Audit event types

  • Tier: Premium, Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
History

Audit event types are used to filter streamed audit events:

Every audit event is associated with an event type. Audit event types can allow:

  • Most audit events to be saved to the database. Available in the Premium and Ultimate tier. You can retrieve audit events associated with these types by using the audit events dashboard or the audit events API.
  • All audit events to be streamed to external destinations. Available in the Ultimate tier. You can stream audit events associated with these types to external destinations if a destination is set.

An audit event type’s scope limits the availability of the audit event type to either:

Available audit event types

Audit event types belong to the following product categories.

Ai framework

Type nameEvent triggered whenSaved to databaseIntroduced inScope
duo_features_enabled_updatedGitLab Duo Features enabled setting on group or project changedcheck-circle YesGitLab 16.10Group, Project
q_onbarding_updatedAmazon Q instance settings changedcheck-circle YesGitLab 17.8Instance

Audit events

Type nameEvent triggered whenSaved to databaseIntroduced inScope
amazon_s3_configuration_createdAmazon S3 configuration for audit events streaming is createdcheck-circle YesGitLab 16.5Group
amazon_s3_configuration_deletedAmazon S3 configuration for audit events streaming is deletedcheck-circle YesGitLab 16.5Group
amazon_s3_configuration_updatedAmazon S3 configuration for audit events streaming is updatedcheck-circle YesGitLab 16.5Group
audit_events_streaming_headers_createA streaming header for audit events is createdcheck-circle YesGitLab 15.3Group
audit_events_streaming_headers_destroyA streaming header for audit events is deletedcheck-circle YesGitLab 15.3Group
audit_events_streaming_instance_headers_createA streaming header for instance level external audit event destination is createdcheck-circle YesGitLab 16.3Instance
audit_events_streaming_instance_headers_destroyA streaming header for instance level external audit event destination is deletedcheck-circle YesGitLab 16.3Instance
audit_events_streaming_instance_headers_updateA streaming header for instance level external audit event destination is updatedcheck-circle YesGitLab 16.3Instance
create_event_streaming_destinationAn external audit event destination is createdcheck-circle YesGitLab 14.6Group
create_http_namespace_filterA namespace filter for an external audit event destination for a top-level group is createdcheck-circle YesGitLab 16.6Group
create_instance_event_streaming_destinationAn external audit event destination for an instance is createdcheck-circle YesGitLab 16.2Instance
created_group_audit_event_streaming_destinationAn external audit event destination for a top-level group is createdcheck-circle YesGitLab 16.11Group
created_group_namespace_filterA namespace filter for an external audit event destination for a top-level group is createdcheck-circle YesGitLab 17.0Group
created_instance_audit_event_streaming_destinationAn external audit event destination for an instance is createdcheck-circle YesGitLab 16.11Instance
created_instance_namespace_filterA namespace filter for an external audit event destination for an instance is createdcheck-circle YesGitLab 17.2Instance
delete_http_namespace_filterA namespace filter for an external audit event destination for a top-level group is deletedcheck-circle YesGitLab 16.7Group
deleted_group_audit_event_streaming_destinationAn external audit event destination for a top-level group is deletedcheck-circle YesGitLab 16.11Group
deleted_group_namespace_filterA namespace filter for an external audit event destination for a top-level group is deletedcheck-circle YesGitLab 17.0Group
deleted_instance_audit_event_streaming_destinationAn external audit event destination for a GitLab instance is deletedcheck-circle YesGitLab 16.11Instance
deleted_instance_namespace_filterA namespace filter for an external audit event destination for a GitLab instance is deletedcheck-circle YesGitLab 17.2Instance
destroy_event_streaming_destinationAn external audit event destination is deletedcheck-circle YesGitLab 14.6Group
destroy_instance_event_streaming_destinationAn instance level external audit event destination is deletedcheck-circle YesGitLab 16.2Instance
event_type_filters_createdA new audit events streaming event type filter is createdcheck-circle YesGitLab 15.10Group
event_type_filters_deletedAn audit events streaming event type filter is deletedcheck-circle YesGitLab 15.10Group
google_cloud_logging_configuration_createdGoogle Cloud Logging configuration is createdcheck-circle YesGitLab 16.1Group
google_cloud_logging_configuration_deletedGoogle Cloud Logging configuration is deletedcheck-circle YesGitLab 16.1Group
google_cloud_logging_configuration_updatedGoogle Cloud Logging configuration is updatedcheck-circle YesGitLab 16.1Group
instance_amazon_s3_configuration_createdInstance Amazon S3 configuration for audit events streaming is createdcheck-circle YesGitLab 16.7Instance
instance_amazon_s3_configuration_deletedInstance-level Amazon S3 configuration for audit events streaming is deletedcheck-circle YesGitLab 16.7Instance
instance_amazon_s3_configuration_updatedInstance-level Amazon S3 configuration for audit events streaming is updatedcheck-circle YesGitLab 16.7Instance
instance_google_cloud_logging_configuration_createdInstance-level Google Cloud Logging configuration is createdcheck-circle YesGitLab 16.4Instance
instance_google_cloud_logging_configuration_deletedInstance-level Google Cloud Logging configuration is deletedcheck-circle YesGitLab 16.5Instance
instance_google_cloud_logging_configuration_updatedInstance-level Google Cloud Logging configuration is updatedcheck-circle YesGitLab 16.5Instance
update_event_streaming_destinationAn external audit event destination is updatedcheck-circle YesGitLab 14.6Group
update_instance_event_streaming_destinationAn instance level external audit event destination is updatedcheck-circle YesGitLab 16.2Instance
updated_group_audit_event_streaming_destinationAn external audit event destination for a top-level group is updatedcheck-circle YesGitLab 16.11Group
updated_instance_audit_event_streaming_destinationAn external audit event destination for a GitLab instance is updatedcheck-circle YesGitLab 16.11Instance

Authorization

Type nameEvent triggered whenSaved to databaseIntroduced inScope
secure_ci_job_token_policies_updatedPermissions are updated for a CI_JOB_TOKEN scopecheck-circle YesGitLab 17.6Project
user_authorized_oauth_applicationUser authorized an OAuth applicationcheck-circle YesGitLab 17.9User

Build artifacts

Type nameEvent triggered whenSaved to databaseIntroduced inScope
job_artifact_downloadedA user downloads a job artifact from a projectdotted-circle NoGitLab 16.8Project

Code review

Type nameEvent triggered whenSaved to databaseIntroduced inScope
delete_merge_requestA merge request is successfully deleteddotted-circle NoGitLab 15.4Project

Code review workflow

Type nameEvent triggered whenSaved to databaseIntroduced inScope
merge_request_approval_operationA merge request is approveddotted-circle NoGitLab 15.3Project
merge_request_closed_by_project_botA merge request is closed using a project access tokencheck-circle YesGitLab 16.1Project
merge_request_created_by_project_botA merge request is created using a project access tokencheck-circle YesGitLab 16.1Project
merge_request_invalid_approver_rulesAn invalid rule when merge request is approvedcheck-circle YesGitLab 15.5Project
merge_request_merged_by_project_botA merge request is merged using a project access tokencheck-circle YesGitLab 16.1Project
merge_request_reopened_by_project_botA merge request is reopened using a project access tokencheck-circle YesGitLab 16.1Project
project_merge_requests_template_updatedA merge request template for a project is updatedcheck-circle YesGitLab 15.0Project
project_remove_source_branch_after_merge_updatedA project has its setting to remove branches after merges updatedcheck-circle YesGitLab 14.10Project
project_reset_approvals_on_push_updatedA project has its setting on whether approvals are reset on a push is updatedcheck-circle YesGitLab 14.2Project
selective_code_owner_removals_updatedSelective code owner removal is updatedcheck-circle YesGitLab 17.0Project

Code suggestions

Type nameEvent triggered whenSaved to databaseIntroduced inScope
project_suggestion_commit_message_updatedA project has its suggested commit message updatedcheck-circle YesGitLab 14.10Project

Compliance management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
add_gpg_keyA GPG key is addedcheck-circle YesGitLab 15.9User
allow_author_approval_updatedPrevent approval by author setting is updatedcheck-circle YesGitLab 15.6Group
allow_committer_approval_updatedPrevent approvals by users who add commits setting is updatedcheck-circle YesGitLab 15.6Group
allow_overrides_to_approver_list_per_merge_request_updatedPrevent editing approval rules in projects and merge requests setting is updatedcheck-circle YesGitLab 15.6Group
audit_events_streaming_headers_updateA streaming header for audit events is updatedcheck-circle YesGitLab 15.3Group
compliance_framework_addedA compliance framework is applied to a projectcheck-circle YesGitLab 17.2Project
compliance_framework_deletedA compliance framework is removed from a projectcheck-circle YesGitLab 14.1Project
compliance_framework_id_updatedA compliance framework is updated for a projectcheck-circle YesGitLab 15.7Project
compliance_framework_removedA compliance framework is removed from a projectcheck-circle YesGitLab 17.2Project
create_compliance_frameworkA compliance framework is successfully createdcheck-circle YesGitLab 14.6Group
create_status_checkAn external status check is createdcheck-circle YesGitLab 15.9Project
created_compliance_requirementA requirement is added to a compliance frameworkcheck-circle YesGitLab 17.6Group
created_compliance_requirement_controlA control is added to a compliance requirement.check-circle YesGitLab 17.9Group
delete_status_checkAn external status check is deletedcheck-circle YesGitLab 15.9Project
destroy_compliance_frameworkA compliance framework is successfully deletedcheck-circle YesGitLab 14.6Group
destroyed_compliance_requirementA compliance framework requirement is destroyedcheck-circle YesGitLab 17.7Group
destroyed_compliance_requirement_controlA compliance requirement control is destroyed.check-circle YesGitLab 17.9Group
email_createdAn email is createdcheck-circle YesGitLab 15.11User
email_destroyedAn email is destroyedcheck-circle YesGitLab 15.11User
external_status_check_name_updatedThe name of an external status check is updatedcheck-circle YesGitLab 15.7Project
external_status_check_url_updatedThe URL that is used for external status checks for a pipeline is updatedcheck-circle YesGitLab 15.0Project
group_deletion_markedA group is marked for deletioncheck-circle YesGitLab 15.11Group
group_destroyedA group is destroyedcheck-circle YesGitLab 15.11Group
group_restoredA group is restoredcheck-circle YesGitLab 15.11Group
group_saml_provider_createA group SAML provider is createdcheck-circle YesGitLab 15.9Group
group_saml_provider_updateA group SAML provider is updatedcheck-circle YesGitLab 15.9Group
inactive_project_scheduled_for_deletionAn inactive project is scheduled for deletioncheck-circle YesGitLab 16.4Project
member_createdA membership is createdcheck-circle YesGitLab 15.9Group, Project
member_destroyedA membership is destroyedcheck-circle YesGitLab 15.9Group, Project
member_updatedA membership is updatedcheck-circle YesGitLab 15.9Group, Project
merge_request_createA merge request is createddotted-circle NoGitLab 15.9Project
merge_request_mergedA merge request is mergedcheck-circle YesGitLab 17.5Project
omniauth_login_failedAn OmniAuth login failscheck-circle YesGitLab 16.3User
password_reset_requestedA user requests a password reset using a registered email addresscheck-circle YesGitLab 15.11User
pending_compliance_external_control_failedA project’s compliance external control status is updated to fail because of timeout.check-circle YesGitLab 17.9Project
personal_access_token_createdA user creates a personal access tokencheck-circle YesGitLab 15.9User
personal_access_token_revokedA personal access token is revokedcheck-circle YesGitLab 15.9User
project_archivedA project is archivedcheck-circle YesGitLab 15.11Project
project_deletion_markedA project is marked for deletioncheck-circle YesGitLab 15.11Project
project_destroyedA project is destroyedcheck-circle YesGitLab 15.11Group
project_export_file_download_startedA download of a project export file is startedcheck-circle YesGitLab 15.11Project
project_group_link_createdA group is invited to a projectcheck-circle YesGitLab 15.9Group
project_group_link_deletedA project group link is deletedcheck-circle YesGitLab 15.9Group
project_group_link_updatedA project group link is updatedcheck-circle YesGitLab 15.9Project
project_importedA project is importedcheck-circle YesGitLab 15.11Group
project_restoredA project is restoredcheck-circle YesGitLab 15.11Project
project_topics_updatedA project’s topics assignments are changedcheck-circle YesGitLab 17.4Project
project_unarchivedA project is unarchivedcheck-circle YesGitLab 15.11Project
protected_branch_allow_force_push_updatedA protected branch has its ability to allow force pushes is updatedcheck-circle YesGitLab 14.3Project
public_repository_download_operationA Git repository for a public project is downloadeddotted-circle NoGitLab 17.0Project
registration_createdA user registers for instance accesscheck-circle YesGitLab 16.3User
release_createdA release is createdcheck-circle YesGitLab 15.9Project
release_deleted_audit_eventA release is deletedcheck-circle YesGitLab 15.9Project
release_milestones_updatedA release’s associated milestones are updatedcheck-circle YesGitLab 15.9Project
release_updatedA release is updatedcheck-circle YesGitLab 15.9Project
remove_gpg_keyA GPG key is deletedcheck-circle YesGitLab 15.9User
repository_download_operationA Git repository for a private or internal project is downloadedcheck-circle YesGitLab 15.9Project
request_to_compliance_external_control_failedRequest to compliance external control failedcheck-circle YesGitLab 17.9Project
request_to_compliance_external_control_successfulRequest to compliance external control successfuldotted-circle NoGitLab 17.9Project
require_password_to_approve_updatedRequire user password for approvals from group merge request setting is updatedcheck-circle YesGitLab 15.6Group
retain_approvals_on_push_updatedRequire new approvals when new commits are added to an MR from group merge request setting is updatedcheck-circle YesGitLab 15.6Group
saml_group_links_createdA SAML Group Link is createdcheck-circle YesGitLab 15.9Group
saml_group_links_removedA SAML Group Link is removedcheck-circle YesGitLab 15.9Group
smartcard_authentication_createdA user authenticates with smartcardcheck-circle YesGitLab 16.0User
update_approval_rulesUpdating a merge approval rulecheck-circle YesGitLab 15.2Project
update_compliance_frameworkA compliance framework is updatedcheck-circle YesGitLab 14.6Group
update_compliance_requirementA compliance framework requirement is updated.check-circle YesGitLab 17.7Group
update_status_checkAn external status check is updatedcheck-circle YesGitLab 15.9Project
updated_compliance_requirement_controlCompliance requirement control updated.check-circle YesGitLab 17.9Group

Container registry

Type nameEvent triggered whenSaved to databaseIntroduced inScope
container_repository_createdA container repository is first pushed to the registrycheck-circle YesGitLab 17.5Project
container_repository_deletedA project’s container registry is deletedcheck-circle YesGitLab 17.2Project
container_repository_deletion_markedA project’s container repository is marked for deletioncheck-circle YesGitLab 17.2Project
container_repository_tags_deletedA project’s container repository tag is deletedcheck-circle YesGitLab 17.2Project

Continuous-integration

Type nameEvent triggered whenSaved to databaseIntroduced inScope
multi_project_downstream_pipeline_createdMulti project downstream pipeline is createddotted-circle NoGitLab 17.6Project

Continuous delivery

Type nameEvent triggered whenSaved to databaseIntroduced inScope
deploy_key_addedA deploy key is addedcheck-circle YesGitLab 15.3Project
deploy_key_removedA deploy key is removedcheck-circle YesGitLab 15.3Project
deploy_token_createdA deploy token is createdcheck-circle YesGitLab 15.1Project
deploy_token_creation_failedA deploy token fails to createcheck-circle YesGitLab 15.1Project
deploy_token_destroyedA deploy token is destroyedcheck-circle YesGitLab 15.1Project
deploy_token_revokedA project deploy token is revokedcheck-circle YesGitLab 15.1Project
deployment_approvedA deployment is approvedcheck-circle YesGitLab 17.1Project
deployment_rejectedA deployment is rejectedcheck-circle YesGitLab 17.1Project
deployment_startedA deployment to a protected environment is startedcheck-circle YesGitLab 17.2Project
group_deploy_token_createdA group deploy token is createdcheck-circle YesGitLab 15.3Group
group_deploy_token_creation_failedCreating a group deploy token failedcheck-circle YesGitLab 15.3Group
group_deploy_token_destroyedA group deploy token is destroyedcheck-circle YesGitLab 15.3Group
group_deploy_token_revokedA group deploy token is revokedcheck-circle YesGitLab 15.3Group

Continuous integration

Type nameEvent triggered whenSaved to databaseIntroduced inScope
allow_merge_on_skipped_pipeline_updatedSkipped pipelines are considered successful setting is updatedcheck-circle YesGitLab 14.10Project
ci_group_variable_createdA CI/CD variable is created for a groupcheck-circle YesGitLab 15.2Group
ci_group_variable_deletedA CI/CD variable is deleted for a groupcheck-circle YesGitLab 15.2Group
ci_group_variable_updatedA CI/CD variable is updated for a groupcheck-circle YesGitLab 15.2Group
ci_instance_variable_createdA CI/CD variable is created for an instancecheck-circle YesGitLab 16.5Instance
ci_instance_variable_deletedA CI/CD variable is deleted for an instancecheck-circle YesGitLab 16.5Instance
ci_instance_variable_updatedA CI/CD variable is updated for an instancecheck-circle YesGitLab 16.5Instance
ci_variable_createdA CI/CD variable is created for a projectcheck-circle YesGitLab 15.2Project
ci_variable_deletedA CI/CD variable is deleted for a projectcheck-circle YesGitLab 15.2Project
ci_variable_updatedA CI/CD variable is updated for a projectcheck-circle YesGitLab 15.2Project
destroy_pipelineA pipeline is deletedcheck-circle YesGitLab 16.6Project

Deployment management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
cluster_agent_create_failedA user attempts to create a cluster agent but it failedcheck-circle YesGitLab 17.3Project
cluster_agent_createdA user creates a cluster agentcheck-circle YesGitLab 17.3Project
cluster_agent_delete_failedA user attempts to delete a cluster agent but it failedcheck-circle YesGitLab 17.3Project
cluster_agent_deletedA user deletes a cluster agentcheck-circle YesGitLab 17.3Project
cluster_agent_token_createdA user creates a cluster agent tokencheck-circle YesGitLab 15.10Project
cluster_agent_token_revokedA user revokes a cluster agent tokencheck-circle YesGitLab 15.10Project

Duo workflow

Type nameEvent triggered whenSaved to databaseIntroduced inScope
api_request_access_with_scopeA susbset of API requests authenticated by a token with an audited scopecheck-circle YesGitLab 17.7User

Dynamic application security testing

Type nameEvent triggered whenSaved to databaseIntroduced inScope
dast_profile_createA dynamic application security testing profile is createdcheck-circle YesGitLab 14.1Project
dast_profile_destroyA dynamic application security profile is removedcheck-circle YesGitLab 14.1Project
dast_profile_schedule_createA dynamic application security testing profile schedule is createdcheck-circle YesGitLab 14.3Project
dast_profile_schedule_updateA dynamic application security testing profile schedule is updatedcheck-circle YesGitLab 14.3Project
dast_profile_updateA dynamic application security profile is updatedcheck-circle YesGitLab 14.1Project
dast_scanner_profile_createA dynamic application security testing scanner profile is createdcheck-circle YesGitLab 14.0Project
dast_scanner_profile_destroyA dynamic application security testing scanner profile is removedcheck-circle YesGitLab 14.0Project
dast_scanner_profile_updateA dynamic application security testing scanner profile is updatedcheck-circle YesGitLab 14.0Project
dast_site_profile_createA dynamic application security testing site profile is createdcheck-circle YesGitLab 14.0Project
dast_site_profile_destroyA dynamic application security testing site profile is removedcheck-circle YesGitLab 14.0Project
dast_site_profile_updateA dynamic application security testing site profile is updatedcheck-circle YesGitLab 14.0Project

Environment management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
environment_protectedA protected environment is createdcheck-circle YesGitLab 15.8Group, Project
environment_unprotectedA protected environment is unprotectedcheck-circle YesGitLab 15.8Group, Project
protected_environment_approval_rule_addedAn approval rule is added to a protected environmentcheck-circle YesGitLab 16.5Group, Project
protected_environment_approval_rule_deletedAn approval rule is removed from a protected environmentcheck-circle YesGitLab 16.5Project, Group
protected_environment_approval_rule_updatedAn approval rule of a protected environment is updatedcheck-circle YesGitLab 16.5Project, Group
protected_environment_deploy_access_level_addedA deploy access level is added to a protected environmentcheck-circle YesGitLab 16.5Group, Project
protected_environment_deploy_access_level_deletedA deploy access level is removed from a protected environmentcheck-circle YesGitLab 16.5Group, Project
protected_environment_deploy_access_level_updatedA deploy access level of a protected environment is updatedcheck-circle YesGitLab 16.5Project
protected_environment_updatedA protected environment is updatedcheck-circle YesGitLab 16.5Group, Project

Feature flags

Type nameEvent triggered whenSaved to databaseIntroduced inScope
feature_flag_createdA feature flag is createdcheck-circle YesGitLab 15.10Project
feature_flag_deletedA feature flag is deletedcheck-circle YesGitLab 15.10Project
feature_flag_updatedA feature flag is updatedcheck-circle YesGitLab 15.10Project

Fleet visibility

Type nameEvent triggered whenSaved to databaseIntroduced inScope
ci_runner_createdTriggered when a runner is createdcheck-circle YesGitLab 17.8Instance, Group, Project
ci_runner_usage_exportA runner usage report is generatedcheck-circle YesGitLab 16.8Instance
ci_runners_bulk_deletedRunners are deleted in bulkcheck-circle YesGitLab 17.7User

Fuzz testing

Type nameEvent triggered whenSaved to databaseIntroduced inScope
coverage_fuzzing_corpus_createA corpus action is addedcheck-circle YesGitLab 14.5Project

Groups and projects

Type nameEvent triggered whenSaved to databaseIntroduced inScope
allow_mfa_for_subgroups_updatedSetting for Subgroups can set up their own two-factor authentication rules updatedcheck-circle YesGitLab 17.4Group
allow_runner_registration_token_updatedSetting Allow members of projects and groups to create runners with runner registration tokens is updatedcheck-circle YesGitLab 16.0Group, Project
allowed_email_domain_updatedGroup setting allowed email domain entry is updatedcheck-circle YesGitLab 17.5Group
create_ssh_certificateAn SSH certificate is createdcheck-circle YesGitLab 16.6Group
default_branch_name_updatedDefault branch name for the group repository is changedcheck-circle YesGitLab 17.4Group
delete_ssh_certificateAn SSH certificate is deletedcheck-circle YesGitLab 16.6Group
disable_personal_access_tokens_updatedSetting Disable personal access tokens is updatedcheck-circle YesGitLab 17.4Group
emails_enabled_updatedSetting Enable email notifications is updatedcheck-circle YesGitLab 17.4Group
enabled_git_access_protocol_updatedSetting Enabled Git access protocols is updatedcheck-circle YesGitLab 17.4Group
enforce_ssh_certificates_updatedSetting Enforce SSH Certificates is updatedcheck-circle YesGitLab 17.4Group
group_createdA group is createdcheck-circle YesGitLab 16.3Group
group_description_updatedGroup description is updatedcheck-circle YesGitLab 17.4Group
group_lfs_enabled_updatedLFS enabled for a group is updatedcheck-circle YesGitLab 15.7Group
group_membership_lock_updatedMembership lock for a group is updatedcheck-circle YesGitLab 15.7Group
group_mentions_disabled_updatedA group’s setting to notify group members on group mention is updatedcheck-circle YesGitLab 17.4Group
group_merge_request_approval_setting_createdMerge request approval settings are added to a groupcheck-circle YesGitLab 15.1Group
group_name_updatedA group’s name is updatedcheck-circle YesGitLab 15.7Group
group_path_updatedA group’s path is updatedcheck-circle YesGitLab 15.7Group
group_project_creation_level_updatedA group’s project creation level is updatedcheck-circle YesGitLab 15.7Group
group_repository_size_limit_updatedA group’s repository size limit is updatedcheck-circle YesGitLab 15.7Group
group_request_access_enabled_updatedA group’s request access enabled is updatedcheck-circle YesGitLab 15.7Group
group_require_two_factor_authentication_updatedA group’s require two factor authentication setting is updatedcheck-circle YesGitLab 15.7Group
group_share_with_group_link_createdYou invite a group to another group by using the group’s membership pagecheck-circle YesGitLab 15.10Group
group_share_with_group_link_removedYou remove a group from another group by using the group’s membership pagecheck-circle YesGitLab 15.10Group
group_share_with_group_link_updatedYou update a group’s access settings to another group by using the group’s membership pagecheck-circle YesGitLab 15.10Group
group_shared_runners_minutes_limit_updatedA group’s shared runners minutes limit is updatedcheck-circle YesGitLab 15.7Group
group_shared_with_group_lock_updatedGroup can be shared with other group setting is updatedcheck-circle YesGitLab 17.4Group
group_two_factor_grace_period_updatedA group’s two factor grace period is updatedcheck-circle YesGitLab 15.7Group
group_visibility_level_updatedA group’s visibility level is updatedcheck-circle YesGitLab 15.7Group
merge_commit_template_updatedMerge commit template is updatedcheck-circle YesGitLab 15.8Project
new_user_signups_cap_updatedSetting Number of users for user cap is updatedcheck-circle YesGitLab 17.4Group
prevent_forking_outside_group_updatedSetting for Prevent forking outside current group is changedcheck-circle YesGitLab 17.4Group
prevent_sharing_groups_outside_hierarchy_updatedA group’s setting to Members cannot invite groups outside of group and its subgroup updatedcheck-circle YesGitLab 17.4Group
project_cicd_merge_pipelines_enabled_updatedThe CI/CD merge pipelines setting for a project is updatedcheck-circle YesGitLab 15.8Project
project_cicd_merge_trains_enabled_updatedThe CI/CD merge trains settings for a project is updatedcheck-circle YesGitLab 15.8Project
project_createdA project is createdcheck-circle YesGitLab 16.0Project
project_default_branch_updatedDefault branch of a project’s repository is updatedcheck-circle YesGitLab 16.0Project
project_description_updatedA project’s description is updateddotted-circle NoGitLab 16.3Project
project_disable_overriding_approvers_per_merge_request_updatedThe disable overriding approvers per MR setting for a project is updatedcheck-circle YesGitLab 15.7Project
project_feature_analytics_access_level_updatedA project’s analytics access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_builds_access_level_updatedA project’s builds access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_container_registry_access_level_updatedA project’s container registry access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_environments_access_level_updatedA project’s environments access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_feature_flags_access_level_updatedA project’s feature flags access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_forking_access_level_updatedA project’s feature forking access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_infrastructure_access_level_updatedA project’s infrastructure access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_issues_access_level_updatedA project’s issues access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_merge_requests_access_level_updatedA project’s merge request access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_metrics_dashboard_access_level_updatedA project’s metrics dashboard access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_monitor_access_level_updatedA project’s monitor access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_operations_access_level_updatedA project’s operation access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_package_registry_access_level_updatedA project’s package registry access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_pages_access_level_updatedA project’s page access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_releases_access_level_updatedA project’s releases access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_repository_access_level_updatedA project’s repository access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_requirements_access_level_updatedA project’s requirements access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_security_and_compliance_access_level_updatedA project’s security and compliance access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_snippets_access_level_updatedA project’s snippet access level setting is updatedcheck-circle YesGitLab 15.7Project
project_feature_wiki_access_level_updatedA project’s wiki access level setting is updatedcheck-circle YesGitLab 15.7Project
project_merge_method_updatedA project’s merge request method is updatedcheck-circle YesGitLab 14.10Project
project_merge_requests_author_approval_updatedA project’s MR author approval setting is updatedcheck-circle YesGitLab 15.7Project
project_merge_requests_disable_committers_approval_updatedA project’s setting for disabling committers approval on merge requests is updatedcheck-circle YesGitLab 15.7Project
project_name_updatedA project has its name updatedcheck-circle YesGitLab 10.2Project
project_namespace_updatedA project’s namespace is updatedcheck-circle YesGitLab 15.7Project
project_only_allow_merge_if_all_discussions_are_resolved_updatedA project’s setting for allowing merge only when all discussions are resolved is updatedcheck-circle YesGitLab 15.7Project
project_only_allow_merge_if_pipeline_succeeds_updatedA project’s only allow merge if pipeline succeeds setting is updatedcheck-circle YesGitLab 15.7Project
project_packages_enabled_updatedThe setting that controls packages for a project is updatedcheck-circle YesGitLab 11.5Project
project_path_updatedA project’s path is updatedcheck-circle YesGitLab 15.5Project
project_printing_merge_request_link_enabled_updatedThe setting for projects for enabling printing merge request link is updatedcheck-circle YesGitLab 15.7Project
project_repository_size_limit_updatedThe repository size limit of a project is updatedcheck-circle YesGitLab 15.7Project
project_require_password_to_approve_updatedA project’s setting for requiring a user’s password for approval of merge request is updatedcheck-circle YesGitLab 15.7Project
project_resolve_outdated_diff_discussions_updatedA project’s resolve outdated diff discussions setting is updatedcheck-circle YesGitLab 15.7Project
project_security_setting_updatedA project’s security setting is updatedcheck-circle YesGitLab 17.0Project
project_visibility_level_updatedA project’s visibility level setting is updatedcheck-circle YesGitLab 15.7Project
remove_dormant_members_period_updatedSetting Days of inactivity before removal is updatedcheck-circle YesGitLab 17.4Group
remove_dormant_members_updatedSetting Dormant members is updatedcheck-circle YesGitLab 17.4Group
resource_access_token_creation_allowed_updatedSetting for Users can create project access tokens and group access tokens in this group is updatedcheck-circle YesGitLab 17.4Group, Project
runner_registration_enabled_updatedSetting Runner registration is updatedcheck-circle YesGitLab 17.4Group
seat_control_updatedSetting Seat control is updatedcheck-circle YesGitLab 17.4Group
service_access_tokens_expiration_enforced_updatedSetting Service account token expiration is updatedcheck-circle YesGitLab 17.4Group
show_diff_preview_in_email_updatedSetting Email notification to include diff preview is updatedcheck-circle YesGitLab 17.4Group, Project
squash_commit_template_updatedThe merge request squash commit template for a project is updatedcheck-circle YesGitLab 15.8Project
squash_option_updatedSquash option setting is updatedcheck-circle YesGitLab 15.0Project

Importers

Type nameEvent triggered whenSaved to databaseIntroduced inScope
group_export_createdA group file export is createdcheck-circle YesGitLab 17.0Group
project_export_createdA project file export is createdcheck-circle YesGitLab 17.0Project

Incident management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
incident_closed_by_project_botAn incident is closed using a project access tokencheck-circle YesGitLab 16.1Project
incident_created_by_project_botAn incident is created using a project access tokencheck-circle YesGitLab 16.1Project
incident_reopened_by_project_botAn incident is reopened using a project access tokencheck-circle YesGitLab 16.1Project

MLOps

Type nameEvent triggered whenSaved to databaseIntroduced inScope
project_feature_model_experiments_access_level_updatedA project’s model experiments access level is updatedcheck-circle YesGitLab 16.1Project
ml_model_createdML model is createdcheck-circle YesGitLab 17.4Project
ml_model_destroyedML model destroyedcheck-circle YesGitLab 17.4Project
ml_model_version_createdML model version is createdcheck-circle YesGitLab 17.4Project
ml_model_version_destroyedML model version destroyedcheck-circle YesGitLab 17.4Project
project_feature_model_registry_access_level_updatedModel registry access level was updatedcheck-circle YesGitLab 16.7Project

Not categorized

Type nameEvent triggered whenSaved to databaseIntroduced inScope
experiment_features_enabled_updatedEnabling experiment AI features setting is toggledcheck-circle YesGitLab 16.0Group

Package registry

Type nameEvent triggered whenSaved to databaseIntroduced inScope
package_registry_package_deletedA package was deleted from GitLab package registry. Available only when the feature flag package_registry_audit_events is enabled.check-circle YesGitLab 17.10Project, Group
package_registry_package_publishedA package was published to GitLab package registry. Available only when the feature flag package_registry_audit_events is enabled.check-circle YesGitLab 17.9Project, Group

Permissions

Type nameEvent triggered whenSaved to databaseIntroduced inScope
member_role_createdA custom role is createdcheck-circle YesGitLab 16.7Group, Instance
member_role_deletedA custom role is deletedcheck-circle YesGitLab 16.9Group, Instance
member_role_updatedA custom role is updatedcheck-circle YesGitLab 16.9Group, Instance

Portfolio management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
delete_epicAn epic is successfully deleteddotted-circle NoGitLab 15.4Group
epic_closed_by_project_botAn epic is closed by a group access tokencheck-circle YesGitLab 16.1Group
epic_created_by_project_botAn epic is created by a group access tokencheck-circle YesGitLab 16.1Group
epic_reopened_by_project_botAn epic is reopened by a group access tokencheck-circle YesGitLab 16.1Group

Product analytics data management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
product_analytics_settings_updateProduct analytics settings are changedcheck-circle YesGitLab 17.1Project

Project

Type nameEvent triggered whenSaved to databaseIntroduced inScope
project_access_token_createdA project access token is createdcheck-circle YesGitLab 15.2Project
project_access_token_creation_failedCreating a project access token failscheck-circle YesGitLab 15.2Project
project_access_token_deletedA project access token is deletedcheck-circle YesGitLab 15.2Project
project_access_token_deletion_failedDeleting a project access token failscheck-circle YesGitLab 15.2Project

Quality management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
test_case_closed_by_project_botA test case is closed using a project access tokencheck-circle YesGitLab 16.1Project
test_case_created_by_project_botA test case is created using a project access tokencheck-circle YesGitLab 16.1Project
test_case_reopened_by_project_botA test case is reopened using a project access tokencheck-circle YesGitLab 16.1Project

Runner

Type nameEvent triggered whenSaved to databaseIntroduced inScope
ci_runner_assigned_to_projectA runner is assigned to a projectcheck-circle YesGitLab 14.9Project
ci_runner_registeredAn instance, group, or project runner is registeredcheck-circle YesGitLab 14.8Instance, Group, Project
ci_runner_token_resetA runner’s token is resetcheck-circle YesGitLab 15.0Instance, Group, Project
ci_runner_unassigned_from_projectA runner is unassigned from a projectcheck-circle YesGitLab 14.9Project
ci_runner_unregisteredAn instance, group, or project runner is unregisteredcheck-circle YesGitLab 14.9Instance, Group, Project
set_runner_associated_projectsAssociated projects are successfully assigned to a CI/CD runnercheck-circle YesGitLab 15.4Project

Secret detection

Type nameEvent triggered whenSaved to databaseIntroduced inScope
group_secret_push_protection_updatedSecret push protection is enabled or disabled for a group and its child groups and projects, except those projects specified as excludedcheck-circle YesGitLab 17.7Group
project_security_exclusion_appliedA project security exclusion is applied in one of the security scannerscheck-circle YesGitLab 17.6Project
project_security_exclusion_createdA project security exclusion is createdcheck-circle YesGitLab 17.5Project
project_security_exclusion_deletedA project security exclusion is deletedcheck-circle YesGitLab 17.5Project
project_security_exclusion_updatedA project security exclusion is updatedcheck-circle YesGitLab 17.5Project
skip_secret_push_protectionSecret push protection is skipped by the usercheck-circle YesGitLab 16.11Project

Secrets management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
user_authenticated_using_job_tokenA user is authenticated using job tokendotted-circle NoGitLab 17.4Project

Security policy management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
policy_project_updatedThe security policy project is updated for a projectcheck-circle YesGitLab 15.6Group, Project

Self-hosted models

Type nameEvent triggered whenSaved to databaseIntroduced inScope
self_hosted_model_createdA new self-hosted model configuration was addedcheck-circle YesGitLab 17.4Instance
self_hosted_model_destroyedA new self-hosted model configuration was destroyedcheck-circle YesGitLab 17.4Instance
self_hosted_model_feature_changedA self-hosted model feature had its configuration changedcheck-circle YesGitLab 17.4Instance
self_hosted_model_terms_acceptedTerms for usage of self-hosted models were acceptedcheck-circle YesGitLab 17.4Instance
self_hosted_model_updatedA self-hosted model configuration was updatedcheck-circle YesGitLab 17.4Instance

Source code management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
approval_rule_createdA merge request approval rule is createdcheck-circle YesGitLab 15.2Project
approval_rule_deletedA merge request approval rule is deletedcheck-circle YesGitLab 14.9Project
group_push_rules_author_email_regex_updatedA group’s push rules settings is changed for author email regexcheck-circle YesGitLab 15.7Group
group_push_rules_branch_name_regex_updatedA group’s push rules settings is changed for branch name regexcheck-circle YesGitLab 15.7Group
group_push_rules_commit_committer_check_updatedA group’s push rule setting is updated for reject unverified userscheck-circle YesGitLab 15.0Group
group_push_rules_commit_message_negative_regex_updatedA group’s push rules settings is changed for commit message negative regexcheck-circle YesGitLab 15.7Group
group_push_rules_commit_message_regex_updatedA group’s push rules settings is changed for commit message regexcheck-circle YesGitLab 15.7Group
group_push_rules_file_name_regex_updatedA group’s push rules settings is changed for filename regexcheck-circle YesGitLab 15.7Group
group_push_rules_max_file_size_updatedA group’s push rules settings is changed for max file sizecheck-circle YesGitLab 15.7Group
group_push_rules_prevent_secrets_updatedA group’s push rule setting is updated to prevent pushing secret filescheck-circle YesGitLab 15.0Group
group_push_rules_reject_deny_delete_tag_updatedA group’s push rule setting is updated to deny deletion of tags using Git pushcheck-circle YesGitLab 15.0Group
group_push_rules_reject_member_check_updatedA group’s push rule setting is updated to check if commit author is a GitLab usercheck-circle YesGitLab 15.0Group
group_push_rules_reject_non_dco_commits_updatedA group’s push rule setting is updated for reject non DCO certified commitscheck-circle YesGitLab 15.0Group
group_push_rules_reject_unsigned_commits_updatedA group push’s rule setting is updated for reject unsigned commitscheck-circle YesGitLab 15.0Group
merged_merge_request_deletedA merged merge request is deleteddotted-circle NoGitLab 16.0Project
merged_merge_request_deletion_startedA merged merge request’s deletion is starteddotted-circle NoGitLab 16.1Project
project_fork_operationA project is forkedcheck-circle YesGitLab 15.2Project
project_fork_relationship_removedA project’s fork relationship is successfully removedcheck-circle YesGitLab 15.6Project
project_push_rules_commit_committer_check_updatedA project’s push rule setting for reject unverified users is updatedcheck-circle YesGitLab 16.5Project
protected_branch_code_owner_approval_required_updatedThe protected branch code owner approval required setting is updatedcheck-circle YesGitLab 15.8Project
protected_branch_createdA protected branch is createdcheck-circle YesGitLab 15.2Project
protected_branch_removedA protected branch is removedcheck-circle YesGitLab 15.2Project
protected_branch_updatedThe setting for protected branches is updatedcheck-circle YesGitLab 15.8Project
repository_git_operationAuthenticated users push, pull, or clone a project using SSH, HTTP(S), or the UIdotted-circle NoGitLab 14.9Project
require_reauthentication_to_approve_updatedThe setting for requiring reauthentication for merge request approvals is updatedcheck-circle YesGitLab 17.1Group, Project
manually_trigger_housekeepingManually triggering housekeeping via API or admin UIcheck-circle YesGitLab 15.9Project
project_blobs_removalRemoving blobs by using the GraphQL API or project settings UIcheck-circle YesGitLab 17.0Project
project_text_replacementReplacing text by using the GraphQL API or project settings UIcheck-circle YesGitLab 17.1Project

System access

Type nameEvent triggered whenSaved to databaseIntroduced inScope
application_setting_updatedAn application setting is updatedcheck-circle YesGitLab 16.3Instance
group_access_token_createdA group access token is createdcheck-circle YesGitLab 15.2Group
group_access_token_creation_failedCreating a group access token failedcheck-circle YesGitLab 15.2Group
group_access_token_deletedA group access token is deletedcheck-circle YesGitLab 15.2Group
group_access_token_deletion_failedDeleting a group access token failedcheck-circle YesGitLab 15.2Group
ip_restrictions_changedAny changes in the IP allowlistcheck-circle YesGitLab 15.0Group
login_failed_with_otp_authenticationSign-in fails because of an incorrect OTPcheck-circle YesGitLab 16.4User
login_failed_with_standard_authenticationSign-in to GitLab fails with standard authentication, such as passwordcheck-circle YesGitLab 16.4Instance
login_failed_with_webauthn_authenticationSign-in fails when using a WebAuthn devicecheck-circle YesGitLab 16.4User
update_mismatched_group_saml_extern_uidThe external UID is changed on a SAML identitycheck-circle YesGitLab 15.7User
user_access_lockedUser access to the instance is lockedcheck-circle YesGitLab 16.2User
user_access_unlockedUser access to the instance is unlockedcheck-circle YesGitLab 16.2User
user_disable_two_factorA user disables two factor authentication. Group scope was introduced in GitLab 17.6.check-circle YesGitLab 15.1User, Group
user_enable_admin_modeAdmin Mode enabledcheck-circle YesGitLab 15.7User

Team planning

Type nameEvent triggered whenSaved to databaseIntroduced inScope
comment_by_project_botA comment is added to an issue or a merge request when using a project access tokendotted-circle NoGitLab 16.1Project
delete_issueAn issue is successfully deleteddotted-circle NoGitLab 15.4Project
delete_work_itemA work item is successfully deleteddotted-circle NoGitLab 15.4Project
issue_closed_by_project_botAn issue is closed using a project access tokencheck-circle YesGitLab 16.1Project
issue_created_by_project_botAn issue is created using a project access tokencheck-circle YesGitLab 16.1Project
issue_reopened_by_project_botAn issue is reopened using a project access tokencheck-circle YesGitLab 16.1Project
task_closed_by_project_botA task is closed using a project access tokencheck-circle YesGitLab 16.1Project
task_created_by_project_botA task is created using a project access tokencheck-circle YesGitLab 16.1Project
task_reopened_by_project_botA task is reopened using a project access tokencheck-circle YesGitLab 16.1Project

User management

Type nameEvent triggered whenSaved to databaseIntroduced inScope
authenticated_with_group_samlSuccessfully signing in with SAML authenticationcheck-circle YesGitLab 12.10Group
ban_userA user is banned, unbanned, blocked, or unblockedcheck-circle YesGitLab 15.11User
change_membership_stateA user’s membership is updatedcheck-circle YesGitLab 15.1Group
inactive_scim_user_cannot_be_addedA user cannot be added to a group during SAML authentication when their SCIM identity is inactivecheck-circle YesGitLab 17.7Group
password_reset_failedA password reset fails for a userdotted-circle NoGitLab 16.4User
unban_userA user is unbannedcheck-circle YesGitLab 15.11User
unblock_userA user is bannedcheck-circle YesGitLab 15.11User
user_activateA user is activatedcheck-circle YesGitLab 16.1User
user_approvedA user is approved for an instancecheck-circle YesGitLab 15.11User
user_blockedA user is blockedcheck-circle YesGitLab 15.11User
user_createdA user is createdcheck-circle YesGitLab 15.10User
user_deactivateA user is deactivatedcheck-circle YesGitLab 16.0User
user_destroyedA user is scheduled for removal from the instance. Group and Project scopes were introduced in GitLab 17.5.check-circle YesGitLab 15.11User, Group, Project
user_email_changed_and_user_signed_inUser email changed and user signed incheck-circle YesGitLab 15.8User
user_impersonationAn instance administrator starts or stops impersonating a usercheck-circle YesGitLab 14.8User, Group
user_password_updatedA user password is updatedcheck-circle YesGitLab 15.7User
user_provisioned_by_scimA user is provisioned by SCIMcheck-circle YesGitLab 17.8Group
user_rejectedA user registration is rejectedcheck-circle YesGitLab 15.11User

User profile

Type nameEvent triggered whenSaved to databaseIntroduced inScope
email_confirmation_sentUsers add or change an email address and it must be confirmeddotted-circle NoGitLab 16.3User
remove_ssh_keyA SSH key is removedcheck-circle YesGitLab 14.1User
user_admin_status_updatedA user is either made an administrator or removed as an administratorcheck-circle YesGitLab 14.1User
user_auditor_status_updatedA user is either made an auditor or removed as an auditorcheck-circle YesGitLab 16.6User
user_email_address_updatedA user updates their email addresscheck-circle YesGitLab 10.1User
user_name_updatedA user’s name is updatedcheck-circle YesGitLab 17.5User
user_profile_visiblity_updatedUser toggles private profile user settingdotted-circle NoGitLab 16.3User
user_username_updatedA user’s username is updatedcheck-circle YesGitLab 15.7User

Verify security

Type nameEvent triggered whenSaved to databaseIntroduced inScope
secure_ci_job_token_group_addedGroup added to CI_JOB_TOKEN scopecheck-circle YesGitLab 17.3Project
secure_ci_job_token_group_removedGroup removed from CI_JOB_TOKEN scopecheck-circle YesGitLab 17.3Project
secure_ci_job_token_inbound_disabledCI_JOB_TOKEN permissions disabled for inboundcheck-circle YesGitLab 16.0Project
secure_ci_job_token_inbound_enabledCI_JOB_TOKEN permissions enabled for inboundcheck-circle YesGitLab 16.0Project
secure_ci_job_token_project_addedProject added to inbound CI_JOB_TOKEN scopecheck-circle YesGitLab 16.0Project
secure_ci_job_token_project_removedProject removed from inbound CI_JOB_TOKEN scopecheck-circle YesGitLab 16.0Project

Webhooks

Type nameEvent triggered whenSaved to databaseIntroduced inScope
webhook_createdA webhook is createdcheck-circle YesGitLab 17.1Project, Group, Instance
webhook_destroyedA webhook is destroyedcheck-circle YesGitLab 17.0Project, Group, Instance