action",
      "actor",
      "user",
      "operation_type",
      "user_agent",
      "actor_id",
      "created_at",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Manage visibility settings for private contributions"
  },
  {
    "action": "user.sign_in_from_unrecognized_device",
    "description": "A user signed in from an unrecognized device.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "action",
      "_document_id",
      "user_agent",
      "user",
      "user_id",
      "operation_type",
      "created_at",
      "actor",
      "actor_id",
      "@timestamp",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.sign_in_from_unrecognized_device_and_location",
    "description": "A user signed in from an unrecognized device and location.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user",
      "user_id",
      "@timestamp",
      "user_agent",
      "created_at",
      "_document_id",
      "request_id",
      "action",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user_status.destroy",
    "description": "Triggered when you clear the status on your profile.",
    "docs_reference_links": "N/A",
    "fields": [
      "org",
      "user_id",
      "actor",
      "message",
      "user",
      "actor_id",
      "created_at",
      "request_id",
      "limited_availability",
      "action",
      "emoji",
      "operation_type",
      "user_agent",
      "@timestamp",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user_status.update",
    "description": "Triggered when you set or change the status on your profile.",
    "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status",
    "fields": [
      "limited_availability",
      "user",
      "action",
      "actor_id",
      "message",
      "user_id",
      "created_at",
      "_document_id",
      "request_id",
      "@timestamp",
      "user_agent",
      "emoji",
      "org",
      "actor",
      "operation_type",
      "token_scopes",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Personalize your profile"
  },
  {
    "action": "user.suspend",
    "description": "A user account was suspended.",
    "docs_reference_links": "N/A",
    "fields": [
      "oauth_application_id",
      "operation_type",
      "actor_id",
      "user",
      "user_agent",
      "request_id",
      "actor",
      "created_at",
      "_document_id",
      "@timestamp",
      "user_id",
      "action",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.toggle_warn_private_email",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "user",
      "actor_id",
      "@timestamp",
      "operation_type",
      "_document_id",
      "user_agent",
      "actor",
      "action",
      "user_id",
      "created_at",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_challenge_failure",
    "description": "A 2FA challenge issued for a user account failed.",
    "docs_reference_links": "N/A",
    "fields": [
      "operation_type",
      "created_at",
      "_document_id",
      "user_agent",
      "user",
      "actor_id",
      "actor",
      "user_id",
      "@timestamp",
      "action",
      "request_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_challenge_success",
    "description": "A 2FA challenge issued for a user account succeeded.",
    "docs_reference_links": "N/A",
    "fields": [
      "@timestamp",
      "_document_id",
      "user_id",
      "operation_type",
      "actor_id",
      "user",
      "actor",
      "user_agent",
      "request_id",
      "action",
      "created_at",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_recover",
    "description": "A user used their 2FA recovery codes.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "operation_type",
      "user_agent",
      "request_id",
      "user",
      "action",
      "actor",
      "actor_id",
      "created_at",
      "@timestamp",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_recovery_codes_downloaded",
    "description": "A user downloaded 2FA recovery codes for their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_id",
      "operation_type",
      "actor_id",
      "user",
      "request_id",
      "action",
      "@timestamp",
      "created_at",
      "user_agent",
      "actor",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_recovery_codes_printed",
    "description": "A user printed 2FA recovery codes for their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "user",
      "action",
      "operation_type",
      "user_agent",
      "request_id",
      "user_id",
      "created_at",
      "_document_id",
      "actor",
      "actor_id",
      "@timestamp"
    ]
  },
  {
    "action": "user.two_factor_recovery_codes_viewed",
    "description": "A user viewed 2FA recovery codes for their account.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "user_agent",
      "actor",
      "user_id",
      "action",
      "created_at",
      "user",
      "operation_type",
      "@timestamp",
      "request_id",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.two_factor_requested",
    "description": "A user was prompted for a two-factor authentication code.",
    "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication",
    "fields": [
      "user",
      "actor_id",
      "action",
      "user_agent",
      "request_id",
      "created_at",
      "_document_id",
      "user_id",
      "operation_type",
      "@timestamp",
      "actor"
    ],
    "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication"
  },
  {
    "action": "user.unblock_user",
    "description": "A user was unblocked by another user.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor_id",
      "action",
      "request_id",
      "_document_id",
      "blocked_user",
      "operation_type",
      "actor",
      "@timestamp",
      "user_agent",
      "user_id",
      "user",
      "created_at",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.unsuspend",
    "description": "A user account was unsuspended.",
    "docs_reference_links": "N/A",
    "fields": [
      "request_id",
      "_document_id",
      "user",
      "action",
      "user_agent",
      "actor",
      "oauth_application_id",
      "operation_type",
      "actor_id",
      "created_at",
      "@timestamp",
      "user_id",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.update_integration_secret",
    "description": "A user secret for Codespaces was updated.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "key",
      "visibility",
      "integration",
      "user",
      "user_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "user.update_new_repository_default_branch_setting",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "created_at",
      "user",
      "user_id",
      "action",
      "operation_type",
      "@timestamp",
      "_document_id",
      "request_access_security_header"
    ]
  },
  {
    "action": "workflows.approve_workflow_job",
    "description": "A workflow job was approved.",
    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "workflow_run_id",
      "run_number",
      "user",
      "user_id",
      "repo",
      "repo_id",
      "business",
      "business_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "token_scopes",
      "programmatic_access_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Reviewing deployments"
  },
  {
    "action": "workflows.bypass_protection_rules",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "workflow_run_id",
      "run_number",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "workflows.comment_workflow_job",
    "description": "N/A",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "token_id",
      "hashed_token",
      "programmatic_access_type",
      "actor",
      "actor_id",
      "workflow_run_id",
      "run_number",
      "repo",
      "repo_id",
      "public_repo",
      "org",
      "org_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type"
    ]
  },
  {
    "action": "workflows.delete_workflow_run",
    "description": "A workflow run was deleted.",
    "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repo",
      "repo_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "workflow_run_id",
      "started_at",
      "head_branch",
      "head_sha",
      "trigger_id",
      "programmatic_access_type"
    ],
    "docs_reference_titles": "Deleting a workflow run"
  },
  {
    "action": "workflows.disable_workflow",
    "description": "A workflow was disabled.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repo",
      "repo_id",
      "workflow_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "workflows.enable_workflow",
    "description": "A workflow was enabled, after previously being disabled by disable_workflow.",
    "docs_reference_links": "N/A",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "repo",
      "repo_id",
      "workflow_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "request_access_security_header"
    ]
  },
  {
    "action": "workflows.pin_workflow",
    "description": "A workflow was pinned.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "repo",
      "repo_id",
      "public_repo",
      "workflow_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  },
  {
    "action": "workflows.reject_workflow_job",
    "description": "A workflow job was rejected.",
    "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments",
    "fields": [
      "user_agent",
      "request_id",
      "actor",
      "actor_id",
      "workflow_run_id",
      "run_number",
      "user",
      "user_id",
      "repo",
      "repo_id",
      "action",
      "operation_type",
      "@timestamp",
      "created_at",
      "_document_id",
      "public_repo",
      "programmatic_access_type",
      "request_access_security_header"
    ],
    "docs_reference_titles": "Reviewing deployments"
  },
  {
    "action": "workflows.unpin_workflow",
    "description": "A workflow was unpinned after previously being pinned.",
    "docs_reference_links": "N/A",
    "fields": [
      "actor",
      "actor_id",
      "user_agent",
      "request_id",
      "repo",
      "repo_id",
      "public_repo",
      "workflow_id",
      "org",
      "org_id",
      "business",
      "business_id",
      "action",
      "_document_id",
      "@timestamp",
      "created_at",
      "operation_type",
      "actor_is_bot",
      "request_access_security_header"
    ]
  }
]