[ { "action": "account.billing_date_change", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "org", "@timestamp", "operation_type", "user_agent", "_document_id", "created_at", "action", "request_id", "actor", "actor_id", "org_id" ] }, { "action": "account.plan_change", "description": "The account's plan changed.", "docs_reference_links": "/billing/managing-the-plan-for-your-github-account/about-billing-for-plans", "fields": [ "actor", "operation_type", "_document_id", "user_agent", "created_at", "actor_id", "request_id", "@timestamp", "user", "action", "user_id", "programmatic_access_type" ], "docs_reference_titles": "How GitHub billing works" }, { "action": "account_recovery_token.confirm", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor_id", "action", "request_id", "@timestamp", "user_agent", "created_at", "_document_id", "token_id", "user_id", "user", "actor", "operation_type" ] }, { "action": "account_recovery_token.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "action", "created_at", "token_id", "user", "request_id", "_document_id", "user_agent", "actor", "user_id", "actor_id", "operation_type", "@timestamp" ] }, { "action": "account_recovery_token.recover", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user", "@timestamp", "actor_id", "operation_type", "created_at", "actor", "user_agent", "request_id", "action", "_document_id", "user_id", "token_id" ] }, { "action": "actions_cache.delete", "description": "A GitHub Actions cache was deleted using the REST API.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "user_id", "user", "repo_id", "repo", "org", "org_id", "actions_cache_id", "actions_cache_key", "actions_cache_version", "actions_cache_scope", "action", "_document_id", "@timestamp", "created_at", "operation_type", "token_scopes", "programmatic_access_type", "request_access_security_header" ] }, { "action": "artifact.destroy", "description": "A workflow run artifact was manually deleted.", "docs_reference_links": "N/A", "fields": [ "action", "actor", "user_agent", "actor_id", "repo", "repo_id", "request_id", "@timestamp", "created_at", "_document_id", "operation_type", "programmatic_access_type" ] }, { "action": "billing.budget_create", "description": "A billing budget was created for a business or organization. Includes details about the budget limit, alerting preferences, and recipients.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "pricing_target_type", "pricing_target_id", "budget_limit_type", "alert_recipient_user_ids" ] }, { "action": "billing.budget_delete", "description": "A billing budget was deleted for a business or organization. Includes details about the removed budget and any alerting settings.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "customer_id", "uuid", "status", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "billing.budget_update", "description": "A billing budget was updated for a business or organization. Includes details about the updated limit and alerting settings.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "customer_id", "target_amount", "target_type", "target_id", "alert_enabled", "status", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header", "old_target_amount", "old_budget_limit_type", "old_alert_enabled", "old_target_id", "old_pricing_target_type", "old_pricing_target_id" ] }, { "action": "billing.change_billing_type", "description": "The way the account pays for GitHub was changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/adding-or-editing-a-payment-method", "fields": [ "actor_id", "user", "@timestamp", "actor", "user_id", "action", "created_at", "operation_type", "_document_id", "user_agent", "request_id" ], "docs_reference_titles": "Managing your payment and billing information" }, { "action": "billing.change_email", "description": "The billing email address changed.", "docs_reference_links": "/billing/managing-your-github-billing-settings/setting-your-billing-email", "fields": [ "actor", "operation_type", "actor_id", "org_id", "@timestamp", "user_agent", "request_id", "created_at", "_document_id", "org", "email", "action", "request_access_security_header" ], "docs_reference_titles": "Managing your payment and billing information" }, { "action": "billing_customer.azure_subscription_linked", "description": "Azure subscription has been linked on this account.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "billing_customer.azure_subscription_unlinked", "description": "Azure subscription has been unlinked on this account.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "billing.lock", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "oauth_application_id", "@timestamp", "actor_id", "operation_type", "_document_id", "request_id", "actor", "user", "user_id", "user_agent", "created_at", "action" ] }, { "action": "billing.overage_policy_updated", "description": "The premium request paid usage policy for your GitHub account was changed.", "docs_reference_links": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "/copilot/how-tos/manage-and-track-spending/manage-request-allowances#setting-a-policy-for-paid-usage" }, { "action": "billing.unlock", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor_id", "user", "operation_type", "user_agent", "created_at", "user_id", "request_id", "actor", "action", "@timestamp", "_document_id", "programmatic_access_type" ] }, { "action": "billing.update_bill_cycle_day", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "business.security_center_export_code_scanning_metrics", "description": "A CSV export was requested on the \"CodeQL pull request alerts\" page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "user", "user_id", "query", "filename", "requested_at", "start_date", "end_date", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "business.security_center_export_coverage", "description": "A CSV export was requested on the \"Coverage\" page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "user", "user_id", "query", "filename", "requested_at", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "business.security_center_export_overview_dashboard", "description": "A CSV export was requested on the \"Overview Dashboard\" page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "user", "user_id", "query", "filename", "requested_at", "start_date", "end_date", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "business.security_center_export_risk", "description": "A CSV export was requested on the \"Risk\" page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "business_id", "user", "user_id", "query", "filename", "requested_at", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ] }, { "action": "business.set_actions_cache_retention_policy", "description": "The cache retention policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "name", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_actions_cache_storage_policy", "description": "The cache storage policy for GitHub Actions was set for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "name", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_actions_fork_pr_approvals_policy", "description": "The policy for requiring approvals for workflows from public forks was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "policy", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-private-repositories", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "policy", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-artifact-and-log-retention-in-your-enterprise", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "limit", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-workflow-permissions-in-your-enterprise", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_fork_pr_workflows_policy", "description": "The policy for fork pull request workflows was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#enforcing-a-policy-for-fork-pull-requests-in-your-enterprise", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "policy", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "business.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an enterprise.", "docs_reference_links": "/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Enforcing policies for GitHub Actions in your enterprise" }, { "action": "checks.auto_trigger_disabled", "description": "Automatic creation of check suites was disabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ "visibility", "user_agent", "user", "@timestamp", "repo", "actor_id", "user_id", "action", "created_at", "actor", "operation_type", "request_id", "repo_id", "_document_id" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, { "action": "checks.auto_trigger_enabled", "description": "Automatic creation of check suites was enabled on a repository in the organization or enterprise.", "docs_reference_links": "/rest/checks#update-repository-preferences-for-check-suites", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "repo", "repo_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo" ], "docs_reference_titles": "/rest/checks#update-repository-preferences-for-check-suites" }, { "action": "checks.delete_logs", "description": "Logs in a check suite were deleted.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "actor", "actor_id", "operation_type", "repo_id", "action", "created_at", "_document_id", "user_agent", "request_id", "repo", "programmatic_access_type" ] }, { "action": "codespaces.allow_permissions", "description": "A codespace using custom permissions from its devcontainer.json file was launched.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "origin_repository", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "codespaces.connect", "description": "Credentials for a codespace were refreshed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repository_id", "repository", "pull_request_id", "user_id", "org_id", "owner", "name", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "token_scopes", "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" ] }, { "action": "codespaces.create", "description": "A codespace was created", "docs_reference_links": "/codespaces/developing-in-codespaces/creating-a-codespace-for-a-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repository_id", "repository", "pull_request_id", "owner", "name", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes", "programmatic_access_type", "actor_is_bot", "machine_type", "devcontainer_path" ], "docs_reference_titles": "Creating a codespace for a repository" }, { "action": "codespaces.destroy", "description": "A user deleted a codespace.", "docs_reference_links": "/codespaces/developing-in-codespaces/deleting-a-codespace", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repository_id", "repository", "pull_request_id", "owner", "name", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Deleting a codespace" }, { "action": "codespaces.export_environment", "description": "A codespace was exported to a branch on GitHub.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "owner", "action", "_document_id", "@timestamp", "created_at", "operation_type", "public_repo" ] }, { "action": "codespaces.restore", "description": "A codespace was restored.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "owner", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "codespaces.start_environment", "description": "A codespace was started.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "org", "owner", "pull_request_id", "machine_type", "user_id", "user", "devcontainer_path", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "codespaces.suspend_environment", "description": "A codespace was stopped.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "owner", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "token_scopes", "programmatic_access_type" ] }, { "action": "codespaces.trusted_repositories_access_update", "description": "A personal account's access and security setting for Codespaces were updated.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ "user_agent", "request_id", "actor", "actor_id", "business", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, { "action": "copilot.cfb_seat_added", "description": "A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "token_id", "hashed_token", "programmatic_access_type", "actor", "actor_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ] }, { "action": "copilot.cfb_seat_assignment_created", "description": "A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.", "docs_reference_links": "/copilot/overview-of-github-copilot/about-github-copilot-for-business", "fields": [ "actor", "actor_id", "user_agent", "request_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "What is GitHub Copilot?" }, { "action": "copilot.cfb_seat_assignment_refreshed", "description": "A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "hashed_token", "programmatic_access_type", "actor", "actor_id", "token_id", "token_scopes", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ] }, { "action": "copilot.cfb_seat_assignment_reused", "description": "A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "copilot.cfb_seat_assignment_unassigned", "description": "A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ] }, { "action": "copilot.cfb_seat_cancelled", "description": "A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "seat_assignment", "request_access_security_header" ] }, { "action": "copilot.cfb_seat_cancelled_by_staff", "description": "A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user_id", "user", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id" ] }, { "action": "copilot.swe_agent_repo_disabled", "description": "Specific repositories were disabled from using Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ "actor", "org_id", "owner_type", "actor_id", "owner", "repo", "repo_id", "public_repo", "org", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id" ] }, { "action": "copilot.swe_agent_repo_enabled", "description": "Specific repositories were enabled to use Copilot coding agent.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "org_id", "owner_type", "owner", "repo", "repo_id", "public_repo", "org", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "copilot.swe_agent_repo_enablement_updated", "description": "Copilot coding agent access was updated for the organization's or user's repositories.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "new_access", "old_access", "org_id", "owner_type", "owner", "org", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "custom_hosted_runner.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "runner_group_id", "user", "user_id", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "custom_hosted_runner.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "custom_hosted_runner.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "runner_group_id", "user", "user_id", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "dependabot_alerts.disable", "description": "Dependabot alerts were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, { "action": "dependabot_alerts.enable", "description": "Dependabot alerts were enabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-existing-repositories" }, { "action": "dependabot_alerts_new_repos.disable", "description": "Dependabot alerts were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, { "action": "dependabot_alerts_new_repos.enable", "description": "Dependabot alerts were enabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-automatically-when-new-repositories-are-added" }, { "action": "dependabot_repository_access.repositories_updated", "description": "The repositories that Dependabot can access were updated.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "dependabot_security_updates.disable", "description": "Dependabot security updates were disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, { "action": "dependabot_security_updates.enable", "description": "Dependabot security updates were enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ] }, { "action": "dependabot_security_updates_new_repos.disable", "description": " Dependabot security updates were disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, { "action": "dependabot_security_updates_new_repos.enable", "description": "Dependabot security updates were enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "dependency_graph.disable", "description": "The dependency graph was disabled for all existing repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, { "action": "dependency_graph.enable", "description": "The dependency graph was enabled for all existing repositories.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ] }, { "action": "dependency_graph_new_repos.disable", "description": "The dependency graph was disabled for all new repositories.", "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id" ], "docs_reference_titles": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization" }, { "action": "dependency_graph_new_repos.enable", "description": "The dependency graph was enabled for all new repositories.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id", "request_access_security_header" ] }, { "action": "environment.add_protection_rule", "description": "A GitHub Actions deployment protection rule was created via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "programmatic_access_type", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "environment_name", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "environment.create_actions_secret", "description": "A secret was created for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "key", "visibility", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id", "public_repo", "token_scopes", "programmatic_access_type", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.create_actions_variable", "description": "A variable was created for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "environment_name", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "environment.delete", "description": "An environment was deleted.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deleting-an-environment", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "token_scopes", "programmatic_access_type", "actor_is_bot", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.remove_actions_secret", "description": "A secret was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "key", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id", "public_repo", "token_scopes", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.remove_actions_variable", "description": "A variable was deleted for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "environment_name", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "environment.remove_protection_rule", "description": "A GitHub Actions deployment protection rule was deleted via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.update_actions_secret", "description": "A secret was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#environment-secrets", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "key", "visibility", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "request_access_security_header" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "environment.update_actions_variable", "description": "A variable was updated for a GitHub Actions environment.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-an-environment", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "environment_name", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "environment.update_protection_rule", "description": "A GitHub Actions deployment protection rule was updated via the API.", "docs_reference_links": "/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repo", "repo_id", "org", "org_id", "action", "@timestamp", "_document_id", "new_value", "approvers_was", "approvers", "programmatic_access_type", "can_admins_bypass", "prevent_self_review" ], "docs_reference_titles": "Managing environments for deployment" }, { "action": "gist.create", "description": "A gist was created.", "docs_reference_links": "N/A", "fields": [ "request_id", "user_id", "user", "gist_id", "@timestamp", "created_at", "operation_type", "user_agent", "actor", "actor_id", "visibility", "action", "_document_id", "token_scopes", "programmatic_access_type" ] }, { "action": "gist.destroy", "description": "A gist was deleted.", "docs_reference_links": "N/A", "fields": [ "user_id", "gist_id", "visibility", "created_at", "_document_id", "user", "request_id", "operation_type", "actor", "actor_id", "action", "user_agent", "@timestamp", "programmatic_access_type" ] }, { "action": "gist.visibility_change", "description": "The visibility of a gist was updated.", "docs_reference_links": "N/A", "fields": [ "action", "operation_type", "@timestamp", "user_agent", "actor", "user", "gist_id", "actor_id", "request_id", "visibility", "user_id", "created_at", "_document_id", "token_scopes", "programmatic_access_type" ] }, { "action": "git_signing_ssh_public_key.create", "description": "An SSH key was added to a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "key", "fingerprint", "user_id", "user", "action", "_document_id", "@timestamp", "created_at", "operation_type", "token_scopes", "request_access_security_header" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, { "action": "git_signing_ssh_public_key.delete", "description": "An SSH key was removed from a user account as a Git commit signing key.", "docs_reference_links": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "key", "fingerprint", "user_id", "explanation", "user", "action", "_document_id", "@timestamp", "created_at", "operation_type", "token_scopes", "request_access_security_header" ], "docs_reference_titles": "/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key" }, { "action": "github_hosted_runner.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "runner_group_id", "business", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "github_hosted_runner.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "business", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ] }, { "action": "github_hosted_runner.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "runner_group_id", "business", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "gpg_key.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "request_id", "actor_id", "created_at", "user_id", "@timestamp", "user", "operation_type", "_document_id", "actor", "action", "user_agent", "request_access_security_header" ] }, { "action": "gpg_key.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_id", "operation_type", "request_id", "actor", "actor_id", "user", "action", "created_at", "_document_id", "user_agent", "@timestamp", "request_access_security_header" ] }, { "action": "hook.active_changed", "description": "A hook's active status was updated.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "name", "events", "active", "active_was", "hook_id", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id", "programmatic_access_type" ] }, { "action": "hook.config_changed", "description": "A hook's configuration was changed.", "docs_reference_links": "N/A", "fields": [ "actor_id", "operation_type", "@timestamp", "_document_id", "actor", "name", "org", "user_agent", "request_id", "hook_id", "repo", "repo_id", "created_at", "oauth_application_id", "action", "events", "org_id", "token_scopes", "programmatic_access_type" ] }, { "action": "hook.create", "description": "A new hook was added.", "docs_reference_links": "/get-started/exploring-integrations/about-webhooks", "fields": [ "oauth_application", "_document_id", "user_agent", "actor", "actor_id", "oauth_application_id", "repo_id", "request_id", "hook_id", "events", "repo", "@timestamp", "operation_type", "name", "action", "created_at", "org_id", "org", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "About webhooks" }, { "action": "hook.destroy", "description": "A hook was deleted.", "docs_reference_links": "N/A", "fields": [ "actor", "events", "repo", "created_at", "org", "name", "request_id", "actor_id", "repo_id", "org_id", "action", "operation_type", "oauth_application_id", "user_agent", "hook_id", "@timestamp", "_document_id", "token_scopes", "programmatic_access_type" ] }, { "action": "hook.events_changed", "description": "A hook's configured events were changed.", "docs_reference_links": "N/A", "fields": [ "actor", "events", "repo", "operation_type", "action", "_document_id", "actor_id", "name", "events_were", "@timestamp", "created_at", "hook_id", "repo_id", "org_id", "org", "user_agent", "request_id", "oauth_application_id", "token_scopes", "programmatic_access_type" ] }, { "action": "integration.create", "description": "A GitHub App was created.", "docs_reference_links": "N/A", "fields": [ "user", "action", "operation_type", "@timestamp", "actor", "user_agent", "actor_id", "request_id", "name", "user_id", "_document_id", "integration", "created_at", "programmatic_access_type", "request_access_security_header", "application_client_id" ] }, { "action": "integration.destroy", "description": "A GitHub App was deleted.", "docs_reference_links": "N/A", "fields": [ "actor", "user_id", "actor_id", "request_id", "@timestamp", "name", "integration", "user", "_document_id", "action", "operation_type", "created_at", "user_agent" ] }, { "action": "integration.generate_client_secret", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "integration", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "programmatic_access_type", "request_access_security_header", "application_client_id" ] }, { "action": "integration_installation.create", "description": "A GitHub App was installed.", "docs_reference_links": "/apps/using-github-apps/authorizing-github-apps", "fields": [ "operation_type", "@timestamp", "name", "request_id", "repository_selection", "user_id", "action", "user_agent", "user", "created_at", "integration", "_document_id", "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/authorizing-github-apps" }, { "action": "integration_installation.destroy", "description": "A GitHub App was uninstalled.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "@timestamp", "request_id", "actor", "created_at", "_document_id", "repository_selection", "integration", "user_id", "user", "action", "operation_type", "name", "actor_id", "user_agent", "programmatic_access_type", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, { "action": "integration_installation.repositories_added", "description": "Repositories were added to a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ "user_id", "repository_selection", "name", "user", "request_id", "integration", "operation_type", "actor_id", "action", "repositories_added", "created_at", "_document_id", "@timestamp", "actor", "user_agent", "token_scopes", "repositories_added_names", "programmatic_access_type", "actor_is_bot", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" }, { "action": "integration_installation.repositories_removed", "description": "Repositories were removed from a GitHub App.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access", "fields": [ "user", "operation_type", "user_agent", "actor", "repository_selection", "repositories_removed", "integration", "user_id", "created_at", "_document_id", "request_id", "@timestamp", "name", "action", "actor_id", "repositories_removed_names", "programmatic_access_type", "actor_is_bot", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#modifying-repository-access" }, { "action": "integration_installation.suspend", "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "user_agent", "request_id", "name", "repository_selection", "actor_id", "integration", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, { "action": "integration_installation.unsuspend", "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access", "fields": [ "user_agent", "request_id", "name", "repository_selection", "actor_id", "integration", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access" }, { "action": "integration_installation.version_updated", "description": "Permissions for a GitHub App were updated.", "docs_reference_links": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app", "fields": [ "integration", "user_id", "user_agent", "name", "user", "operation_type", "actor_id", "action", "_document_id", "request_id", "created_at", "repository_selection", "@timestamp", "actor", "application_client_id" ], "docs_reference_titles": "/apps/using-github-apps/approving-updated-permissions-for-a-github-app" }, { "action": "integration.manager_added", "description": "A member of an enterprise or organization was added as a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization", "fields": [ "created_at", "action", "_document_id", "name", "org_id", "manager", "operation_type", "actor", "integration", "org", "@timestamp", "actor_id", "request_id", "user_agent" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#giving-someone-the-ability-to-manage-all-github-apps-owned-by-the-organization" }, { "action": "integration.manager_removed", "description": "A member of an enterprise or organization was removed from being a GitHub App manager.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization", "fields": [ "user_agent", "request_id", "actor_id", "org", "operation_type", "integration", "org_id", "_document_id", "action", "actor", "name", "created_at", "manager", "@timestamp" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/adding-and-removing-github-app-managers-in-your-organization#removing-a-github-app-managers-permissions-for-the-entire-organization" }, { "action": "integration.remove_client_secret", "description": "A client secret for a GitHub App was removed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "integration", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header" ] }, { "action": "integration.revoke_all_tokens", "description": "All user tokens for a GitHub App were requested to be revoked.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "integration", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "application_client_id" ] }, { "action": "integration.revoke_tokens", "description": "Token(s) for a GitHub App were revoked.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "integration", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "application_client_id" ] }, { "action": "integration.suspend", "description": "A GitHub App was suspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "integration", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "application_client_id" ], "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" }, { "action": "integration.transfer", "description": "Ownership of a GitHub App was transferred to another user or organization.", "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app", "fields": [ "@timestamp", "user_id", "name", "transfer_to_id", "user", "requester", "action", "requester_id", "actor_id", "created_at", "_document_id", "user_agent", "transfer_to", "operation_type", "request_id", "actor", "integration", "transfer_from", "transfer_from_id", "transfer_from_type", "transfer_to_type" ], "docs_reference_titles": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app" }, { "action": "integration.unsuspend", "description": "A GitHub App was unsuspended.", "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "integration", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "application_client_id" ], "docs_reference_titles": "/apps/maintaining-github-apps/suspending-a-github-app-installation" }, { "action": "issue_dependencies.blocked_by_add", "description": "An issue was marked as blocked by another issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ] }, { "action": "issue_dependencies.blocked_by_remove", "description": "The blocked by relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "title", "org", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "issue_dependencies.blocking_add", "description": "An issue was marked as blocking another issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ] }, { "action": "issue_dependencies.blocking_remove", "description": "The blocking relationship between an issue and another issue was removed.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ] }, { "action": "marketplace_agreement_signature.create", "description": "The GitHub Marketplace Developer Agreement was signed.", "docs_reference_links": "N/A", "fields": [ "request_id", "actor", "actor_id", "@timestamp", "_document_id", "user_agent", "operation_type", "created_at", "action", "user", "user_id", "request_access_security_header" ] }, { "action": "marketplace_listing.approve", "description": "A listing was approved for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ "secondary_category", "actor", "primary_category", "user", "@timestamp", "_document_id", "user_id", "user_agent", "operation_type", "created_at", "request_id", "actor_id", "marketplace_listing", "integration", "action" ] }, { "action": "marketplace_listing.change_category", "description": "A category for a listing for an app in GitHub Marketplace was changed.", "docs_reference_links": "N/A", "fields": [ "primary_category", "user_agent", "request_id", "actor", "marketplace_listing", "@timestamp", "integration", "org_id", "action", "org", "secondary_category", "operation_type", "created_at", "actor_id", "_document_id" ] }, { "action": "marketplace_listing.create", "description": "A listing for an app in GitHub Marketplace was created.", "docs_reference_links": "N/A", "fields": [ "primary_category", "_document_id", "user", "created_at", "user_agent", "oauth_application", "action", "request_id", "marketplace_listing", "user_id", "secondary_category", "oauth_application_id", "actor", "actor_id", "operation_type", "@timestamp" ] }, { "action": "marketplace_listing.delist", "description": "A listing was removed from GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ "org", "actor", "actor_id", "user_agent", "request_id", "org_id", "created_at", "secondary_category", "operation_type", "marketplace_listing", "action", "@timestamp", "_document_id", "primary_category", "integration" ] }, { "action": "marketplace_listing_plan.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "@timestamp", "created_at", "actor", "action", "operation_type", "marketplace_listing", "has_free_trial", "user_agent", "request_id", "actor_id", "yearly_price_in_cents", "description", "bullets", "monthly_price_in_cents", "marketplace_listing_plan", "_document_id" ] }, { "action": "marketplace_listing_plan.publish", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "marketplace_listing_plan", "marketplace_listing", "description", "bullets", "has_free_trial", "created_at", "actor_id", "operation_type", "_document_id", "action", "user_agent", "request_id", "actor", "monthly_price_in_cents", "yearly_price_in_cents", "@timestamp" ] }, { "action": "marketplace_listing_plan.retire", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "marketplace_listing_plan", "_document_id", "request_id", "description", "yearly_price_in_cents", "@timestamp", "created_at", "actor_id", "bullets", "has_free_trial", "marketplace_listing", "user_agent", "monthly_price_in_cents", "action", "operation_type" ] }, { "action": "marketplace_listing_plan.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "monthly_price_in_cents", "marketplace_listing", "_document_id", "action", "description", "bullets", "yearly_price_in_cents", "request_id", "actor_id", "has_free_trial", "marketplace_listing_plan", "user_agent", "@timestamp", "operation_type", "actor", "created_at" ] }, { "action": "marketplace_listing.redraft", "description": "A listing was sent back to draft state.", "docs_reference_links": "N/A", "fields": [ "_document_id", "secondary_category", "oauth_application_id", "@timestamp", "action", "user_agent", "user_id", "operation_type", "oauth_application", "actor", "created_at", "marketplace_listing", "request_id", "actor_id", "primary_category", "user" ] }, { "action": "marketplace_listing.reject", "description": "A listing was not accepted for inclusion in GitHub Marketplace.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "primary_category", "secondary_category", "marketplace_listing", "oauth_application", "oauth_application_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "merge_queue.pull_request_dequeued", "description": "A pull request was removed from a merge queue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "repo_id", "public_repo", "repo", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "merge_queue.pull_request_queue_jump", "description": "A pull request was moved ahead in a merge queue.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "hashed_token", "programmatic_access_type", "actor", "actor_id", "oauth_application_id", "token_id", "token_scopes", "repo_id", "public_repo", "repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "merge_queue.queue_cleared", "description": "A merge queue was cleared.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "repo_id", "public_repo", "repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "merge_queue.update_settings", "description": "The settings for a merge queue were updated.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "max_entries_to_build", "min_entries_to_merge", "repo_id", "public_repo", "repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "metered_billing_configuration.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user", "@timestamp", "_document_id", "user_id", "action", "operation_type", "created_at", "request_access_security_header" ] }, { "action": "metered_billing_configuration.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id" ] }, { "action": "metered_billing_configuration.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor_id", "action", "org", "created_at", "operation_type", "org_id", "@timestamp", "_document_id", "user_agent", "request_id", "actor", "request_access_security_header" ] }, { "action": "migration.create", "description": "A migration file was created for transferring data from a source location (such as a GitHub.com organization or a GitHub Enterprise Server instance) to a target GitHub Enterprise Server instance.", "docs_reference_links": "N/A", "fields": [ "repo", "org_id", "_document_id", "org", "repo_id", "action", "actor", "created_at", "operation_type", "@timestamp", "user_agent", "request_id", "actor_id", "token_scopes", "programmatic_access_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "oauth_access.create", "description": "An OAuth access token was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, /authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token", "fields": [ "_document_id", "operation_type", "user_agent", "actor", "@timestamp", "user", "user_id", "created_at", "action", "actor_id", "request_id", "token_scopes", "programmatic_access_type", "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps, Managing your personal access tokens" }, { "action": "oauth_access.destroy", "description": "An OAuth access token was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "fields": [ "@timestamp", "user_agent", "action", "operation_type", "_document_id", "actor", "created_at", "user", "user_id", "request_id", "explanation", "hashed_token", "actor_id", "token_scopes", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" }, { "action": "oauth_access.regenerate", "description": "An OAuth access token was regenerated.", "docs_reference_links": "N/A", "fields": [ "user", "user_id", "_document_id", "created_at", "@timestamp", "operation_type", "action", "user_agent", "request_id", "actor", "actor_id", "token_scopes", "programmatic_access_type", "oauth_application_name" ] }, { "action": "oauth_access.revoke", "description": "An OAuth access token was revoked.", "docs_reference_links": "N/A", "fields": [ "request_id", "request_access_security_header", "hashed_token", "token_id", "token_scopes", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "oauth_access.update", "description": "An OAuth access token was updated.", "docs_reference_links": "N/A", "fields": [ "request_id", "actor_id", "actor", "operation_type", "_document_id", "user_id", "created_at", "action", "@timestamp", "user", "user_agent", "request_access_security_header" ] }, { "action": "oauth_application.create", "description": "An OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "org", "created_at", "oauth_application_id", "operation_type", "user_agent", "actor_id", "org_id", "action", "actor", "oauth_application", "@timestamp", "_document_id", "request_id", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.destroy", "description": "An OAuth application was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "created_at", "oauth_application_id", "user_id", "operation_type", "@timestamp", "user_agent", "oauth_application", "_document_id", "actor", "actor_id", "request_id", "action", "user", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.generate_client_secret", "description": "An OAuth application's secret key was generated.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application", "oauth_application_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.remove_client_secret", "description": "An OAuth application's secret key was deleted.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application", "oauth_application_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.reset_secret", "description": "The secret key for an OAuth application was reset.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "user", "user_id", "action", "oauth_application", "operation_type", "request_id", "actor_id", "_document_id", "created_at", "actor", "oauth_application_id", "@timestamp", "user_agent" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.revoke_all_tokens", "description": "All user tokens for an OAuth application were requested to be revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application", "oauth_application_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.revoke_tokens", "description": "Token(s) for an OAuth application were revoked.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "oauth_application_id", "oauth_application", "actor_id", "user_agent", "@timestamp", "request_id", "user_id", "action", "_document_id", "actor", "user", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_application.transfer", "description": "An OAuth application was transferred from one account to another.", "docs_reference_links": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app", "fields": [ "actor", "operation_type", "created_at", "user_agent", "oauth_application", "actor_id", "oauth_application_id", "@timestamp", "user_id", "_document_id", "request_id", "user", "action" ], "docs_reference_titles": "/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#registering-your-app" }, { "action": "oauth_authorization.create", "description": "An authorization for an OAuth application was created.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ "operation_type", "user_agent", "user_id", "actor", "org_id", "_document_id", "request_id", "action", "@timestamp", "created_at", "actor_id", "user", "business", "business_id", "token_scopes", "programmatic_access_type", "actor_is_bot", "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" }, { "action": "oauth_authorization.destroy", "description": "An authorization for an OAuth application was deleted.", "docs_reference_links": "/apps/using-github-apps/reviewing-your-authorized-integrations", "fields": [ "user_agent", "_document_id", "request_id", "operation_type", "@timestamp", "actor", "created_at", "explanation", "user", "user_id", "org_id", "action", "actor_id", "token_scopes", "actor_is_bot", "oauth_application_name" ], "docs_reference_titles": "Reviewing and revoking authorization of GitHub Apps" }, { "action": "oauth_authorization.update", "description": "An authorization for an OAuth application was updated.", "docs_reference_links": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps", "fields": [ "org_id", "request_id", "user_id", "actor", "actor_id", "user_agent", "@timestamp", "operation_type", "action", "user", "created_at", "_document_id", "actor_is_bot", "request_access_security_header", "oauth_application_name" ], "docs_reference_titles": "/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps" }, { "action": "org.add_member", "description": "A user joined an organization.", "docs_reference_links": "N/A", "fields": [ "permission", "_document_id", "org", "operation_type", "request_id", "actor", "user", "@timestamp", "created_at", "user_agent", "org_id", "user_id", "actor_id", "action", "programmatic_access_type", "actor_is_bot" ] }, { "action": "org.add_outside_collaborator", "description": "An outside collaborator was added to a repository.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "inviter", "org", "org_id", "repo", "repo_id", "public_repo", "permission", "invitee", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "org.advanced_security_disabled_for_new_repos", "description": "GitHub Advanced Security was disabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id", "token_scopes" ] }, { "action": "org.advanced_security_disabled_on_all_repos", "description": "GitHub Advanced Security was disabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes" ] }, { "action": "org.advanced_security_enabled_for_new_repos", "description": "GitHub Advanced Security was enabled for new repositories in an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id", "token_scopes" ] }, { "action": "org.advanced_security_enabled_on_all_repos", "description": "GitHub Advanced Security was enabled for all repositories in an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "org", "org_id", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes" ] }, { "action": "org.remove_member", "description": "A member was removed from an organization, either manually or due to a two-factor authentication requirement.", "docs_reference_links": "N/A", "fields": [ "_document_id", "request_id", "actor_id", "user_agent", "actor", "action", "user_id", "@timestamp", "created_at", "user", "operation_type", "org_id", "org", "token_scopes", "programmatic_access_type" ] }, { "action": "org.security_center_export_code_scanning_metrics", "description": "A CSV export was requested on the CodeQL pull request alerts page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "user", "user_id", "query", "filename", "requested_at", "start_date", "end_date", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot" ] }, { "action": "org.security_center_export_coverage", "description": "A CSV export was requested on the Coverage page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "user", "user_id", "query", "filename", "requested_at", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ] }, { "action": "org.security_center_export_overview_dashboard", "description": "A CSV export was requested on the Overview Dashboard page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "user", "user_id", "query", "filename", "requested_at", "start_date", "end_date", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ] }, { "action": "org.security_center_export_risk", "description": "A CSV export was requested on the Risk page.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "user", "user_id", "query", "filename", "requested_at", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ] }, { "action": "org.set_actions_cache_retention_policy", "description": "The cache retention policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization" }, { "action": "org.set_actions_cache_storage_policy", "description": "The cache storage policy for GitHub Actions was set for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "/organizations/managing-organization-settings/managing-github-actions-settings-for-your-organization" }, { "action": "org.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks", "fields": [ "user_agent", "request_id", "actor", "actor_id", "policy", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#requiring-approval-for-workflows-from-public-forks" }, { "action": "org.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ "actor", "actor_id", "user_agent", "request_id", "policy", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, { "action": "org.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in an organization was changed.", "docs_reference_links": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "limit", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/organizations/managing-organization-settings/configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization" }, { "action": "org.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization" }, { "action": "org.set_fork_pr_workflows_policy", "description": "The policy for workflows on private repository forks was changed.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks", "fields": [ "user_agent", "request_id", "actor", "actor_id", "policy", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#enabling-workflows-for-private-repository-forks" }, { "action": "org.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for an organization.", "docs_reference_links": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ "actor", "actor_id", "user_agent", "request_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests" }, { "action": "org.update_member", "description": "A person's role was changed from owner to member or member to owner.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "org_id", "created_at", "_document_id", "user", "user_id", "action", "request_id", "actor_id", "old_permission", "permission", "actor", "user_agent", "operation_type", "org" ] }, { "action": "org.update_member_repository_creation_permission", "description": "The create repository permission for organization members was changed.", "docs_reference_links": "N/A", "fields": [ "actor", "action", "@timestamp", "request_id", "actor_id", "permission", "created_at", "user_agent", "org", "org_id", "_document_id", "visibility", "operation_type" ] }, { "action": "org.update_member_repository_invitation_permission", "description": "An organization owner changed the policy setting for organization members inviting outside collaborators to repositories.", "docs_reference_links": "/organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators", "fields": [ "actor_id", "permission", "action", "org_id", "actor", "created_at", "_document_id", "business_id", "operation_type", "org", "user_agent", "request_id", "business", "@timestamp" ], "docs_reference_titles": "Setting permissions for adding outside collaborators" }, { "action": "pages_protected_domain.create", "description": "A GitHub Pages verified domain was created for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ "user_agent", "request_id", "actor", "actor_id", "owner", "owner_type", "domain", "state", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, { "action": "pages_protected_domain.delete", "description": "A GitHub Pages verified domain was deleted from an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ "user_agent", "request_id", "actor", "actor_id", "owner", "owner_type", "domain", "state", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, { "action": "pages_protected_domain.verify", "description": "A GitHub Pages domain was verified for an organization or enterprise.", "docs_reference_links": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages", "fields": [ "user_agent", "request_id", "actor", "actor_id", "owner", "owner_type", "domain", "state", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/pages/configuring-a-custom-domain-for-your-github-pages-site/verifying-your-custom-domain-for-github-pages" }, { "action": "passkey.register", "description": "A new passkey was added.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "nickname", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "passkey.remove", "description": "A new passkey was removed.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "nickname", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "payment_method.create", "description": "A new payment method was added, such as a new credit card or PayPal account.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "user", "operation_type", "user_id", "_document_id", "action", "actor", "actor_id", "@timestamp", "created_at", "request_access_security_header" ] }, { "action": "payment_method.remove", "description": "A payment method was removed.", "docs_reference_links": "N/A", "fields": [ "user", "created_at", "actor_id", "@timestamp", "user_id", "action", "operation_type", "actor", "_document_id", "request_access_security_header" ] }, { "action": "payment_method.update", "description": "An existing payment method was updated.", "docs_reference_links": "N/A", "fields": [ "operation_type", "request_id", "org_id", "created_at", "actor_id", "@timestamp", "action", "actor", "org", "user_agent", "_document_id", "request_access_security_header" ] }, { "action": "personal_access_token.access_granted", "description": "A fine-grained personal access token was granted access to resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" }, { "action": "personal_access_token.access_revoked", "description": "A fine-grained personal access token was revoked. The token can still read public organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_id", "user_programmatic_access_name", "repository_selection", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/reviewing-and-revoking-personal-access-tokens-in-your-organization" }, { "action": "personal_access_token.create", "description": "Triggered when you create a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_name", "user", "user_id", "repository_selection", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "personal_access_token.credential_regenerated", "description": "Triggered when you regenerate a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_name", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "personal_access_token.credential_revoked", "description": "A fine-grained personal access token was revoked by GitHub Advanced Security.", "docs_reference_links": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users", "fields": [ "user_programmatic_access_name", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/code-security/getting-started/github-security-features#secret-scanning-alerts-for-users" }, { "action": "personal_access_token.destroy", "description": "Triggered when you delete a fine-grained personal access token.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_name", "user", "user_id", "explanation", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "personal_access_token.request_cancelled", "description": "A pending request for a fine-grained personal access token to access organization resources was canceled.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_name", "org", "org_id", "repository_selection", "action", "_document_id", "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" ] }, { "action": "personal_access_token.request_created", "description": "Triggered when a fine-grained personal access token was created to access organization resources and the organization requires approval before the token can access organization resources.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_id", "user_programmatic_access_name", "user", "user_id", "repository_selection", "action", "_document_id", "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" }, { "action": "personal_access_token.request_denied", "description": "A request for a fine-grained personal access token to access organization resources was denied.", "docs_reference_links": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user_programmatic_access_name", "org", "org_id", "repository_selection", "action", "_document_id", "@timestamp", "created_at", "operation_type", "user_programmatic_access_request_id" ], "docs_reference_titles": "/organizations/managing-programmatic-access-to-your-organization/managing-requests-for-personal-access-tokens-in-your-organization" }, { "action": "personal_access_token.update", "description": "A fine-grained personal access token was updated.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user_programmatic_access_name", "user", "user_id", "repository_selection", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#fine-grained-personal-access-tokens" }, { "action": "premium_runner.create", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "runner_group_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "premium_runner.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "premium_runner.update", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "name", "runner_group_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "private_vulnerability_reporting.disable", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "private_vulnerability_reporting.enable", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "private_vulnerability_reporting_new_repos.disable", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "private_vulnerability_reporting_new_repos.enable", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "profile_picture.update", "description": "A profile picture was updated.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile", "fields": [ "user", "actor_id", "user_id", "@timestamp", "created_at", "owner", "action", "_document_id", "request_id", "user_agent", "actor", "operation_type" ], "docs_reference_titles": "Personalize your profile" }, { "action": "project.access", "description": "A project board visibility was changed.", "docs_reference_links": "N/A", "fields": [ "actor_id", "actor", "user_agent", "operation_type", "user", "created_at", "user_id", "action", "request_id", "_document_id", "@timestamp" ] }, { "action": "project.close", "description": "A project board was closed.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/closing-a-project-board", "fields": [ "org_id", "user_agent", "request_id", "operation_type", "@timestamp", "created_at", "repo_id", "org", "_document_id", "project_id", "action", "actor", "actor_id", "repo", "project_kind" ], "docs_reference_titles": "Closing a project (classic)" }, { "action": "project_collaborator.add", "description": "A collaborator was added to a project.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "collaborator_type", "org", "org_id", "collaborator", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "public_project", "project_name", "project_role", "old_project_role", "request_access_security_header" ] }, { "action": "project_collaborator.remove", "description": "A collaborator was removed from a project.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "collaborator_type", "user", "user_id", "collaborator", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "project_collaborator.update", "description": "A project collaborator's permission level was changed.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "public_project", "project_name", "collaborator_type", "project_role", "old_project_role", "project_id", "user", "user_id", "collaborator", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "project.create", "description": "A project board was created.", "docs_reference_links": "N/A", "fields": [ "operation_type", "user", "_document_id", "request_id", "user_id", "user_agent", "@timestamp", "actor_id", "action", "created_at", "actor" ] }, { "action": "project.delete", "description": "A project board was deleted.", "docs_reference_links": "N/A", "fields": [ "request_id", "action", "actor_id", "operation_type", "actor", "user_id", "@timestamp", "created_at", "_document_id", "user_agent", "user" ] }, { "action": "project_field.create", "description": "A field was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields" }, { "action": "project_field.delete", "description": "A field was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/understanding-fields/deleting-custom-fields" }, { "action": "project.link", "description": "A repository was linked to a project board.", "docs_reference_links": "N/A", "fields": [ "repo_id", "action", "actor_id", "org_id", "user_agent", "request_id", "actor", "operation_type", "@timestamp", "_document_id", "created_at", "org", "repo" ] }, { "action": "project.open", "description": "A project board was reopened.", "docs_reference_links": "/issues/organizing-your-work-with-project-boards/managing-project-boards/reopening-a-closed-project-board", "fields": [ "actor", "request_id", "actor_id", "action", "user_id", "project_id", "_document_id", "user_agent", "operation_type", "user", "@timestamp", "created_at", "project_kind", "project_name" ], "docs_reference_titles": "Reopening a closed project (classic)" }, { "action": "project.rename", "description": "A project board was renamed.", "docs_reference_links": "N/A", "fields": [ "action", "created_at", "request_id", "actor_id", "old_name", "operation_type", "@timestamp", "repo", "_document_id", "user_agent", "org_id", "business_id", "actor", "repo_id", "org", "business" ] }, { "action": "project.unlink", "description": "A repository was unlinked from a project board.", "docs_reference_links": "N/A", "fields": [ "repo", "repo_id", "operation_type", "actor", "action", "created_at", "actor_id", "_document_id", "request_id", "@timestamp", "user_agent", "org", "org_id" ] }, { "action": "project.update_org_permission", "description": "The project's base-level permission for all organization members was changed or removed.", "docs_reference_links": "N/A", "fields": [ "actor", "org", "@timestamp", "_document_id", "operation_type", "created_at", "request_id", "actor_id", "action", "org_id", "user_agent" ] }, { "action": "project.update_team_permission", "description": "A team's project board permission level was changed or when a team was added or removed from a project board.", "docs_reference_links": "N/A", "fields": [ "created_at", "org_id", "operation_type", "org", "actor_id", "_document_id", "request_id", "team", "@timestamp", "action", "user_agent", "actor" ] }, { "action": "project.update_user_permission", "description": "A user was added to or removed from a project board or had their permission level changed.", "docs_reference_links": "N/A", "fields": [ "request_id", "user_id", "operation_type", "@timestamp", "actor_id", "user", "user_agent", "actor", "created_at", "org", "_document_id", "org_id", "action", "programmatic_access_type" ] }, { "action": "project_view.create", "description": "A view was created in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, { "action": "project_view.delete", "description": "A view was deleted in a project board.", "docs_reference_links": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/issues/planning-and-tracking-with-projects/customizing-views-in-your-project/managing-your-views" }, { "action": "project.visibility_private", "description": "A project's visibility was changed from public to private.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "project_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "project_kind", "project_name" ] }, { "action": "project.visibility_public", "description": "A project's visibility was changed from private to public.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "project_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "project_kind", "project_name", "request_access_security_header" ] }, { "action": "protected_branch.update_merge_queue_enforcement_level", "description": "Enforcement of the merge queue was modified for a branch.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "merge_queue_enforcement_level", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-merge-queue" }, { "action": "public_key.create", "description": "An SSH key was added to a user account or a deploy key was added to a repository.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account", "fields": [ "read_only", "user_agent", "actor_id", "operation_type", "created_at", "_document_id", "key", "fingerprint", "actor", "action", "user", "user_id", "@timestamp", "request_id", "title", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account" }, { "action": "public_key.delete", "description": "An SSH key was removed from a user account or a deploy key was removed from a repository.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys", "fields": [ "fingerprint", "user_agent", "read_only", "explanation", "repo", "@timestamp", "action", "key", "operation_type", "_document_id", "actor", "title", "request_id", "actor_id", "repo_id", "created_at", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/reviewing-your-ssh-keys" }, { "action": "public_key.unverification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ "user_agent", "request_id", "title", "key", "fingerprint", "read_only", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "token_scopes" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, { "action": "public_key.unverify", "description": "A user account's SSH key or a repository's deploy key was unverified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ "created_at", "operation_type", "_document_id", "title", "request_id", "key", "action", "actor", "read_only", "explanation", "repo_id", "@timestamp", "actor_id", "repo", "user_agent", "fingerprint" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, { "action": "public_key.update", "description": "A user account's SSH key or a repository's deploy key was updated.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ "actor", "user_agent", "key", "fingerprint", "read_only", "repo_id", "operation_type", "created_at", "actor_id", "repo", "action", "_document_id", "request_id", "title", "@timestamp", "programmatic_access_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, { "action": "public_key.verification_failure", "description": "A user account's SSH key or a repository's deploy key was unable to be verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ "repo_id", "actor", "key", "fingerprint", "@timestamp", "request_id", "actor_id", "oauth_application_id", "title", "action", "user_agent", "created_at", "repo", "read_only", "operation_type", "_document_id", "user", "user_id", "programmatic_access_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, { "action": "public_key.verify", "description": "A user account's SSH key or a repository's deploy key was verified.", "docs_reference_links": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys", "fields": [ "operation_type", "user", "@timestamp", "_document_id", "action", "created_at", "key", "fingerprint", "actor_id", "actor", "title", "user_agent", "user_id", "request_id", "read_only", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys" }, { "action": "repo.access", "description": "The visibility of a repository changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility", "fields": [ "repo_id", "user", "request_id", "operation_type", "@timestamp", "actor_id", "user_id", "created_at", "user_agent", "actor", "action", "repo", "visibility", "_document_id", "previous_visibility", "programmatic_access_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility" }, { "action": "repo.actions_enabled", "description": "GitHub Actions was enabled for a repository.", "docs_reference_links": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "_document_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#using-the-audit-log-api" }, { "action": "repo.add_member", "description": "A collaborator was added to a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/inviting-collaborators-to-a-personal-repository", "fields": [ "visibility", "repo", "created_at", "user_agent", "operation_type", "@timestamp", "_document_id", "actor", "actor_id", "repo_id", "user", "request_id", "action", "user_id", "oauth_application_id", "org", "org_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Inviting collaborators to a personal repository" }, { "action": "repo.add_topic", "description": "A topic was added to a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics", "fields": [ "action", "user_agent", "actor", "repo", "repo_id", "user", "org", "org_id", "request_id", "actor_id", "topic", "@timestamp", "_document_id", "user_id", "created_at", "operation_type", "programmatic_access_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics" }, { "action": "repo.advanced_security_disabled", "description": "GitHub Advanced Security was disabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "repository", "repository_id", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "programmatic_access_type", "actor_is_bot", "request_access_security_header" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, { "action": "repo.advanced_security_enabled", "description": "GitHub Advanced Security was enabled for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "repository", "repository_id", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository" }, { "action": "repo.archived", "description": "A repository was archived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ "repo_id", "user_agent", "user_id", "created_at", "@timestamp", "repo", "user", "operation_type", "visibility", "action", "actor_id", "actor", "_document_id", "request_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, { "action": "repo.change_merge_setting", "description": "Pull request merge options were changed for a repository.", "docs_reference_links": "N/A", "fields": [ "actor", "oauth_application_id", "user_agent", "request_id", "created_at", "@timestamp", "_document_id", "actor_id", "operation_type", "action", "public_repo", "token_scopes", "programmatic_access_type", "actor_is_bot" ] }, { "action": "repo.code_scanning_analysis_deleted", "description": "Code scanning analysis for a repository was deleted.", "docs_reference_links": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "tool", "category", "request_access_security_header" ], "docs_reference_titles": "/rest/code-scanning#delete-a-code-scanning-analysis-from-a-repository" }, { "action": "repo.code_scanning_configuration_for_branch_deleted", "description": "A code scanning configuration for a branch of a repository was deleted.", "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch", "fields": [ "actor", "actor_id", "user_agent", "request_id", "tool", "branch", "category", "repo", "repo_id", "public_repo", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "Resolving code scanning alerts" }, { "action": "repo.config.disable_collaborators_only", "description": "The interaction limit for collaborators only was disabled.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "user_agent", "actor", "actor_id", "repo_id", "_document_id", "action", "created_at", "repo", "operation_type", "@timestamp", "request_id" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.disable_contributors_only", "description": "The interaction limit for prior contributors only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "repo", "@timestamp", "request_id", "actor", "_document_id", "user_agent", "actor_id", "repo_id", "action", "operation_type", "created_at" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.disable_sockpuppet_disallowed", "description": "The interaction limit for existing users only was disabled in a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "actor", "request_id", "repo_id", "action", "user_agent", "_document_id", "@timestamp", "created_at", "actor_id", "repo", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.enable_collaborators_only", "description": "The interaction limit for collaborators only was enabled in a repository Users that are not collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "actor", "oauth_application_id", "created_at", "action", "request_id", "repo_id", "repo", "@timestamp", "_document_id", "user_agent", "actor_id", "operation_type" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.enable_contributors_only", "description": "The interaction limit for prior contributors only was enabled in a repository Users that are not prior contributors, collaborators or organization members were unable to interact with a repository for a set duration.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "user_agent", "request_id", "operation_type", "created_at", "actor", "org", "action", "actor_id", "repo", "repo_id", "org_id", "@timestamp", "_document_id" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.config.enable_sockpuppet_disallowed", "description": "The interaction limit for existing users was enabled in a repository New users aren't able to interact with a repository for a set duration Existing users of the repository, contributors, collaborators or organization members are able to interact with a repository.", "docs_reference_links": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository", "fields": [ "actor", "operation_type", "created_at", "user_agent", "request_id", "action", "actor_id", "repo", "repo_id", "@timestamp", "_document_id" ], "docs_reference_titles": "/communities/moderating-comments-and-conversations/limiting-interactions-in-your-repository" }, { "action": "repo.configure_self_hosted_jit_runner", "description": "A new just-in-time GitHub Actions self-hosted runner was configured", "docs_reference_links": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository", "fields": [ "user_agent", "request_id", "hashed_token", "programmatic_access_type", "actor", "actor_id", "oauth_application_id", "token_id", "token_scopes", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-a-repository" }, { "action": "repo.create", "description": "A repository was created.", "docs_reference_links": "/repositories/creating-and-managing-repositories/creating-a-new-repository", "fields": [ "repo", "user_id", "visibility", "repo_id", "user", "request_id", "actor_id", "action", "operation_type", "request_category", "@timestamp", "created_at", "_document_id", "actor", "user_agent", "org", "oauth_application_id", "org_id", "request_method", "business", "business_id", "public_repo", "token_scopes", "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/creating-a-new-repository" }, { "action": "repo.create_actions_secret", "description": "A GitHub Actions secret was created for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "key", "repo", "repo_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, { "action": "repo.create_actions_variable", "description": "A GitHub Actions variable was created for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "repo.create_integration_secret", "description": "A Codespaces or Dependabot secret was created for a repository.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "key", "visibility", "integration", "repo", "repo_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "request_access_security_header" ] }, { "action": "repo.destroy", "description": "A repository was deleted.", "docs_reference_links": "/repositories/creating-and-managing-repositories/deleting-a-repository", "fields": [ "repo", "_document_id", "user_agent", "user_id", "actor", "action", "user", "repo_id", "operation_type", "request_category", "actor_id", "visibility", "request_id", "created_at", "@timestamp", "request_method", "oauth_application_id", "token_scopes", "programmatic_access_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/deleting-a-repository" }, { "action": "repo.pages_cname", "description": "A GitHub Pages custom domain was modified in a repository.", "docs_reference_links": "N/A", "fields": [ "actor", "@timestamp", "visibility", "repo", "repo_id", "user", "request_id", "actor_id", "cname", "user_agent", "user_id", "created_at", "_document_id", "action", "operation_type", "old_cname", "programmatic_access_type" ] }, { "action": "repo.pages_create", "description": "A GitHub Pages site was created.", "docs_reference_links": "N/A", "fields": [ "actor_id", "user", "_document_id", "user_id", "visibility", "action", "user_agent", "operation_type", "repo_id", "created_at", "@timestamp", "request_id", "actor", "repo", "programmatic_access_type" ] }, { "action": "repo.pages_destroy", "description": "A GitHub Pages site was deleted.", "docs_reference_links": "N/A", "fields": [ "created_at", "user_id", "action", "request_id", "user", "repo", "user_agent", "_document_id", "actor_id", "@timestamp", "actor", "visibility", "operation_type", "repo_id", "programmatic_access_type" ] }, { "action": "repo.pages_https_redirect_disabled", "description": "HTTPS redirects were disabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ "user", "actor_id", "repo_id", "_document_id", "user_agent", "actor", "visibility", "user_id", "request_id", "repo", "@timestamp", "operation_type", "action", "created_at", "programmatic_access_type", "request_access_security_header" ] }, { "action": "repo.pages_https_redirect_enabled", "description": "HTTPS redirects were enabled for a GitHub Pages site.", "docs_reference_links": "N/A", "fields": [ "request_id", "@timestamp", "user_agent", "user_id", "created_at", "visibility", "actor", "actor_id", "user", "operation_type", "repo_id", "action", "repo", "_document_id", "request_access_security_header" ] }, { "action": "repo.pages_private", "description": "A GitHub Pages site visibility was changed to private.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "repo.pages_public", "description": "A GitHub Pages site visibility was changed to public.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "programmatic_access_type", "request_access_security_header" ] }, { "action": "repo.pages_soft_delete", "description": "A GitHub Pages site was soft-deleted because its owner's plan changed.", "docs_reference_links": "N/A", "fields": [ "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "repo.pages_soft_delete_restore", "description": "A GitHub Pages site that was previously soft-deleted was restored.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "repo.pages_source", "description": "A GitHub Pages source was modified.", "docs_reference_links": "N/A", "fields": [ "user_id", "actor_id", "operation_type", "user_agent", "actor", "@timestamp", "repo_id", "user", "_document_id", "request_id", "visibility", "repo", "created_at", "action", "programmatic_access_type" ] }, { "action": "repo.register_self_hosted_runner", "description": "A new self-hosted runner was registered.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository", "fields": [ "actor_id", "repo", "operation_type", "action", "@timestamp", "actor", "user_agent", "created_at", "_document_id", "request_id", "repo_id", "request_access_security_header" ], "docs_reference_titles": "Adding self-hosted runners" }, { "action": "repo.remove_actions_secret", "description": "A GitHub Actions secret was deleted for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "key", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, { "action": "repo.remove_actions_variable", "description": "A GitHub Actions variable was deleted for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "repo.remove_integration_secret", "description": "A Codespaces or Dependabot secret was deleted for a repository.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "key", "integration", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "request_access_security_header" ] }, { "action": "repo.remove_member", "description": "A collaborator was removed from a repository.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/removing-a-collaborator-from-a-personal-repository", "fields": [ "request_id", "user", "business", "action", "actor_id", "org", "org_id", "actor", "created_at", "repo_id", "user_agent", "business_id", "user_id", "operation_type", "@timestamp", "_document_id", "visibility", "repo", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Removing a collaborator from a personal repository" }, { "action": "repo.remove_self_hosted_runner", "description": "A self-hosted runner was removed.", "docs_reference_links": "/actions/hosting-your-own-runners/managing-self-hosted-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository", "fields": [ "request_id", "actor_id", "repo_id", "@timestamp", "_document_id", "repo", "org_id", "action", "operation_type", "user_agent", "actor", "created_at", "org", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Removing self-hosted runners" }, { "action": "repo.remove_topic", "description": "A topic was removed from a repository.", "docs_reference_links": "N/A", "fields": [ "user", "action", "repo_id", "user_agent", "topic", "operation_type", "user_id", "org", "org_id", "actor", "business", "request_id", "repo", "@timestamp", "created_at", "_document_id", "actor_id", "business_id", "programmatic_access_type" ] }, { "action": "repo.rename", "description": "A repository was renamed.", "docs_reference_links": "/repositories/creating-and-managing-repositories/renaming-a-repository", "fields": [ "user_agent", "@timestamp", "request_id", "actor_id", "actor", "old_name", "repo", "user_id", "created_at", "user", "action", "operation_type", "visibility", "repo_id", "_document_id", "programmatic_access_type" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/renaming-a-repository" }, { "action": "repo.restore", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "repo", "action", "_document_id", "actor_id", "user", "operation_type", "user_agent", "request_id", "repo_id", "@timestamp", "created_at", "actor", "user_id" ] }, { "action": "repo.set_actions_cache_retention_policy", "description": "The cache retention policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository" }, { "action": "repo.set_actions_cache_storage_policy", "description": "The cache storage policy for GitHub Actions was set for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository" }, { "action": "repo.set_actions_fork_pr_approvals_policy", "description": "The setting for requiring approvals for workflows from public forks was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "policy", "repo", "repo_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "public_repo" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks" }, { "action": "repo.set_actions_private_fork_pr_approvals_policy", "description": "The policy for requiring approval for fork pull request workflows from collaborators without write access to private repos was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories", "fields": [ "actor", "actor_id", "user_agent", "request_id", "visibility", "policy", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-forks-of-private-repositories" }, { "action": "repo.set_actions_retention_limit", "description": "The retention period for GitHub Actions artifacts and logs in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "limit", "repo", "repo_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository" }, { "action": "repo.set_default_workflow_permissions", "description": "The default permissions granted to the GITHUB_TOKEN when running workflows were changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "visibility", "repo", "repo_id", "public_repo", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository" }, { "action": "repo.set_fork_pr_workflows_policy", "description": "Triggered when the policy for workflows on private repository forks is changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "policy", "repo", "repo_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks" }, { "action": "repo.set_workflow_permission_can_approve_pr", "description": "The policy for allowing GitHub Actions to create and approve pull requests was changed for a repository.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests", "fields": [ "actor", "actor_id", "user_agent", "request_id", "visibility", "repo", "repo_id", "public_repo", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests" }, { "action": "repo.staff_unlock", "description": "An enterprise owner or GitHub staff (with permission from a repository administrator) temporarily unlocked the repository.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "_document_id", "user_agent", "actor_id", "created_at", "actor", "repo_id", "action", "org", "org_id", "request_id", "repo", "operation_type" ] }, { "action": "repo.temporary_access_granted", "description": "Temporary access was enabled for a repository.", "docs_reference_links": "/admin/user-management/managing-repositories-in-your-enterprise/accessing-user-owned-repositories-in-your-enterprise", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "repo", "repo_id", "public_repo", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id" ], "docs_reference_titles": "Accessing user-owned repositories in your enterprise" }, { "action": "repo.transfer", "description": "A user accepted a request to receive a transferred repository.", "docs_reference_links": "/repositories/creating-and-managing-repositories/transferring-a-repository", "fields": [ "@timestamp", "user_id", "_document_id", "request_id", "actor_id", "repo_id", "owner", "user", "old_user", "action", "operation_type", "created_at", "user_agent", "repo", "visibility", "repo_was", "actor" ], "docs_reference_titles": "/repositories/creating-and-managing-repositories/transferring-a-repository" }, { "action": "repo.transfer_outgoing", "description": "A repository was transferred to another repository network.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repo", "repo_id", "new_nwo", "visibility", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "public_repo", "request_access_security_header" ] }, { "action": "repo.transfer_start", "description": "A user sent a request to transfer a repository to another user or organization.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "_document_id", "operation_type", "user_id", "request_id", "user", "action", "user_agent", "created_at", "actor", "visibility", "repo_id", "actor_id", "repo", "request_access_security_header" ] }, { "action": "repo.unarchived", "description": "A repository was unarchived.", "docs_reference_links": "/repositories/archiving-a-github-repository", "fields": [ "actor", "request_id", "actor_id", "repo", "operation_type", "created_at", "_document_id", "repo_id", "user", "@timestamp", "visibility", "user_agent", "user_id", "action", "programmatic_access_type" ], "docs_reference_titles": "/repositories/archiving-a-github-repository" }, { "action": "repo.update_actions_access_settings", "description": "The setting to control how a repository was used by GitHub Actions workflows in other repositories was changed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "policy", "old_policy", "repo", "repo_id", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id" ] }, { "action": "repo.update_actions_secret", "description": "A GitHub Actions secret was updated for a repository.", "docs_reference_links": "/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository", "fields": [ "user_agent", "request_id", "actor", "actor_id", "oauth_application_id", "key", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "business", "business_id", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Using secrets in GitHub Actions" }, { "action": "repo.update_actions_settings", "description": "A repository administrator changed GitHub Actions policy settings for a repository.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "new_policy", "old_policy", "updated_access_policy", "programmatic_access_type", "actor_is_bot" ] }, { "action": "repo.update_actions_variable", "description": "A GitHub Actions variable was updated for a repository.", "docs_reference_links": "/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "request_access_security_header" ], "docs_reference_titles": "Store information in variables" }, { "action": "repo.update_default_branch", "description": "The default branch for a repository was changed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "visibility", "repo", "repo_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "token_scopes", "programmatic_access_type", "actor_is_bot" ] }, { "action": "repo.update_integration_secret", "description": "A Codespaces or Dependabot secret was updated for a repository.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "key", "visibility", "integration", "repo", "repo_id", "org", "org_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "token_scopes", "programmatic_access_type", "request_access_security_header" ] }, { "action": "repo.update_member", "description": "A user's permission to a repository was changed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "action", "_document_id", "actor", "repo_id", "created_at", "oauth_application_id", "user", "@timestamp", "repo", "operation_type", "request_id", "org_id", "actor_id", "visibility", "old_permission", "org", "user_id", "old_base_role", "old_repo_permission", "old_repo_base_role", "new_repo_base_role", "new_repo_permission", "token_scopes", "programmatic_access_type", "actor_is_bot" ] }, { "action": "repository_image.create", "description": "An image to represent a repository was uploaded.", "docs_reference_links": "N/A", "fields": [ "user_agent", "operation_type", "created_at", "actor_id", "repo_id", "action", "request_id", "actor", "content_type", "repo", "@timestamp", "_document_id", "user", "user_id", "request_access_security_header" ] }, { "action": "repository_image.destroy", "description": "An image to represent a repository was deleted.", "docs_reference_links": "N/A", "fields": [ "content_type", "created_at", "actor_id", "user_id", "operation_type", "request_id", "_document_id", "actor", "repo_id", "user_agent", "repo", "user", "action", "@timestamp", "request_access_security_header" ] }, { "action": "repository_invitation.accept", "description": "An invitation to join a repository was accepted.", "docs_reference_links": "N/A", "fields": [ "actor_id", "created_at", "request_id", "repo", "invitee", "operation_type", "actor", "repo_id", "_document_id", "action", "user_agent", "inviter", "@timestamp", "token_scopes", "programmatic_access_type" ] }, { "action": "repository_invitation.cancel", "description": "An invitation to join a repository was canceled.", "docs_reference_links": "N/A", "fields": [ "inviter", "action", "operation_type", "_document_id", "repo_id", "repo", "@timestamp", "user_agent", "invitee", "created_at", "request_id", "actor", "actor_id", "request_access_security_header" ] }, { "action": "repository_invitation.create", "description": "An invitation to join a repository was sent.", "docs_reference_links": "N/A", "fields": [ "_document_id", "actor", "actor_id", "@timestamp", "invitee", "action", "request_id", "inviter", "repo", "created_at", "user_agent", "repo_id", "operation_type", "token_scopes", "programmatic_access_type" ] }, { "action": "repository_invitation.reject", "description": "An invitation to join a repository was declined.", "docs_reference_links": "N/A", "fields": [ "repo", "_document_id", "actor", "invitee", "action", "@timestamp", "request_id", "actor_id", "operation_type", "created_at", "inviter", "user_agent", "repo_id" ] }, { "action": "repository_ruleset.create", "description": "A repository ruleset was created.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_conditions", "ruleset_bypass_actors", "request_access_security_header" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository" }, { "action": "repository_ruleset.destroy", "description": "A repository ruleset was deleted.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset", "fields": [ "actor", "actor_id", "user_agent", "request_id", "name", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules", "ruleset_bypass_actors", "request_access_security_header" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#deleting-a-ruleset" }, { "action": "repository_ruleset.update", "description": "A repository ruleset was edited.", "docs_reference_links": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset", "fields": [ "actor", "actor_id", "user_agent", "request_id", "old_name", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "ruleset_id", "ruleset_name", "ruleset_enforcement", "ruleset_source_type", "ruleset_rules_updated", "ruleset_conditions_added", "ruleset_conditions_deleted", "ruleset_old_enforcement", "ruleset_rules_added", "ruleset_rules_deleted", "ruleset_old_name", "ruleset_conditions_updated", "ruleset_bypass_actors_added", "ruleset_bypass_actors_deleted", "ruleset_bypass_actors_updated", "actor_is_bot" ], "docs_reference_titles": "/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository#editing-a-ruleset" }, { "action": "security_key.register", "description": "A security key was registered for an account.", "docs_reference_links": "N/A", "fields": [ "actor_id", "user", "created_at", "user_id", "action", "operation_type", "request_id", "@timestamp", "_document_id", "actor", "user_agent", "request_access_security_header" ] }, { "action": "security_key.remove", "description": "A security key was removed from an account.", "docs_reference_links": "N/A", "fields": [ "actor", "user_id", "operation_type", "_document_id", "user_agent", "@timestamp", "request_id", "actor_id", "action", "created_at", "user", "request_access_security_header" ] }, { "action": "social_identity.linked", "description": "A user linked a social identity to their account.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "request_access_security_header", "user_id", "action", "actor_id", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "social_identity.unlinked", "description": "A user unlinked a social identity from their account.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "social_identity.unlinked_all", "description": "A user unlinked all social identities from their account.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "request_access_security_header", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sponsors.agreement_sign", "description": "A GitHub Sponsors agreement was signed on behalf of an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "sponsors_listing_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sponsors.custom_amount_settings_change", "description": "Custom amounts for GitHub Sponsors were enabled or disabled, or the suggested custom amount was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "sponsors_listing_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, { "action": "sponsors.fiscal_host_change", "description": "The fiscal host for a GitHub Sponsors listing was updated.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "org", "org_id", "sponsors_listing_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sponsors.repo_funding_links_file_action", "description": "The FUNDING file in a repository was changed.", "docs_reference_links": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository", "fields": [ "@timestamp", "action", "created_at", "_document_id", "request_id", "repository", "repository_id", "actor", "user_agent", "actor_id", "operation_type" ], "docs_reference_titles": "/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository" }, { "action": "sponsors.sponsor_sponsorship_cancel", "description": "A sponsorship was canceled.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ "operation_type", "_document_id", "created_at", "actor", "user", "action", "actor_id", "user_id", "@timestamp" ], "docs_reference_titles": "Downgrading a sponsorship" }, { "action": "sponsors.sponsor_sponsorship_create", "description": "A sponsorship was created, by sponsoring an account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ "actor", "user_id", "action", "@timestamp", "user_agent", "request_id", "user", "operation_type", "created_at", "actor_id", "_document_id" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, { "action": "sponsors.sponsor_sponsorship_payment_complete", "description": "After you sponsor an account and a payment has been processed, the sponsorship payment was marked as complete.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes", "fields": [ "active", "user", "user_id", "actor", "actor_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/about-sponsorships-fees-and-taxes" }, { "action": "sponsors.sponsor_sponsorship_preference_change", "description": "The option to receive email updates from a sponsored account was changed.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship", "fields": [ "actor_id", "action", "@timestamp", "request_id", "user_id", "created_at", "user", "_document_id", "user_agent", "actor", "operation_type" ], "docs_reference_titles": "/sponsors/sponsoring-open-source-contributors/managing-your-sponsorship" }, { "action": "sponsors.sponsor_sponsorship_tier_change", "description": "A sponsorship was upgraded or downgraded.", "docs_reference_links": "/billing/managing-billing-for-github-sponsors/upgrading-a-sponsorship, /billing/managing-billing-for-github-sponsors/downgrading-a-sponsorship", "fields": [ "user_id", "actor", "actor_id", "action", "user", "operation_type", "@timestamp", "_document_id", "created_at" ], "docs_reference_titles": "Upgrading a sponsorship, Downgrading a sponsorship" }, { "action": "sponsors.sponsored_developer_approve", "description": "A GitHub Sponsors account was approved.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ "user_id", "action", "user_agent", "request_id", "actor", "user", "operation_type", "@timestamp", "created_at", "actor_id", "_document_id" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, { "action": "sponsors.sponsored_developer_create", "description": "A GitHub Sponsors account was created.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ "user_id", "operation_type", "request_id", "actor_id", "@timestamp", "_document_id", "user", "action", "created_at", "user_agent", "actor" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, { "action": "sponsors.sponsored_developer_disable", "description": "A GitHub Sponsors account was disabled.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "sponsors_listing_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "sponsors.sponsored_developer_profile_update", "description": "The profile for GitHub Sponsors account was edited.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors", "fields": [ "@timestamp", "actor_id", "operation_type", "created_at", "user_agent", "request_id", "actor", "action", "_document_id", "request_access_security_header" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/editing-your-profile-details-for-github-sponsors" }, { "action": "sponsors.sponsored_developer_redraft", "description": "A GitHub Sponsors account was returned to draft state from approved state.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "created_at", "request_id", "user", "action", "user_agent", "operation_type", "_document_id", "actor", "actor_id", "user_id" ] }, { "action": "sponsors.sponsored_developer_request_approval", "description": "An application for GitHub Sponsors was submitted for approval.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ "user_agent", "user", "@timestamp", "actor_id", "user_id", "request_id", "_document_id", "actor", "action", "operation_type", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, { "action": "sponsors.sponsored_developer_tier_description_update", "description": "The description for a sponsorship tier was changed.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers", "fields": [ "operation_type", "request_id", "actor", "user_id", "action", "@timestamp", "_document_id", "user_agent", "actor_id", "user", "created_at" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/managing-your-sponsorship-tiers" }, { "action": "sponsors.sponsored_developer_update_newsletter_send", "description": "Triggered when you send an email update to your sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors", "fields": [ "request_id", "actor", "action", "user_agent", "operation_type", "_document_id", "created_at", "actor_id", "user", "user_id", "@timestamp" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/contacting-your-sponsors" }, { "action": "sponsors.sponsors_patreon_user_create", "description": "A Patreon account was linked to a user account for use with GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account", "fields": [ "actor", "actor_id", "user_agent", "request_id", "patreon_email", "patreon_username", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/enabling-sponsorships-through-patreon#linking-your-patreon-account-to-your-github-account" }, { "action": "sponsors.sponsors_patreon_user_destroy", "description": "A Patreon account for use with GitHub Sponsors was unlinked from a user account.", "docs_reference_links": "/sponsors/sponsoring-open-source-contributors/unlinking-your-patreon-account-from-your-github-account", "fields": [ "actor", "actor_id", "user_agent", "request_id", "patreon_email", "patreon_username", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ], "docs_reference_titles": "Unlinking your Patreon account from GitHub" }, { "action": "sponsors.update_tier_repository", "description": "A GitHub Sponsors tier changed access for a repository.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "sponsors_listing_id", "repo", "repo_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sponsors.update_tier_welcome_message", "description": "The welcome message for a GitHub Sponsors tier for an organization was updated.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "sponsors_listing_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sponsors.waitlist_join", "description": "You join the waitlist to join GitHub Sponsors.", "docs_reference_links": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account", "fields": [ "request_id", "actor", "user_id", "user_agent", "actor_id", "action", "operation_type", "created_at", "user", "@timestamp", "_document_id" ], "docs_reference_titles": "/sponsors/receiving-sponsorships-through-github-sponsors/setting-up-github-sponsors-for-your-personal-account" }, { "action": "sponsors.withdraw_agreement_signature", "description": "A signature was withdrawn from a GitHub Sponsors agreement that applies to an organization.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "sponsors_listing_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "sub_issues.parent_issue_add", "description": "A parent issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "sub_issues.parent_issue_remove", "description": "A parent issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "sub_issues.sub_issue_add", "description": "A sub-issue was added to an issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "sub_issues.sub_issue_remove", "description": "A sub-issue was removed from an issue.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "title", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "successor_invitation.accept", "description": "Triggered when you accept a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, { "action": "successor_invitation.cancel", "description": "Triggered when you cancel a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, { "action": "successor_invitation.create", "description": "Triggered when you create a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, { "action": "successor_invitation.decline", "description": "Triggered when you decline a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, { "action": "successor_invitation.destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "successor_invitation.revoke", "description": "Triggered when you revoke a succession invitation.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories", "fields": [ "user_agent", "request_id", "actor", "actor_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Maintaining ownership continuity of your personal account's repositories" }, { "action": "trusted_device.register", "description": "A new trusted device was added.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "trusted_device.remove", "description": "A trusted device was removed.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "two_factor_account_recovery.abort", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "created_at", "action", "request_id", "user_id", "@timestamp", "_document_id", "user", "user_agent", "operation_type" ] }, { "action": "two_factor_account_recovery.complete", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "request_id", "@timestamp", "created_at", "user_id", "operation_type", "user", "_document_id", "user_agent", "action" ] }, { "action": "two_factor_account_recovery.ignore", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "_document_id", "created_at", "user_id", "operation_type", "@timestamp", "user", "action" ] }, { "action": "two_factor_account_recovery.staff_approve", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "created_at", "actor", "actor_id", "@timestamp", "request_id", "user", "user_id", "user_agent", "operation_type", "action", "_document_id" ] }, { "action": "two_factor_account_recovery.staff_decline", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_id", "actor", "action", "@timestamp", "user_agent", "operation_type", "user", "created_at", "request_id", "actor_id", "_document_id" ] }, { "action": "two_factor_account_recovery.start", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user", "operation_type", "@timestamp", "user_agent", "request_id", "created_at", "user_id", "action", "_document_id", "request_access_security_header" ] }, { "action": "two_factor_account_recovery.two_factor_destroy", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "operation_type", "user_id", "action", "@timestamp", "created_at", "user_agent", "user", "_document_id", "request_id" ] }, { "action": "two_factor_authentication.add_factor", "description": "A secondary authentication factor was added to a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, { "action": "two_factor_authentication.disabled", "description": "Two-factor authentication was disabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/disabling-two-factor-authentication-for-your-personal-account", "fields": [ "actor", "action", "_document_id", "user_agent", "user", "user_id", "actor_id", "created_at", "operation_type", "request_id", "@timestamp", "request_access_security_header" ], "docs_reference_titles": "Disabling two-factor authentication for your personal account" }, { "action": "two_factor_authentication.enabled", "description": "Two-factor authentication was enabled for a user account.", "docs_reference_links": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ "actor", "operation_type", "user_agent", "action", "created_at", "actor_id", "@timestamp", "request_id", "user", "user_id", "_document_id", "request_access_security_header" ], "docs_reference_titles": "Configuring two-factor authentication" }, { "action": "two_factor_authentication.password_reset_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ "operation_type", "created_at", "user", "user_id", "action", "@timestamp", "request_id", "_document_id", "user_agent" ] }, { "action": "two_factor_authentication.recovery_codes_regenerated", "description": "Two factor recovery codes were regenerated for a user account.", "docs_reference_links": "N/A", "fields": [ "request_id", "actor", "operation_type", "_document_id", "user_id", "action", "user", "user_agent", "actor_id", "@timestamp", "created_at" ] }, { "action": "two_factor_authentication.remove_factor", "description": "A secondary authentication factor was removed from a user account.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, { "action": "two_factor_authentication.sign_in_fallback_sms", "description": "A one-time password code was sent to a user account fallback phone number.", "docs_reference_links": "N/A", "fields": [ "request_id", "operation_type", "user_id", "user", "user_agent", "created_at", "_document_id", "action", "@timestamp" ] }, { "action": "two_factor_authentication.update_fallback", "description": "The two-factor authentication fallback for a user account was changed.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "created_at", "_document_id", "user", "user_id", "operation_type", "user_agent", "action", "request_id", "actor", "actor_id" ] }, { "action": "user.add_email", "description": "An email address was added to a user account.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/adding-an-email-address-to-your-github-account", "fields": [ "action", "request_id", "user", "user_id", "user_agent", "operation_type", "_document_id", "actor_id", "actor", "email", "@timestamp", "created_at", "request_access_security_header" ], "docs_reference_titles": "Adding an email address to your GitHub account" }, { "action": "user.async_delete", "description": "An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.", "docs_reference_links": "N/A", "fields": [ "actor", "user_id", "created_at", "user", "@timestamp", "_document_id", "request_id", "actor_id", "operation_type", "user_agent", "action", "request_access_security_header" ] }, { "action": "user.audit_log_export", "description": "Audit log entries were exported.", "docs_reference_links": "N/A", "fields": [ "actor_id", "user", "action", "request_id", "actor", "@timestamp", "_document_id", "user_agent", "user_id", "operation_type", "created_at" ] }, { "action": "user.block_user", "description": "A user was blocked by another user.", "docs_reference_links": "N/A", "fields": [ "action", "actor", "user_id", "_document_id", "actor_id", "@timestamp", "user_agent", "user", "request_id", "blocked_user", "operation_type", "created_at", "programmatic_access_type", "request_access_security_header" ] }, { "action": "user.change_password", "description": "A user changed their password.", "docs_reference_links": "N/A", "fields": [ "request_id", "@timestamp", "user_agent", "actor_id", "operation_type", "actor", "user", "user_id", "action", "created_at", "_document_id", "request_access_security_header" ] }, { "action": "user.codespaces_trusted_repo_access_granted", "description": "Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "programmatic_access_type" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, { "action": "user.codespaces_trusted_repo_access_revoked", "description": "Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.", "docs_reference_links": "/codespaces/managing-codespaces-for-your-organization/managing-repository-access-for-your-organizations-codespaces", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ], "docs_reference_titles": "Managing access to other repositories within your codespace" }, { "action": "user.create", "description": "A new user account was created.", "docs_reference_links": "N/A", "fields": [ "email", "user_id", "operation_type", "@timestamp", "request_id", "user", "created_at", "_document_id", "user_agent", "actor", "actor_id", "action", "programmatic_access_type" ] }, { "action": "user.create_integration_secret", "description": "A user secret for Codespaces was created.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "integration", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "user.creation_rate_limit_exceeded", "description": "The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.", "docs_reference_links": "N/A", "fields": [ "user", "created_at", "user_agent", "_document_id", "operation_type", "oauth_application_id", "action", "actor", "actor_id", "request_id", "user_id", "@timestamp", "token_scopes", "programmatic_access_type" ] }, { "action": "user.delete", "description": "A user account was destroyed by an asynchronous job.", "docs_reference_links": "N/A", "fields": [ "operation_type", "created_at", "user_agent", "action", "request_id", "user_id", "actor", "actor_id", "user", "@timestamp", "_document_id", "request_access_security_header" ] }, { "action": "user.demote", "description": "A site administrator was demoted to an ordinary user account.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "oauth_application_id", "action", "user", "created_at", "user_agent", "request_id", "actor", "actor_id", "operation_type", "_document_id", "user_id", "programmatic_access_type", "request_access_security_header" ] }, { "action": "user.destroy", "description": "A user deleted his or her account, triggering user.async_delete.", "docs_reference_links": "N/A", "fields": [ "request_id", "actor", "user", "_document_id", "created_at", "user_agent", "user_id", "operation_type", "actor_id", "action", "@timestamp", "request_access_security_header" ] }, { "action": "user.device_verification_failure", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "request_id", "actor", "created_at", "_document_id", "@timestamp", "user", "user_agent", "user_id", "actor_id", "action", "operation_type", "request_access_security_header" ] }, { "action": "user.device_verification_requested", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "user_id", "actor", "operation_type", "created_at", "_document_id", "@timestamp", "user", "actor_id", "action", "request_access_security_header" ] }, { "action": "user.device_verification_success", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "@timestamp", "user", "_document_id", "action", "operation_type", "user_agent", "created_at", "request_id", "actor", "actor_id", "user_id", "request_access_security_header" ] }, { "action": "user.disable_collaborators_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user.disable_contributors_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user.disable_sockpuppet_disallowed", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user_email.confirm_claim", "description": "An enterprise managed user claimed an email address.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ] }, { "action": "user_email.mark_as_unclaimed", "description": "N/A", "docs_reference_links": "An enterprise managed user unclaimed an email address.", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "business", "business_id", "actor_is_bot", "request_access_security_header" ], "docs_reference_titles": "An, GitHub Help Documentation, managed, user, unclaimed, an, email, address." }, { "action": "user.enable_collaborators_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user.enable_contributors_only", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user.enable_sockpuppet_disallowed", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "operation_type", "@timestamp", "created_at", "_document_id" ] }, { "action": "user.failed_login", "description": "A user tried to sign in with an incorrect username, password, or two-factor authentication code.", "docs_reference_links": "N/A", "fields": [ "user_id", "action", "operation_type", "request_id", "created_at", "_document_id", "@timestamp", "user", "org_id", "actor", "actor_id", "user_agent" ] }, { "action": "user.forgot_password", "description": "A user requested a password reset.", "docs_reference_links": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials", "fields": [ "action", "_document_id", "user_agent", "request_id", "user", "operation_type", "@timestamp", "email", "created_at", "user_id", "request_access_security_header" ], "docs_reference_titles": "/authentication/keeping-your-account-and-data-secure/updating-your-github-access-credentials" }, { "action": "user.grant_github_developer", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor_id", "action", "created_at", "user_agent", "@timestamp", "_document_id", "user", "user_id", "actor", "operation_type", "request_id" ] }, { "action": "user.hide_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ "user_agent", "request_id", "actor", "actor_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, { "action": "user.login", "description": "A user signed in.", "docs_reference_links": "N/A", "fields": [ "user_agent", "user_id", "actor_id", "@timestamp", "user", "action", "operation_type", "_document_id", "request_id", "created_at", "actor", "passkey_nickname", "request_access_security_header" ] }, { "action": "user.logout", "description": "A user signed out.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "user.new_device_used", "description": "A user signed in from a new device.", "docs_reference_links": "N/A", "fields": [ "user", "user_id", "actor", "operation_type", "created_at", "user_agent", "actor_id", "action", "@timestamp", "_document_id", "request_id", "request_access_security_header" ] }, { "action": "user.promote", "description": "An ordinary user account was promoted to a site administrator.", "docs_reference_links": "N/A", "fields": [ "user_id", "action", "actor", "actor_id", "user", "@timestamp", "created_at", "user_agent", "oauth_application_id", "request_id", "operation_type", "_document_id", "token_scopes", "programmatic_access_type", "request_access_security_header" ] }, { "action": "user.recreate", "description": "A user's account was restored.", "docs_reference_links": "N/A", "fields": [ "user_agent", "user", "action", "actor_id", "@timestamp", "_document_id", "request_id", "user_id", "created_at", "actor", "operation_type" ] }, { "action": "user.remove_email", "description": "An email address was removed from a user account.", "docs_reference_links": "N/A", "fields": [ "user_agent", "action", "@timestamp", "_document_id", "request_id", "user", "user_id", "operation_type", "actor", "actor_id", "created_at", "email", "token_scopes", "programmatic_access_type" ] }, { "action": "user.remove_integration_secret", "description": "A user secret for Codespaces was deleted.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "integration", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "user.rename", "description": "A username was changed.", "docs_reference_links": "N/A", "fields": [ "user", "action", "request_id", "actor_id", "old_login", "created_at", "_document_id", "actor", "user_id", "@timestamp", "operation_type", "user_agent", "token_scopes", "programmatic_access_type" ] }, { "action": "user.reset_password", "description": "A user reset their account password.", "docs_reference_links": "N/A", "fields": [ "actor_id", "action", "user_agent", "user", "request_id", "user_id", "created_at", "@timestamp", "_document_id", "actor", "operation_type", "request_access_security_header" ] }, { "action": "user_session.country_change", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "created_at", "request_id", "user_id", "action", "@timestamp", "_document_id", "actor", "actor_id", "user", "user_agent", "operation_type" ] }, { "action": "user.show_private_contributions_count", "description": "A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/showing-your-private-contributions-and-achievements-on-your-profile", "fields": [ "@timestamp", "_document_id", "request_id", "user_id", "action", "actor", "user", "operation_type", "user_agent", "actor_id", "created_at", "request_access_security_header" ], "docs_reference_titles": "Manage visibility settings for private contributions" }, { "action": "user.sign_in_from_unrecognized_device", "description": "A user signed in from an unrecognized device.", "docs_reference_links": "N/A", "fields": [ "request_id", "action", "_document_id", "user_agent", "user", "user_id", "operation_type", "created_at", "actor", "actor_id", "@timestamp", "request_access_security_header" ] }, { "action": "user.sign_in_from_unrecognized_device_and_location", "description": "A user signed in from an unrecognized device and location.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user", "user_id", "@timestamp", "user_agent", "created_at", "_document_id", "request_id", "action", "operation_type", "request_access_security_header" ] }, { "action": "user_status.destroy", "description": "Triggered when you clear the status on your profile.", "docs_reference_links": "N/A", "fields": [ "org", "user_id", "actor", "message", "user", "actor_id", "created_at", "request_id", "limited_availability", "action", "emoji", "operation_type", "user_agent", "@timestamp", "_document_id", "request_access_security_header" ] }, { "action": "user_status.update", "description": "Triggered when you set or change the status on your profile.", "docs_reference_links": "/account-and-profile/setting-up-and-managing-your-github-profile/customizing-your-profile/personalizing-your-profile#setting-a-status", "fields": [ "limited_availability", "user", "action", "actor_id", "message", "user_id", "created_at", "_document_id", "request_id", "@timestamp", "user_agent", "emoji", "org", "actor", "operation_type", "token_scopes", "programmatic_access_type" ], "docs_reference_titles": "Personalize your profile" }, { "action": "user.suspend", "description": "A user account was suspended.", "docs_reference_links": "N/A", "fields": [ "oauth_application_id", "operation_type", "actor_id", "user", "user_agent", "request_id", "actor", "created_at", "_document_id", "@timestamp", "user_id", "action", "token_scopes", "programmatic_access_type", "request_access_security_header" ] }, { "action": "user.toggle_warn_private_email", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "request_id", "user", "actor_id", "@timestamp", "operation_type", "_document_id", "user_agent", "actor", "action", "user_id", "created_at", "request_access_security_header" ] }, { "action": "user.two_factor_challenge_failure", "description": "A 2FA challenge issued for a user account failed.", "docs_reference_links": "N/A", "fields": [ "operation_type", "created_at", "_document_id", "user_agent", "user", "actor_id", "actor", "user_id", "@timestamp", "action", "request_id", "request_access_security_header" ] }, { "action": "user.two_factor_challenge_success", "description": "A 2FA challenge issued for a user account succeeded.", "docs_reference_links": "N/A", "fields": [ "@timestamp", "_document_id", "user_id", "operation_type", "actor_id", "user", "actor", "user_agent", "request_id", "action", "created_at", "request_access_security_header" ] }, { "action": "user.two_factor_recover", "description": "A user used their 2FA recovery codes.", "docs_reference_links": "N/A", "fields": [ "user_id", "operation_type", "user_agent", "request_id", "user", "action", "actor", "actor_id", "created_at", "@timestamp", "_document_id", "request_access_security_header" ] }, { "action": "user.two_factor_recovery_codes_downloaded", "description": "A user downloaded 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ "user_id", "operation_type", "actor_id", "user", "request_id", "action", "@timestamp", "created_at", "user_agent", "actor", "_document_id", "request_access_security_header" ] }, { "action": "user.two_factor_recovery_codes_printed", "description": "A user printed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ "user", "action", "operation_type", "user_agent", "request_id", "user_id", "created_at", "_document_id", "actor", "actor_id", "@timestamp" ] }, { "action": "user.two_factor_recovery_codes_viewed", "description": "A user viewed 2FA recovery codes for their account.", "docs_reference_links": "N/A", "fields": [ "actor_id", "user_agent", "actor", "user_id", "action", "created_at", "user", "operation_type", "@timestamp", "request_id", "_document_id", "request_access_security_header" ] }, { "action": "user.two_factor_requested", "description": "A user was prompted for a two-factor authentication code.", "docs_reference_links": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication", "fields": [ "user", "actor_id", "action", "user_agent", "request_id", "created_at", "_document_id", "user_id", "operation_type", "@timestamp", "actor" ], "docs_reference_titles": "/authentication/securing-your-account-with-two-factor-authentication-2fa/accessing-github-using-two-factor-authentication" }, { "action": "user.unblock_user", "description": "A user was unblocked by another user.", "docs_reference_links": "N/A", "fields": [ "actor_id", "action", "request_id", "_document_id", "blocked_user", "operation_type", "actor", "@timestamp", "user_agent", "user_id", "user", "created_at", "request_access_security_header" ] }, { "action": "user.unsuspend", "description": "A user account was unsuspended.", "docs_reference_links": "N/A", "fields": [ "request_id", "_document_id", "user", "action", "user_agent", "actor", "oauth_application_id", "operation_type", "actor_id", "created_at", "@timestamp", "user_id", "token_scopes", "programmatic_access_type", "request_access_security_header" ] }, { "action": "user.update_integration_secret", "description": "A user secret for Codespaces was updated.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "key", "visibility", "integration", "user", "user_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "user.update_new_repository_default_branch_setting", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "created_at", "user", "user_id", "action", "operation_type", "@timestamp", "_document_id", "request_access_security_header" ] }, { "action": "workflows.approve_workflow_job", "description": "A workflow job was approved.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ "user_agent", "request_id", "actor", "actor_id", "workflow_run_id", "run_number", "user", "user_id", "repo", "repo_id", "business", "business_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "token_scopes", "programmatic_access_type", "request_access_security_header" ], "docs_reference_titles": "Reviewing deployments" }, { "action": "workflows.bypass_protection_rules", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "workflow_run_id", "run_number", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "request_access_security_header" ] }, { "action": "workflows.comment_workflow_job", "description": "N/A", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "token_id", "hashed_token", "programmatic_access_type", "actor", "actor_id", "workflow_run_id", "run_number", "repo", "repo_id", "public_repo", "org", "org_id", "action", "_document_id", "@timestamp", "created_at", "operation_type" ] }, { "action": "workflows.delete_workflow_run", "description": "A workflow run was deleted.", "docs_reference_links": "/actions/managing-workflow-runs/deleting-a-workflow-run", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repo", "repo_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "workflow_run_id", "started_at", "head_branch", "head_sha", "trigger_id", "programmatic_access_type" ], "docs_reference_titles": "Deleting a workflow run" }, { "action": "workflows.disable_workflow", "description": "A workflow was disabled.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repo", "repo_id", "workflow_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "workflows.enable_workflow", "description": "A workflow was enabled, after previously being disabled by disable_workflow.", "docs_reference_links": "N/A", "fields": [ "user_agent", "request_id", "actor", "actor_id", "repo", "repo_id", "workflow_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "request_access_security_header" ] }, { "action": "workflows.pin_workflow", "description": "A workflow was pinned.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "repo", "repo_id", "public_repo", "workflow_id", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] }, { "action": "workflows.reject_workflow_job", "description": "A workflow job was rejected.", "docs_reference_links": "/actions/managing-workflow-runs/reviewing-deployments", "fields": [ "user_agent", "request_id", "actor", "actor_id", "workflow_run_id", "run_number", "user", "user_id", "repo", "repo_id", "action", "operation_type", "@timestamp", "created_at", "_document_id", "public_repo", "programmatic_access_type", "request_access_security_header" ], "docs_reference_titles": "Reviewing deployments" }, { "action": "workflows.unpin_workflow", "description": "A workflow was unpinned after previously being pinned.", "docs_reference_links": "N/A", "fields": [ "actor", "actor_id", "user_agent", "request_id", "repo", "repo_id", "public_repo", "workflow_id", "org", "org_id", "business", "business_id", "action", "_document_id", "@timestamp", "created_at", "operation_type", "actor_is_bot", "request_access_security_header" ] } ]