Unable to pull organization audit log through the REST API

[myharrypotter]

Select Topic Area

Question

Body

As per the GIT HUB docs, below API should return organization audit_log but it is throwing 404, could some one help us on this.

curl -L
-H "Accept: application/vnd.github+json"
-H "Authorization: Bearer "
-H "X-GitHub-Api-Version: 2022-11-28"
https://api.github.com/orgs/ORG/audit-log

Organizations
Use the REST API to interact with organizations.

https://docs.github.com/en/enterprise-cloud@latest/rest/orgs/orgs?apiVersion=2022-11-28#get-the-audit-log-for-an-organization

Here is the response from postman.

[seyLu]

Hi @myharrypotter,

As per the Github API docs, to access the audit logs, you have to be an org owner and use an access token with read:audit_log scope. In the phrase param, if you are only taking in audit log for those created at 2023-09-04, then don't do created:2023-09-04..2023-09-04. To narrow down the error, query all audit-logs first. If all good, then filter. If all good then add other params. It would also help if you included the complete url query you used.

[Makanist]

I have exactly the same problem even after having read:audit_log permission on my token. Is it becasue of not having any repos on the organization?

[lghakamo-almaco]

I was investigating the same issue in relation to getting organization audit logs into Wazuh and the resolution is apparently to move to GitHub Enterprise tier :(. See wazuh/wazuh#14964.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬