Audit log

The audit log records organization management actions such as release promotion, tester changes, and webhook updates. Only a GitHub dashboard session with the organization admin role can read it. API tokens cannot call this endpoint.

GET /api/v1/orgs/:orgId/audit-log

The response is { "items": [...] }, ordered by creation time from newest to oldest. Each entry has:

Field	Meaning
id, orgId	Opaque audit entry and organization IDs
action	Action name, for example release.promoted or webhook.updated
targetType, targetId	Type and ID of the affected object
data	Action-specific JSON object or null
createdAt	Time the event was recorded
actor	{ id, name, githubLogin } or null if no linked user is available

Filter and page through entries

Query parameter	Behavior
action	Exact action name
targetType	Exact target type, such as release
actorUserId	Exact user ID, not a GitHub login
limit	Page size, defaults to 50 and is clamped to 1–100
offset	Number of matching rows to skip, defaults to 0

GET /api/v1/orgs/org_123/audit-log?action=release.promoted&limit=50&offset=0

To read another page, add the number of entries you requested to offset. The route returns only an items array; it does not return a total count or nextCursor. An empty array means there are no more matching rows at that offset. Entries written while you page can shift later offset results, so export or process a busy log with that possibility in mind.

data varies by action and may contain IDs, counts, or changed field names. Use action, targetType, and targetId for routing; do not assume every action has the same data shape. The endpoint is read-only. A missing session returns 401 unauthorized; an insufficient role returns 403 forbidden; a user outside the organization gets 404 org_not_found.