> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/cloud-log-forwarding/github-audit-logs-via-api.md).

# GitHub Audit Logs via API

## Overview

This document will guide you on how to create a PAT in GitHub for audit logs.

## Prerequisites

Create a dedicated GitHub user account with appropriate privileges:

* **Organization Admin** → for organization-level audit logs
* **Enterprise Admin** → for enterprise-level audit logs

## Steps to Create a PAT (Classic)

1. Log in to GitHub with the required user account
2. Ensure the email address is verified
3. In the top-right corner, click your profile icon → **Settings**
4. In the left sidebar, click **Developer settings**
5. Navigate to:
6. **Personal access tokens** → **Tokens (classic)**
7. Click:
8. **Generate new token (classic)**
9. Provide the following details:
10. **Note**: Add a descriptive name
11. **Expiration**: Select an appropriate validity period (recommended: avoid “No expiration”)
12. Under **Scopes**, select:
13. ✔ read:audit\_log
14. Click **Generate token**
15. Copy the token and store it securely
16. Select the scopes you'd like to grant this token. In this case select **read:audit\_log**
17. Click Generate token and copy it.

Screenshot of the "Personal access tokens" page. Next to a blurred-out token, an icon of two overlapping squares is outlined in orange.

![](/files/b1a1395fce00dc6f7773e8e2b27d43b67caacf6e)

1. To use your token to access resources owned by an organization that uses SAML single sign-on, authorize the token. For more information, see [Authorizing a personal access token for use with single sign-on](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-saml-single-sign-on/authorizing-a-personal-access-token-for-use-with-saml-single-sign-on).

**Once PAT is created, please share the token with blusapphire.**