OAuth Authorization

action	Description	Sample	Rule
oauth_authorization.create	An authorization for an OAuth application was created.	Y	N
oauth_authorization.destroy	An authorization for an OAuth application was deleted.	N	N
oauth_authorization.update	An authorization for an OAuth application was updated.	Y	N

oauth_authorization.create

Category: oauth-authorization

Description

An authorization for an OAuth application was created.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1774594019579,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMw==",
  "action": "oauth_authorization.create",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1774594019579,
  "oauth_application_name": "GitHub.dev Lightweight Web Editor",
  "operation_type": "create",
  "request_access_security_header": null,
  "request_id": "D147:17A2E4:86F8A8:88D606:69C627E3",
  "token_scopes": "codespace,read:user,repo,user:email,workflow",
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
  "user_id": 9000002
}

oauth_authorization.destroy

Category: oauth-authorization

Description

An authorization for an OAuth application was deleted.

Documented on GitHub's user audit log reference.

oauth_authorization.update

Category: oauth-authorization

Description

An authorization for an OAuth application was updated.

Documented on GitHub's user audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1772315603240,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxNA==",
  "action": "oauth_authorization.update",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1772315603240,
  "oauth_application_name": "GitHub CLI",
  "operation_type": "modify",
  "request_access_security_header": null,
  "request_id": "D1CE:202D44:11357E5:152FE38:69A363D0",
  "token_scopes": "admin:public_key,gist,read:org,repo,workflow",
  "user": "user",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0",
  "user_id": 9000002
}