> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Organization Audit Logs

> Coming soon: read-only organization audit log analysis for GitHub Enterprise Cloud

# GitHub organization audit logs

**Coming soon.** GitHub audit log connections are not available yet. Planned support covers membership, repository-setting and permission changes in a verified organization. Flare’s [PR security check](/pr-security-check) and other GitHub Actions integrations are available today and are separate from this connector.

## What Flare reads

Flare reads **organization web audit events** through GitHub’s organization audit-log API. Git operations (such as clone, fetch and push), repository contents, personal security logs, enterprise-wide audit endpoints and GitHub Enterprise Server are excluded.

## Before connecting

Use an **organization owner** in **GitHub Enterprise Cloud**. This connector does not claim full audit API access for GitHub Free or Team. Know the organization name from its GitHub URL, such as `your-organization`; do not enter a repository or personal account.

The OAuth application requests `read:audit_log` and `offline_access` for read-only audit access and token renewal when the provider issues refresh tokens. Your organization’s OAuth-app restrictions and SAML SSO policies may require an owner’s separate approval or authorization. Follow your organization’s policy.

## Setup when access is enabled

These steps apply only when GitHub access is enabled for your account. Until then, Connectors shows **Coming soon**.

1. Open [Connectors](https://tryflare.ai/connectors?audit_provider=github) and select **GitHub**.
2. Enter the organization name and choose **Connect GitHub**.
3. Sign in as the intended organization owner, review the requested access and authorize it through your organization’s permitted flow.
4. Confirm the organization name and ID shown by Flare. Flare checks audit access before saving the connection.
5. Choose **Run an analysis**, name the run, select a window and inspect the **GitHub audit coverage** panel beside the findings.

The immutable organization ID is bound to the connection. A changed name or identity must be verified through reconnect; Flare will reject a mismatched account.

## Availability and limits

GitHub audit log analysis is coming soon. New connections and analyses are unavailable while this source is disabled. Existing saved results and disconnect remain accessible. Each account supports one connection per provider; reconnecting replaces that provider’s connection when access is enabled.

Choose a window of up to 30 days. A run retains up to 1,000 unique in-window provider records for analysis across the selected streams. Provider requests have separate page, byte and time limits and may read additional duplicate or out-of-window records. The coverage panel reports the streams read and whether collection was truncated. Available history and reporting delays depend on the provider. An empty result means no events were observed in this query, not that the account had no activity or risk.

Only manual runs are supported for this source. Scheduled runs, deploy webhooks and file uploads under this source label are unavailable. Existing GitHub Actions integrations are separate features, not an audit-log collector.

## Troubleshooting

| What you see          | Next step                                                                                                  |
| --------------------- | ---------------------------------------------------------------------------------------------------------- |
| Coming soon           | No setup is needed yet. Review the planned coverage above. Saved results and disconnect remain accessible. |
| Access denied         | Confirm provider permissions, organization policy and subscription requirements, then reconnect.           |
| Scope mismatch        | Sign into the account for the customer or organization entered in Flare. Reconnect to change scope.        |
| No events             | Confirm scope and timestamps, allow for provider reporting delay and try a different window.               |
| Limited coverage      | Read the coverage panel; shorten the window to reduce truncation.                                          |
| Rate limited          | Wait before retrying; avoid repeatedly starting new runs.                                                  |
| Authorization expired | Reconnect. If permissions were removed, restore them with your administrator first.                        |
| Connection changed    | Another reconnect or disconnect superseded this run. Start a fresh analysis.                               |

## Disconnect and deletion

Disconnect removes the encrypted credentials stored in Flare and cancels pending authorization attempts. Existing analyses, selected supporting excerpts and follow-up conversations remain available until deleted. Disconnect is separate from provider-side revocation: remove Flare’s access in the provider’s application settings as well if you want to revoke the grant.

Flare projects supported audit metadata before analysis. Selected fields are processed by the AI model; results, selected evidence and frequency baselines support later investigation. Full message, file or repository contents are not collected by these connectors. Review [Privacy](https://tryflare.ai/privacy) or request account deletion through [Support](https://tryflare.ai/support). Never send passwords, OAuth tokens or authorization codes to Support.

## Provider references

[GitHub organization audit-log REST API](https://docs.github.com/en/enterprise-cloud%40latest/rest/orgs/orgs?apiVersion=2026-03-10#get-the-audit-log-for-an-organization) · [Review organization audit logs](https://docs.github.com/en/enterprise-cloud%40latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization)