Audit Logs

The Audit Logs page records every action taken via the dashboard, provided it’s classified as an action. This visibility ensures accountability and is especially valuable for compliance and regulatory requirements

Audit Logs dashboard

Audit Log Events

The tables below list every event that can appear in your audit log, grouped by product area. Each event has an action name, a description of what happened, and a type: Write events change configuration or data, while Read events record sensitive read or trigger operations (such as exports and connection tests).

For sample audit log payloads, see API Audit Log Events.

Users, Roles, and Authentication

Action Name	Description	Type
customer.authentication.update	Updated authentication options	Write
customer.role.create	Created custom role	Write
customer.role.delete	Deleted custom role	Write
customer.role.update	Updated custom role	Write
customer.users.add	Added new user	Write
customer.users.delete	Deleted user	Write
customer.users.update	Updated user	Write

API Keys, Tokens, and OIDC

Action Name	Description	Type
customer.api-key.rotate	Rotated customer API key	Write
customer.fine-grained-api-keys.mint	Minted tenant fine-grained API key	Write
customer.fine-grained-api-keys.revoke	Revoked tenant fine-grained API key	Write
customer.oidc-trust-policies.create	Created OIDC trust policy	Write
customer.oidc-trust-policies.delete	Deleted OIDC trust policy	Write
customer.oidc.token-exchanged	Exchanged GitHub OIDC token for StepSecurity API token	Write
customer.tokens.mint	Minted short-lived token	Write
customer.tokens.revoke	Revoked short-lived token	Write
github.fine-grained-api-keys.mint	Minted org fine-grained API key	Write
github.fine-grained-api-keys.revoke	Revoked org fine-grained API key	Write
github.oidc-trust-policies.create	Created org OIDC trust policy	Write
github.oidc-trust-policies.delete	Deleted org OIDC trust policy	Write

Detection Rules, Suppression, and Notifications

Action Name	Description	Type
customer.custom_detection_rule.create	Created custom detection rule	Write
customer.custom_detection_rule.update	Updated custom detection rule	Write
customer.default_slack_channel.set	Set default Slack channel for customer	Write
customer.default_slack_channel.test	Tested customer default Slack channel	Read
customer.detection_rule.create	Created detection rule	Write
customer.detection_rule.delete	Deleted detection rule	Write
customer.detection_rule.update	Updated detection rule	Write
customer.notification_settings.update	Updated customer notification settings	Write
customer.slack_oauth.disconnect	Disconnected Slack OAuth	Write
detection-suppression-resolution.update	Updated detection suppression or resolution	Write
org.notification_settings.test	Tested notification connection	Read
org.notification_settings.update	Updated notification settings	Write

Harden-Runner Policies and Settings

Action Name	Description	Type
customer.harden_runner_settings.delete	Reset harden runner settings to defaults	Write
customer.harden_runner_settings.update	Updated harden runner settings	Write
customer.run_policy.create	Created workflow run policy	Write
customer.run_policy.delete	Deleted workflow run policy	Write
customer.run_policy.update	Updated workflow run policy	Write
jobs.baseline.delete	Deleted Job baseline	Write
org.attach_harden_runner_policy.add	Attached/Updated harden runner policy	Write
org.attach_harden_runner_policy.delete	Deleted harden runner policy attachment	Write
org.harden_runner_policy.add	Added/Updated harden runner policy	Write
org.harden_runner_policy.delete	Deleted harden runner policy	Write
org.tls_inspection_settings.update	Updated tls inspection settings	Write
repo.harden-runner-checks.update	Updated harden-runner baseline check	Write

Secure Registry

Action Name	Description	Type
customer.secure_registry_controls.reset	Reset secure registry controls to defaults	Write
customer.secure_registry_controls.update	Updated secure registry controls	Write

Dev Machine Guard

Action Name	Description	Type
customer.developer_mdm.agent_update_policy.update	Updated developer MDM agent update policy	Write
customer.developer_mdm.device.delete	Deleted developer MDM device	Write
customer.developer_mdm.feature_configurations.update	Updated developer MDM feature configurations	Write
customer.developer_mdm.hook_policy.update	Updated developer MDM hook policy	Write
customer.developer_mdm.policy.create	Created developer MDM policy	Write
customer.developer_mdm.policy.delete	Deleted developer MDM policy	Write
customer.developer_mdm.policy.update	Updated developer MDM policy	Write
customer.developer_mdm.profile.create	Created developer MDM profile	Write
customer.developer_mdm.profile.delete	Deleted developer MDM profile	Write
customer.developer_mdm.profile.export	Exported developer MDM profile	Read
customer.developer_mdm.profile.update	Updated developer MDM profile	Write
customer.developer_mdm.telemetry_key.rotate	Rotated developer MDM telemetry key	Write
customer.host.trigger-update	Triggered agent update for host	Write

Controls and Feature Configurations

Action Name	Description	Type
org-and-repo.control-settings.update	Updated control settings for org and repo	Write
org-or-repo.control-settings.reset	Reset feature configs for an owner or repo	Write
org-or-repo.control-settings.update	Updated feature configs for org or repo	Write
org.control-settings.update	Updated control settings for org	Write
org.controls.inprogress.update	Update control check in-progress status	Write
org.controls.update	Suppressed/Unsuppressed control	Write
org.exempted-controls.update	Updated exempted controls for org	Write
repo.controls.refresh	Triggered controls refresh	Read
repo.feature-configurations.update	Updated feature configurations for repo	Write

GitHub Organization and Repository

Action Name	Description	Type
customer.github-job-markdown-config.update	Updated GitHub job markdown configuration	Write
github.checks-config.update	Updated checks config	Write
github.checks.update	Updated checks	Write
org.actions.activate-subscription	Activated subscription	Write
org.apps-pats.refresh	Triggered Apps & PATs refresh	Read
org.artifact.add	Added artifact	Write
org.artifact.delete	Deleted artifact	Write
org.maintained_action.request	Requested maintained action for action	Write
org.pr-template.update	Updated PR template for org	Write
org.suppress-imposter-commit.suppress	Suppressed imposter commit	Write

Integrations (S3 and Webhook)

Action Name	Description	Type
customer.s3-integration.test	Tested s3 integration	Write
customer.s3-integration.update	Updated s3 integration	Write
customer.s3-integration.verify	Verified s3 integration	Write
customer.webhook-integration.update	Updated webhook integration	Write

Servers (GitHub Enterprise Server and GitLab)

Action Name	Description	Type
customer.github_server.advanced_app.installation	Install advanced app in GHES	Write
customer.github_server.advanced_app.setup	Setup advanced app in GHES	Write
customer.github_server.delete	Deleted github server	Write
customer.github_server.setup	Setup github server	Write
customer.github_server.update	Created/Updated github server	Write
customer.gitlab_server.update	Created/Updated gitlab server	Write

Azure DevOps

Action Name	Description	Type
ado.apps-pats.refresh	Triggered ADO Apps & PATs refresh	Read
ado.jobs.baseline.delete	Deleted ADO job baseline endpoint	Write
ado.organization.create	Created ado organization	Write
ado.organization.delete	Deleted ado organization	Write
ado.server.create	Created ado server	Write
ado.server.delete	Deleted ado server	Write