Skip to content

Audit logs for organizations#

This feature is only available on Business plan

Codacy logs important events in your organization, reflecting when your team members execute specific operations. This enables the generation of comprehensive reports to assist you with the audit process. For example, you can track who changed a gate policy, or changed the settings of a coding standard.

Only organization admins can see the audit logs of an organization, on the Audit logs page or using the Codacy API. Organization managers and members can't, and personal organizations don't have audit logs.

Codacy keeps audit logs for one year. It records events only from the moment audit logs were enabled for your organization, so there's no history from before that date.

Viewing audit logs in Codacy#

To see the events of your organization, open your organization Settings, page Audit logs.

The page shows the events of one day, starting with today. To see another day, pick a date in the date field. You can go back up to one year.

To find specific events, type an action, actor, or repository in the search box. The search covers only the selected day: to search another day, pick that date first. If nothing matches, check the action names in Audit log events.

Each row is one event:

  • Source: Where the operation came from: the Codacy app (web icon) or the Codacy API (code icon).
  • Action: The identifier of the operation, such as organizations.gatepolicies.update. See Audit log events for what each action means.
  • Actor: The email of the user who executed the operation.
  • Repository: The repository the operation applies to, or - for operations on the organization or user.
  • Time: When the operation happened, in your local time zone.
  • Result: Whether the operation succeeded (Success), failed (Failed), or was denied (Rejected).

If a day shows No audit logs on this date, Codacy didn't record any events in your organization that day. This is also the case for every day before audit logs were enabled for your organization.

If your organization doesn't have access to audit logs yet, the Audit logs page shows an upgrade prompt instead. Talk to us about upgrading.

Exporting audit logs with the Codacy API#

The Audit logs page shows one day at a time. To get the events of a longer period, up to one year, use the Codacy API endpoint listAuditLogsForOrganization.

  1. On the Audit logs page, click Export via API.
  2. Pick the From and To dates of the period you want to export. By default, Codacy selects the date you're viewing and the day before it.
  3. Copy the generated curl command.

  4. In your terminal, save an account API token in the CODACY_API_TOKEN variable. read -rs hides the token as you paste it and keeps it out of your shell history. If you don't have a token yet, generate one in your account, tab Access management.

    read -rs CODACY_API_TOKEN

  5. Paste the command, replace 'api-token: <YOUR_API_TOKEN>' with "api-token: $CODACY_API_TOKEN", and run it.

To build the request yourself, pass the start and end of the period as Unix timestamps in milliseconds:

read -rs CODACY_API_TOKEN
curl -X GET "https://app.codacy.com/api/v3/organizations/<GIT_PROVIDER>/<ORGANIZATION>/audit?from=<FROM>&to=<TO>" \
     -H "api-token: $CODACY_API_TOKEN"

If you leave out from, the response starts at the oldest event Codacy keeps. If you leave out to, it ends at the current time.

Large date ranges may time out. If that happens, export the period in smaller chunks

Audit log events#

Each audit log tracks when a Codacy user executed a specific operation in your organization using the Codacy app or the Codacy API. Each operation is identified by an action. For the detailed content of each audit log, see the Codacy API reference.

The sections below list the events that Codacy logs for your organization at user, organization, and repository levels.

User#

Event Description Action
Log in User logged in to Codacy user.login
Create account API token New account API token created user.tokens.create
Read account API token List of account API tokens retrieved user.tokens.read
Delete account API token Account API token deleted user.tokens.delete
Remove Git provider integration Git provider integration removed from the user's account. <provider> is gh (GitHub), gl (GitLab), or bb (Bitbucket) user.integrations.<provider>.delete
Add enterprise Git provider token Account token for an enterprise Git provider added user.enterprise.integrations.create

Organization#

Event Description Action
Add organization Organization added to Codacy organizations.create
Add people to organization New people added to the organization organizations.people.invite
Remove people from organization People removed from the organization organizations.people.remove
Join organization User joined the organization organizations.join
Update repository management permissions Repository management permissions updated organizations.analysisconfigurationminimumpermission.update
Assign organization manager role Organization manager role assigned to a team member security.managers.create
Revoke organization manager role Organization manager role revoked from a team member security.manager.delete
Update default Git provider configuration Default Git provider configuration for the organization updated organizations.integrations.providersetting.update
Apply default Git provider configuration to all repositories Default Git provider configuration applied to all repositories of the organization organizations.integrations.providersettings.apply
Create new organization hook New organization webhook created organizations.hooks.create
Create new gate policy New gate policy created organizations.gatepolicies.create
Update gate policy Quality gate definition updated organizations.gatepolicies.update
Apply gate policy to repositories Gate policy applied to a list of repositories organizations.gatepolicies.repositories.apply
Make gate policy default Gate policy was made the default for the organization organizations.gatepolicies.setdefault
Make Codacy gate policy default Built-in Codacy gate policy was made the default for the organization organizations.gatepolicies.setcodacydefault
Delete gate policy Gate policy deleted organizations.gatepolicies.delete
Create new coding standard using preset sensitivity levels New coding standard created organizations.presetsstandards.create
Create new coding standard draft using individual language and code pattern settings New coding standard draft created organizations.codingstandards.create
Create new coding standard from draft New coding standard created organizations.codingstandards.promote
Update coding standard from draft Coding standard updated organizations.codingstandards.promote
Update coding standard Coding standard updated organizations.codingstandards.update
Update tool in coding standard Tool or code pattern settings of a coding standard updated organizations.codingstandards.tools.update
Apply coding standard to repositories Coding standard applied to a list of repositories organizations.codingstandards.repositories
Make coding standard default Coding standard was made the default organizations.codingstandards.setdefault
Delete coding standard Coding standard deleted organizations.codingstandards.delete
Export security items Export security items organizations.security.items.export
Ignore security item Security item was ignored organizations.security.items.ignore
Unignore security item Security item was unignored organizations.security.items.unignore
Create DAST target A target for DAST scanning was created organizations.dast.target.create
Delete DAST target A target for DAST scanning was deleted organizations.dast.target.delete
Analyze DAST target Request a DAST scan of an existing target organizations.dast.target.analyze
Update security SLA configurations The security SLA Configuration was updated organizations.sla.configuration.update
### Repository
Event Description Action
Create new post-commit hook New repository hook created repositories.integrations.postcommithook
Create repository API token New repository API token created repositories.tokens.create
Read repository API token List of repository API tokens retrieved repositories.tokens.read
Delete repository API token Repository API token deleted repositories.tokens.delete
Update Git provider integration settings
(GitHub, Bitbucket, or GitLab)		 Git provider integration settings for the repository updated repositories.integrations.providersettings.update
Apply organization Git provider settings to repository Default Git provider configuration of the organization applied to the repository repositories.integrations.providersettings.apply
Refresh Git provider integration
(applies only to Bitbucket and GitLab)		 Git provider integration for the repository refreshed repositories.integrations.refreshprovider
Update issue For example ignore issue repositories.issues.update
Update tool Tool or code pattern settings updated, for example enabling a tool or a single code pattern repositories.tools.update
Update code patterns in bulk Enable or disable code patterns of a tool in bulk repositories.tools.bulk.update
Bypass pull request Bypass pull request by authorized person repositories.pullrequests.bypass
Update repository language Change languages analyzed in repository repositories.settings.language.update
Update branch Enable or Disable branch for analyse repositories.branches.update
Update analysis settings Update analysis settings repositories.settings.analysis.update
Reanalyze commit Reanalyze commit or pull request repositories.reanalyzecommit
Synchronize repository with provider Synchronize repository with provider repositories.settings.provider.sync
Update quality settings for repository Update quality settings for repository repositories.settings.quality.repository.update
Update quality settings for pull requests Update quality settings for pull requests repositories.settings.quality.pullrequests.update
Update file state Ignore or Unignore file repositories.file.update

See also#

Was this page helpful?

Your feedback helps us improve the documentation.

Edit this page on GitHub Contact support