Audit event schema and examples

Audit event schema

History

Audit events have a predictable schema in the body of the response.

FieldDescriptionNotesStreaming Only Field
author_idUser ID of the user who triggered the eventdotted-circle No
author_nameHuman-readable name of the author that triggered the eventHelpful when the author no longer existscheck-circle Yes
created_atTimestamp when event was triggereddotted-circle No
detailsJSON object containing additional metadataHas no defined schema but often contains additional information about an eventdotted-circle No
entity_idID of the audit event’s entitydotted-circle No
entity_pathFull path of the entity affected by the auditable eventcheck-circle Yes
entity_typeString representation of the type of entityAcceptable values include User, Group, and Key. This list is not exhaustivedotted-circle No
event_typeString representation of the type of audit eventcheck-circle Yes
idUnique identifier for the audit eventCan be used for deduplication if requireddotted-circle No
ip_addressIP address of the host used to trigger the eventcheck-circle Yes
target_detailsAdditional details about the targetcheck-circle Yes
target_idID of the audit event’s targetcheck-circle Yes
target_typeString representation of the target’s typecheck-circle Yes

Audit event JSON schema

{
  "properties": {
    "id": {
      "type": "string"
    },
    "author_id": {
      "type": "integer"
    },
    "author_name": {
      "type": "string"
    },
    "details": {},
    "ip_address": {
      "type": "string"
    },
    "entity_id": {
      "type": "integer"
    },
    "entity_path": {
      "type": "string"
    },
    "entity_type": {
      "type": "string"
    },
    "event_type": {
      "type": "string"
    },
    "target_id": {
      "type": "integer"
    },
    "target_type": {
      "type": "string"
    },
    "target_details": {
      "type": "string"
    },
  },
  "type": "object"
}

Headers

History

Headers are formatted as follows:

POST /logs HTTP/1.1
Host: <DESTINATION_HOST>
Content-Type: application/x-www-form-urlencoded
X-Gitlab-Event-Streaming-Token: <DESTINATION_TOKEN>
X-Gitlab-Audit-Event-Type: repository_git_operation

Example: audit event streaming on Git operations

Streaming audit events can be sent when authenticated users push, pull, or clone a project’s remote Git repositories:

  • Using SSH.
  • Using HTTP or HTTPS.
  • Using Download ( download ) in GitLab UI.

Audit events are not captured for users that are not signed in. For example, when downloading a public project.

Example: audit event payloads for Git over SSH events with deploy key

Fetch:

{
  "id": "1",
  "author_id": -3,
  "entity_id": 29,
  "entity_type": "Project",
  "details": {
    "author_name": "deploy-key-name",
    "author_class": "DeployKey",
    "target_id": 29,
    "target_type": "Project",
    "target_details": "example-project",
    "custom_message": {
      "protocol": "ssh",
      "action": "git-upload-pack"
    },
    "ip_address": "127.0.0.1",
    "entity_path": "example-group/example-project"
  },
  "ip_address": "127.0.0.1",
  "author_name": "deploy-key-name",
  "entity_path": "example-group/example-project",
  "target_details": "example-project",
  "created_at": "2022-07-26T05:43:53.662Z",
  "target_type": "Project",
  "target_id": 29,
  "event_type": "repository_git_operation"
}