OAuth Access

actionDescriptionSampleRule
oauth_access.createAn OAuth access token was generated.YN
oauth_access.destroyAn OAuth access token was deleted.YN
oauth_access.regenerateAn OAuth access token was regenerated.YN
oauth_access.revokeAn OAuth access token was revoked.NN
oauth_access.updateAn OAuth access token was updated.NN

oauth_access.create

#
Category
oauth-access

Description

An OAuth access token was generated.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1777695697705,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMA==",
  "action": "oauth_access.create",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1777695697705,
  "hashed_token": null,
  "oauth_application_name": "GitHub CLI",
  "operation_type": "create",
  "request_access_security_header": null,
  "request_id": "E579:20CA55:468831B:476E0EC:69F57BCF",
  "token_id": 9300000007,
  "token_scopes": "gist,read:org,repo,workflow",
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0",
  "user_id": 9000002
}

References #

oauth_access.destroy

#
Category
oauth-access

Description

An OAuth access token was deleted.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1781214274718,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMQ==",
  "action": "oauth_access.destroy",
  "created_at": 1781214274718,
  "explanation": "stale",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQAAAAAAAAA=",
  "oauth_application_name": "Gist",
  "operation_type": "remove",
  "token_id": 9300000002,
  "token_scopes": "",
  "user": "user",
  "user_id": 9000002
}

References #

oauth_access.regenerate

#
Category
oauth-access

Description

An OAuth access token was regenerated.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1774594019596,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMg==",
  "action": "oauth_access.regenerate",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1774594019596,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMgAAAAAAAAA=",
  "oauth_application_name": "GitHub.dev Lightweight Web Editor",
  "operation_type": "modify",
  "request_access_security_header": null,
  "request_id": "D147:17A2E4:86F8A8:88D606:69C627E3",
  "token_id": 9300000005,
  "token_scopes": "codespace,read:user,repo,user:email,workflow",
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
  "user_id": 9000002
}

References #

oauth_access.revoke

#
Category
oauth-access

Description

An OAuth access token was revoked.

Documented on GitHub's user audit log reference.

oauth_access.update

#
Category
oauth-access

Description

An OAuth access token was updated.

Documented on GitHub's user audit log reference.