How to export the GitHub audit log (UI, API, streaming)

TL;DR. To get complete evidence, you need several sources, not one. Take the UI export (JSON, all plans), the REST API with include=all (Enterprise Cloud, and the only way to get Git events per organization), the streaming files if you have them, the Git events export (enterprise, 7-day retention) and the Actions log archives of suspicious runs. Get the Git events first. Every format below can be dropped as is into the in-browser analyzer.

This guide covers the practical side of each source: where to click, what the file looks like, which plan you need and what it does not contain. For what to do with the files afterwards, see GitHub audit log analysis, step by step.

Which source for which question

The plan requirements come from GitHub's docs: the organization page says the audit log API requires GitHub Enterprise Cloud. On GitHub Free or Team, the UI export is your main source.

1. Organization audit log from the web interface

1. Go to the organization's Settings → Archive → Logs → Audit log. Only owners can open it.
2. Filter first. The search box accepts created:>=2026-09-01, actor:, action:, repo: and country:.
3. Click Export and choose JSON. CSV works too, but JSON keeps nested fields such as actor_location.country_code.

GitHub caps each export at 100 MB compressed or 10 minutes of processing. For a long window, export it week by week. Duplicates across overlapping slices are not a problem for the analyzer, which deduplicates on _document_id.

Enable IP addresses first. GitHub does not show source IP addresses by default. An owner can turn on display of IP addresses. The setting applies to new and existing events, so enabling it during an incident still helps. Without it, actor_ip is missing and the new-IP and new-country detections cannot fire. IP addresses are personal data in many jurisdictions: check your obligations before you store them.

2. REST API (Enterprise Cloud)

The organization endpoint is documented in the REST reference. You need to be an owner, and a classic token needs the read:audit_log scope.

curl -sSL -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/orgs/ORG/audit-log?include=all&per_page=100&phrase=created:%3E%3D2026-08-01" \
  -o page-001.json

Three details catch people out:

• include defaults to web. Use include=all to get Git events as well, or include=git to get only them.
• Without a phrase that has a created qualifier, the API only returns the last three months.
• Follow the Link: rel="next" header until it disappears. The endpoint allows 1,750 queries per hour per user and IP address.

Save each page as its own file, or concatenate them. The analyzer accepts arrays, concatenated arrays and JSON lines.

3. Git events export (enterprise)

Enterprise owners get a separate Export Git Events menu in the enterprise audit log. Pick the date range and download the result. GitHub describes it on the enterprise export page. The file is compressed JSON lines named like export-<enterprise>-<timestamp>.json.gz, and you do not need to unzip it.

Two limits matter in an investigation:

• Retention is seven days. Export the same day you open the incident.
• Web and API operations are excluded. A pull request merged in the browser pushes to the base branch, but that push does not appear as a Git event. The absence of git.push does not mean there were no changes.

Since the audit log can include token data for Git events, git.clone rows can carry a hashed_token. Grouping by that field is how you tell the developer apart from someone replaying their token.

4. Audit log streaming

If your enterprise streams its audit log, you already have the most complete source. It contains audit and Git events for every organization, and your storage keeps them for as long as you decide. The supported destinations are Amazon S3, Azure Blob Storage, Azure Event Hubs, Datadog, Google Cloud Storage and Splunk. Object storage uses the layout YYYY/MM/DD/HH/MM/<uuid>.json.log.gz.

Download the folders that cover the window and drop the whole tree, or a ZIP of it. Each .json.log.gz is decompressed on the fly. Also check whether someone changed the stream. audit_log_streaming.destroy or .update during the incident is a finding in itself (see organization takeover). The streaming glossary entry explains how GitHub buffers events while a stream is paused.

5. Actions run log archives

For each suspicious run: repository → Actions → the run → ⋯ → Download log archive. You get a ZIP that holds each job's combined log and a folder with one file per step. Anyone with read access can download it.

Do it early. Logs follow the retention policy (90 days by default) and anyone with write access can delete them. If a run was partially re-run, the archive only contains the re-run jobs, so download the earlier attempts as well.

6. Secret-scanning alerts

GET /orgs/{org}/secret-scanning/alerts returns the alerts as JSON (see the REST reference). Drop that file next to the audit log. When an alert is about an AWS, Google Cloud or Azure credential, the tool shows the cloud next hop. The cloud pivot article explains why that matters.

Chain of custody, briefly

Record who exported what, when, with which filter. Compute a SHA-256 of each file and keep the originals read-only. Work on copies. None of this is specific to GitHub, but the short Git event retention means you will not get a second chance at the same export.

FAQ

Why is git.clone missing from my audit log export?

The web interface export does not include Git events. You get them through the REST API with include=git or include=all, the enterprise Export Git Events menu, or audit log streaming, all of which require GitHub Enterprise Cloud. Git events are kept for seven days.

Is there a size limit on audit log exports?

Yes. GitHub stops an export at 100 MB compressed or 10 minutes of processing. Filter by date with the created qualifier and export in several slices, or use the API or streaming for large volumes.

Related

• GitHub audit log analysis, step by step
• GitHub audit log limitations: retention, gaps, plans
• The same checklist is on the tool page: how to export these logs
• Glossary: Git events, GitHub audit log