Skip to content

Audit event types

DETAILS: Tier: Premium, Ultimate Offering: SaaS, self-managed

Audit event types are used to filter streamed audit events.

Every audit event is associated with an event type. Audit event types can allow audit events to be:

  • Saved to the database. Available in the Premium and Ultimate tier. You can retrieve audit events associated with these types by using the audit events dashboard or the audit events API.
  • Streamed to external destinations. Available in the Ultimate tier. You can stream audit events associated with these types to external destinations if a destination is set.

Some audit event types don't allow saving audit events to the database. Other audit event types don't allow streaming audit events to external destinations.

Available audit event types

Audit event types belong to the following product categories.

Audit events

Name Description Saved to database Streamed Introduced in
amazon_s3_configuration_created Triggered when Amazon S3 configuration for audit events streaming is created {check-circle} Yes {check-circle} Yes GitLab 16.5
amazon_s3_configuration_deleted Triggered when Amazon S3 configuration for audit events streaming is deleted. {check-circle} Yes {check-circle} Yes GitLab 16.5
amazon_s3_configuration_updated Triggered when Amazon S3 configuration for audit events streaming is updated. {check-circle} Yes {check-circle} Yes GitLab 16.5
audit_events_streaming_headers_create Triggered when a streaming header for audit events is created {check-circle} Yes {check-circle} Yes GitLab 15.3
audit_events_streaming_headers_destroy Triggered when a streaming header for audit events is deleted {check-circle} Yes {check-circle} Yes GitLab 15.3
audit_events_streaming_instance_headers_create Triggered when a streaming header for instance level external audit event destination is created {check-circle} Yes {check-circle} Yes GitLab 16.3
audit_events_streaming_instance_headers_destroy Triggered when a streaming header for instance level external audit event destination is deleted {check-circle} Yes {check-circle} Yes GitLab 16.3
audit_events_streaming_instance_headers_update Triggered when a streaming header for instance level external audit event destination is updated {check-circle} Yes {check-circle} Yes GitLab 16.3
create_event_streaming_destination Event triggered when an external audit event destination is created {check-circle} Yes {check-circle} Yes GitLab 14.6
create_http_namespace_filter Event triggered when a namespace filter for an external audit event destination for a top-level group is created. {check-circle} Yes {check-circle} Yes GitLab 16.6
create_instance_event_streaming_destination Event triggered when an instance level external audit event destination is created {check-circle} Yes {check-circle} Yes GitLab 16.2
delete_http_namespace_filter Event triggered when a namespace filter for an external audit event destination for a top-level group is deleted. {check-circle} Yes {check-circle} Yes GitLab 16.7
destroy_event_streaming_destination Event triggered when an external audit event destination is deleted {check-circle} Yes {check-circle} Yes GitLab 14.6
destroy_instance_event_streaming_destination Event triggered when an instance level external audit event destination is deleted {check-circle} Yes {check-circle} Yes GitLab 16.2
event_type_filters_created Event triggered when a new audit events streaming event type filter is created {check-circle} Yes {check-circle} Yes GitLab 15.10
event_type_filters_deleted Event triggered when audit events streaming event type filters are deleted {check-circle} Yes {check-circle} Yes GitLab 15.10
google_cloud_logging_configuration_created Triggered when Google Cloud Logging configuration is created {check-circle} Yes {check-circle} Yes GitLab 16.1
google_cloud_logging_configuration_deleted Triggered when Google Cloud Logging configuration is deleted {check-circle} Yes {check-circle} Yes GitLab 16.1
google_cloud_logging_configuration_updated Triggered when Google Cloud Logging configuration is updated {check-circle} Yes {check-circle} Yes GitLab 16.1
instance_amazon_s3_configuration_created Triggered when instance Amazon S3 configuration for audit events streaming is created {check-circle} Yes {check-circle} Yes GitLab 16.7
instance_amazon_s3_configuration_deleted Triggered when instance-level Amazon S3 configuration for audit events streaming is deleted {check-circle} Yes {check-circle} Yes GitLab 16.7
instance_amazon_s3_configuration_updated Triggered when instance-level Amazon S3 configuration for audit events streaming is updated {check-circle} Yes {check-circle} Yes GitLab 16.7
instance_google_cloud_logging_configuration_created Triggered when Instance level Google Cloud Logging configuration is created {check-circle} Yes {check-circle} Yes GitLab 16.4
instance_google_cloud_logging_configuration_deleted Triggered when instance level Google Cloud Logging configuration is deleted. {check-circle} Yes {check-circle} Yes GitLab 16.5
instance_google_cloud_logging_configuration_updated Triggered when instance level Google Cloud Logging configuration is updated. {check-circle} Yes {check-circle} Yes GitLab 16.5
update_event_streaming_destination Event triggered when an external audit event destination is updated {check-circle} Yes {check-circle} Yes GitLab 14.6
update_instance_event_streaming_destination Event triggered when an instance level external audit event destination is updated {check-circle} Yes {check-circle} Yes GitLab 16.2

Build artifacts

Name Description Saved to database Streamed Introduced in
job_artifact_downloaded Triggered when a user download a job artifact from a project {dotted-circle} No {check-circle} Yes GitLab 16.8

Code review

Name Description Saved to database Streamed Introduced in
delete_merge_request Event triggered on successful merge request deletion {dotted-circle} No {check-circle} Yes GitLab 15.4

Code review workflow

Name Description Saved to database Streamed Introduced in
merge_request_approval_operation Audit event triggered when a merge request is approved {dotted-circle} No {check-circle} Yes GitLab 15.3
merge_request_closed_by_project_bot Triggered when a merge request is closed using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
merge_request_created_by_project_bot Triggered when a merge request is created using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
merge_request_invalid_approver_rules Audit event triggered for an invalid rule when merge request is approved {check-circle} Yes {check-circle} Yes GitLab 15.5
merge_request_merged_by_project_bot Triggered when a merge request is merged using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
merge_request_reopened_by_project_bot Triggered when a merge request is reopened using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
project_merge_requests_template_updated Whenever a MR template is updated for a project, this audit event is created {check-circle} Yes {check-circle} Yes GitLab 15.0
project_remove_source_branch_after_merge_updated Create this audit event whenever a project has its setting to remove branches after merges modified {check-circle} Yes {check-circle} Yes GitLab 14.10
project_reset_approvals_on_push_updated Create this audit event whenever a project has its setting on whether approvals are reset on a push is updated {check-circle} Yes {check-circle} Yes GitLab 14.2

Code suggestions

Name Description Saved to database Streamed Introduced in
code_suggestions_updated Code Suggestion UI group setting change {check-circle} Yes {check-circle} Yes GitLab 15.11
project_suggestion_commit_message_updated Create this audit event whenever a project has its suggested commit message updated {check-circle} Yes {check-circle} Yes GitLab 14.10

Compliance management

Name Description Saved to database Streamed Introduced in
add_gpg_key Event triggered when a GPG Key is created {check-circle} Yes {check-circle} Yes GitLab 15.9
allow_author_approval_updated Event triggered on updating prevent merge request approval from authors from group merge request setting {check-circle} Yes {check-circle} Yes GitLab 15.6
allow_committer_approval_updated Event triggered on updating prevent merge request approval from committers from group merge request setting {check-circle} Yes {check-circle} Yes GitLab 15.6
allow_overrides_to_approver_list_per_merge_request_updated Event triggered on updating prevent users from modifying MR approval rules in merge requests from group merge request setting {check-circle} Yes {check-circle} Yes GitLab 15.6
audit_events_streaming_headers_update Triggered when a streaming header for audit events is updated {check-circle} Yes {check-circle} Yes GitLab 15.3
compliance_framework_deleted Triggered when a framework gets removed from a project {check-circle} Yes {check-circle} Yes GitLab 14.1
compliance_framework_id_updated audit when compliance framework ID is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
create_compliance_framework Triggered on successful compliance framework creation {check-circle} Yes {check-circle} Yes GitLab 14.6
create_status_check Event triggered when an external status check is created {check-circle} Yes {check-circle} Yes GitLab 15.9
delete_status_check Event triggered when an external status check is deleted {check-circle} Yes {check-circle} Yes GitLab 15.9
destroy_compliance_framework Triggered on successful compliance framework deletion {check-circle} Yes {check-circle} Yes GitLab 14.6
email_created Event triggered when an email is created {check-circle} Yes {check-circle} Yes GitLab 15.11
email_destroyed Event triggered when an email is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.11
external_status_check_name_updated Event triggered on updating name of a external status check {check-circle} Yes {check-circle} Yes GitLab 15.7
external_status_check_url_updated Whenever the URL that is used for external status checks for a pipeline is updated, this audit event is created {check-circle} Yes {check-circle} Yes GitLab 15.0
group_deletion_marked Event triggered when a group is marked for deletion. {check-circle} Yes {check-circle} Yes GitLab 15.11
group_destroyed Event triggered when a group is destroyed. {check-circle} Yes {check-circle} Yes GitLab 15.11
group_restored Event triggered when a group is restored. {check-circle} Yes {check-circle} Yes GitLab 15.11
group_saml_provider_create Event triggered when a group SAML provider is created {check-circle} Yes {check-circle} Yes GitLab 15.9
group_saml_provider_update Event triggered when a group SAML provider is updated {check-circle} Yes {check-circle} Yes GitLab 15.9
inactive_project_scheduled_for_deletion Triggered when inactive project is scheduled for deletion {check-circle} Yes {check-circle} Yes GitLab 16.4
member_created Event triggered when a membership is created {check-circle} Yes {check-circle} Yes GitLab 15.9
member_destroyed Event triggered when a membership is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.9
member_updated Event triggered when a membership is updated {check-circle} Yes {check-circle} Yes GitLab 15.9
merge_request_create Event triggered when a Merge Request is created {dotted-circle} No {check-circle} Yes GitLab 15.9
omniauth_login_failed Event triggered when an OmniAuth login fails {check-circle} Yes {check-circle} Yes GitLab 16.3
password_reset_requested Event triggered when a user requests a password reset using a registered email address {check-circle} Yes {dotted-circle} No GitLab 15.11
personal_access_token_created Event triggered when a user creates a personal access token {check-circle} Yes {check-circle} Yes GitLab 15.9
personal_access_token_revoked Event triggered when a personal access token is revoked {check-circle} Yes {check-circle} Yes GitLab 15.9
project_archived Event triggered when a project is archived. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_deletion_marked Event triggered when a project is marked for deletion. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_destroyed Event triggered when a project is destroyed. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_export_file_download_started Event triggered when download of project export file gets started. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_group_link_created Event triggered when a group is invited to a project {check-circle} Yes {check-circle} Yes GitLab 15.9
project_group_link_deleted Event triggered when a project group link is deleted {check-circle} Yes {check-circle} Yes GitLab 15.9
project_group_link_updated Event triggered when a project group link is updated {check-circle} Yes {check-circle} Yes GitLab 15.9
project_imported Event triggered when a project is imported. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_restored Event triggered when a project is restored. {check-circle} Yes {check-circle} Yes GitLab 15.11
project_unarchived Event triggered when a project is unarchived. {check-circle} Yes {check-circle} Yes GitLab 15.11
protected_branch_allow_force_push_updated This audit event is created when a protected branch has its ability to allow force pushes is toggled {check-circle} Yes {check-circle} Yes GitLab 14.3
registration_created Event triggered when a user registers for instance access {check-circle} Yes {check-circle} Yes GitLab 16.3
release_created Event triggered when a release is created {check-circle} Yes {check-circle} Yes GitLab 15.9
release_deleted_audit_event Event triggered when a release is deleted {check-circle} Yes {check-circle} Yes GitLab 15.9
release_milestones_updated Event triggered when a release's associated milestones are updated {check-circle} Yes {check-circle} Yes GitLab 15.9
release_updated Event triggered when a release is updated {check-circle} Yes {check-circle} Yes GitLab 15.9
remove_gpg_key Event triggered when a GPG Key is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.9
repository_download_operation Event triggered when a Git repository for a project is downloaded {check-circle} Yes {check-circle} Yes GitLab 15.9
require_password_to_approve_updated Event triggered on updating require user password for approvals from group merge request setting {check-circle} Yes {check-circle} Yes GitLab 15.6
retain_approvals_on_push_updated Event triggered on updating require new approvals when new commits are added to an MR from group merge request setting {check-circle} Yes {check-circle} Yes GitLab 15.6
saml_group_links_created Event triggered when a SAML Group Link is created {check-circle} Yes {check-circle} Yes GitLab 15.9
saml_group_links_removed Event triggered when a SAML Group Link is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.9
smartcard_authentication_created Event triggered when a user authenticates with smartcard {check-circle} Yes {check-circle} Yes GitLab 16.0
update_approval_rules Event triggered on updating a merge approval rule {check-circle} Yes {check-circle} Yes GitLab 15.2
update_compliance_framework Triggered when a compliance framework is updated {check-circle} Yes {check-circle} Yes GitLab 14.6
update_status_check Event triggered when an external status check is updated {check-circle} Yes {check-circle} Yes GitLab 15.9

Continuous delivery

Name Description Saved to database Streamed Introduced in
deploy_key_added Triggered when deploy key is added {check-circle} Yes {check-circle} Yes GitLab 15.3
deploy_key_removed Audit event triggered when deploy key is removed {check-circle} Yes {check-circle} Yes GitLab 15.3
deploy_token_created Audit event triggered when deploy token is created {check-circle} Yes {check-circle} Yes GitLab 15.1
deploy_token_creation_failed Audit event triggered when deploy token fails to create {check-circle} Yes {check-circle} Yes GitLab 15.1
deploy_token_destroyed Audit event triggered when deploy token is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.1
deploy_token_revoked Triggered when project deploy token is revoked {check-circle} Yes {check-circle} Yes GitLab 15.1
group_deploy_token_created Audit event triggered when a groups deploy token is created {check-circle} Yes {check-circle} Yes GitLab 15.3
group_deploy_token_creation_failed Audit event triggered when a groups deploy token fails to create {check-circle} Yes {check-circle} Yes GitLab 15.3
group_deploy_token_destroyed Audit event triggered when group deploy token is destroyed {check-circle} Yes {check-circle} Yes GitLab 15.3
group_deploy_token_revoked Audit event triggered when group deploy token is revoked {check-circle} Yes {check-circle} Yes GitLab 15.3

Continuous integration

Name Description Saved to database Streamed Introduced in
allow_merge_on_skipped_pipeline_updated There is a project setting which toggles the ability to merge when a pipeline is skipped. This audit event tracks changes to that setting. This MR adds a setting to allow this (like previous GitLab versions). {check-circle} Yes {check-circle} Yes GitLab 14.10
ci_group_variable_created Triggered when a CI variable is created at a group level {check-circle} Yes {check-circle} Yes GitLab 15.2
ci_group_variable_deleted Triggered when a group's CI variable is deleted {check-circle} Yes {check-circle} Yes GitLab 15.2
ci_group_variable_updated Triggered when a group's CI variable is updated {check-circle} Yes {check-circle} Yes GitLab 15.2
ci_instance_variable_created When an instance level CI variable is created {check-circle} Yes {check-circle} Yes GitLab 16.5
ci_instance_variable_deleted When an instance level CI variable is deleted {check-circle} Yes {check-circle} Yes GitLab 16.5
ci_instance_variable_updated When an instance level CI variable is changed {check-circle} Yes {check-circle} Yes GitLab 16.5
ci_variable_created Triggered when a CI variable is created at a project level {check-circle} Yes {check-circle} Yes GitLab 15.2
ci_variable_deleted Triggered when a project's CI variable is deleted {check-circle} Yes {check-circle} Yes GitLab 15.2
ci_variable_updated Triggered when a project's CI variable is updated {check-circle} Yes {check-circle} Yes GitLab 15.2
destroy_pipeline Event triggered when a pipeline is deleted {check-circle} Yes {check-circle} Yes GitLab 16.6

Deployment management

Name Description Saved to database Streamed Introduced in
cluster_agent_token_created Event triggered when a user creates a cluster agent token {check-circle} Yes {check-circle} Yes GitLab 15.10
cluster_agent_token_revoked Event triggered when a user revokes a cluster agent token {check-circle} Yes {check-circle} Yes GitLab 15.10

Dynamic application security testing

Name Description Saved to database Streamed Introduced in
dast_profile_create Triggered when a dynamic application security testing profile is created {check-circle} Yes {check-circle} Yes GitLab 14.1
dast_profile_destroy Triggered when a dynamic application security profile is removed {check-circle} Yes {check-circle} Yes GitLab 14.1
dast_profile_schedule_create Triggered when a dynamic application security testing profile schedule is created {check-circle} Yes {check-circle} Yes GitLab 14.3
dast_profile_schedule_update Triggered when a dynamic application security testing profile schedule is updated {check-circle} Yes {check-circle} Yes GitLab 14.3
dast_profile_update Triggered when a dynamic application security profile is updated {check-circle} Yes {check-circle} Yes GitLab 14.1
dast_scanner_profile_create Triggered when a dynamic application security testing scanner profile is created {check-circle} Yes {check-circle} Yes GitLab 14.0
dast_scanner_profile_destroy Triggered when a dynamic application security testing scanner profile is removed {check-circle} Yes {check-circle} Yes GitLab 14.0
dast_scanner_profile_update Triggered when a dynamic application security testing scanner profile is updated {check-circle} Yes {check-circle} Yes GitLab 14.0
dast_site_profile_create Triggered when a dynamic application security testing site profile is created {check-circle} Yes {check-circle} Yes GitLab 14.0
dast_site_profile_destroy Triggered when a dynamic application security testing site profile is removed {check-circle} Yes {check-circle} Yes GitLab 14.0
dast_site_profile_update Triggered when a dynamic application security testing site profile is updated {check-circle} Yes {check-circle} Yes GitLab 14.0

Environment management

Name Description Saved to database Streamed Introduced in
environment_protected This event is triggered when a protected environment is created. {check-circle} Yes {check-circle} Yes GitLab 15.8
environment_unprotected This event is triggered when a protected environment is deleted. {check-circle} Yes {check-circle} Yes GitLab 15.8
protected_environment_approval_rule_added This event is triggered when an approval rule is added to a protected environment. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_approval_rule_deleted This event is triggered when an approval rule is removed from a protected environment. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_approval_rule_updated This event is triggered when an approval rule of a protected environment is updated. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_deploy_access_level_added This event is triggered when a deploy access level is added to a protected environment. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_deploy_access_level_deleted This event is triggered when a deploy access level is removed from a protected environment. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_deploy_access_level_updated This event is triggered when a deploy access level of a protected environment is updated {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_environment_updated This event is triggered when a protected environment is updated. {check-circle} Yes {check-circle} Yes GitLab 16.5

Feature flags

Name Description Saved to database Streamed Introduced in
feature_flag_created Triggered when a feature flag is created. {check-circle} Yes {check-circle} Yes GitLab 15.10
feature_flag_deleted Triggered when a feature flag is deleted. {check-circle} Yes {check-circle} Yes GitLab 15.10
feature_flag_updated Triggered when a feature flag is updated. {check-circle} Yes {check-circle} Yes GitLab 15.10

Fleet visibility

Name Description Saved to database Streamed Introduced in
ci_runner_usage_export Triggered when a runner usage report is generated. {check-circle} Yes {check-circle} Yes GitLab 16.8

Fuzz testing

Name Description Saved to database Streamed Introduced in
coverage_fuzzing_corpus_create Event triggered on a corpus action is added {check-circle} Yes {check-circle} Yes GitLab 14.5

Groups and projects

Name Description Saved to database Streamed Introduced in
create_ssh_certificate Event triggered when an SSH certificate is created. {check-circle} Yes {check-circle} Yes GitLab 16.6
delete_ssh_certificate Event triggered when an SSH certificate is deleted. {check-circle} Yes {check-circle} Yes GitLab 16.6
group_created Event triggered when a group is created. {check-circle} Yes {check-circle} Yes GitLab 16.3
group_lfs_enabled_updated Event triggered when a groups lfs enabled is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_membership_lock_updated Event triggered when a groups membership lock is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_merge_request_approval_setting_created Triggered when merge request approval settings are added on a group level. {check-circle} Yes {check-circle} Yes GitLab 15.1
group_name_updated Event triggered when a groups name is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_path_updated Event triggered when a groups path is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_project_creation_level_updated Event triggered when a groups project creation level is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_repository_size_limit_updated Event triggered when a groups repository size limit is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_request_access_enabled_updated Event triggered when a groups request access enabled is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_require_two_factor_authentication_updated Event triggered when a groups require two factor authentication setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_share_with_group_link_created This event is triggered when you proceed to invite a group to another group via the 'invite group' tab on the group's membership page {check-circle} Yes {check-circle} Yes GitLab 15.10
group_share_with_group_link_removed This event is triggered when you proceed to invite a group to another group via the 'invite group' tab on the group's membership page {check-circle} Yes {check-circle} Yes GitLab 15.10
group_share_with_group_link_updated This event is triggered when you proceed to invite a group to another group via the 'invite group' tab on the group's membership page {check-circle} Yes {check-circle} Yes GitLab 15.10
group_shared_runners_minutes_limit_updated Event triggered when a groups shared runners minutes limit is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_two_factor_grace_period_updated Event triggered when a groups two factor grace period is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_visibility_level_updated Event triggered when a groups visibility level is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
merge_commit_template_updated audit when merge commit template is updated {check-circle} Yes {check-circle} Yes GitLab 15.8
project_cicd_merge_pipelines_enabled_updated audit when project cicd merge pipelines setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.8
project_cicd_merge_trains_enabled_updated Event triggered on updating project setting for enabling ci cd merge trains {check-circle} Yes {check-circle} Yes GitLab 15.8
project_created Event triggered when a project is created. {check-circle} Yes {check-circle} Yes GitLab 16.0
project_default_branch_updated Event triggered when default branch of a project's repository is updated. {check-circle} Yes {check-circle} Yes GitLab 16.0
project_description_updated Triggered when a project's description is updated {dotted-circle} No {check-circle} Yes GitLab 16.3
project_disable_overriding_approvers_per_merge_request_updated audit when project disable overriding approvers per mr setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_analytics_access_level_updated Event triggered when a project's analytics access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_builds_access_level_updated Event triggered when a project's builds access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_container_registry_access_level_updated Event triggered when a project's container registry access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_environments_access_level_updated Event triggered when a project's environments access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_feature_flags_access_level_updated Event triggered when a project's feature flags access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_forking_access_level_updated Event triggered when a project's feature forking access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_infrastructure_access_level_updated Event triggered when a project's infrastructure access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_issues_access_level_updated Event triggered when a project's issues access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_merge_requests_access_level_updated Event triggered when a project's merge request access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_metrics_dashboard_access_level_updated Event triggered when a project's metrics dashboard access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_monitor_access_level_updated Event triggered when a project's monitor access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_operations_access_level_updated Event triggered when a project's operation access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_package_registry_access_level_updated Event triggered when a project's package registry access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_pages_access_level_updated Event triggered when a project's page access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_releases_access_level_updated Event triggered when a project's releases access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_repository_access_level_updated Event triggered when a project's repository access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_requirements_access_level_updated Event triggered when a project's requirements access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_security_and_compliance_access_level_updated Event triggered when a project's security and compliance access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_snippets_access_level_updated Event triggered when a project's snippet access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_feature_wiki_access_level_updated Event triggered when a project's wiki access level setting is updated. {check-circle} Yes {check-circle} Yes GitLab 15.7
project_merge_method_updated Triggered when a project's merge request method has been changed. {check-circle} Yes {check-circle} Yes GitLab 14.10
project_merge_requests_author_approval_updated audit when project mr author approval setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
project_merge_requests_disable_committers_approval_updated Event triggered on updating project setting for disabling committers approval on merge requests {check-circle} Yes {check-circle} Yes GitLab 15.7
project_name_updated Create this audit event whenever a project has its name updated {check-circle} Yes {check-circle} Yes GitLab 10.2
project_namespace_updated audit when project namespace is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
project_only_allow_merge_if_all_discussions_are_resolved_updated Event triggered on updating project setting for allowing merge only when all discussions are resolved {check-circle} Yes {check-circle} Yes GitLab 15.7
project_only_allow_merge_if_pipeline_succeeds_updated audit when project only allow merge if pipeline succeeds setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
project_packages_enabled_updated When the setting that controls packages for a project is toggled, this audit event is created {check-circle} Yes {check-circle} Yes GitLab 11.5
project_path_updated Event triggered on updating a project's path {check-circle} Yes {check-circle} Yes GitLab 15.5
project_printing_merge_request_link_enabled_updated Event triggered on updating setting for projects for enabling printing merge request link {check-circle} Yes {check-circle} Yes GitLab 15.7
project_repository_size_limit_updated Event triggered on updating repository size limit of a project {check-circle} Yes {check-circle} Yes GitLab 15.7
project_require_password_to_approve_updated Event triggered on updating project setting for requiring user's password for approval of merge request {check-circle} Yes {check-circle} Yes GitLab 15.7
project_resolve_outdated_diff_discussions_updated audit when project resolve outdated diff discussions setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
project_visibility_level_updated audit when project visiblity level setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
squash_commit_template_updated Event triggered on updating the merge request squash commit template for a project {check-circle} Yes {check-circle} Yes GitLab 15.8
squash_option_updated Triggered when squash option setting has been changed. {check-circle} Yes {check-circle} Yes GitLab 15.0

Incident management

Name Description Saved to database Streamed Introduced in
incident_closed_by_project_bot Triggered when an incident is closed using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
incident_created_by_project_bot Triggered when an incident is created using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
incident_reopened_by_project_bot Triggered when an incident is reopened using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1

MLOps

Name Description Saved to database Streamed Introduced in
project_feature_model_experiments_access_level_updated Model experiments access level was updated {check-circle} Yes {check-circle} Yes GitLab 16.1
project_feature_model_registry_access_level_updated Model registry access level was updated {check-circle} Yes {check-circle} Yes GitLab 16.7

Not categorized

Name Description Saved to database Streamed Introduced in
experiment_features_enabled_updated Event triggered on toggling setting for enabling experiment AI features {check-circle} Yes {check-circle} Yes GitLab 16.0

Permissions

Name Description Saved to database Streamed Introduced in
member_role_created Event triggered when a custom role is created. {check-circle} Yes {check-circle} Yes GitLab 16.7
member_role_deleted Event triggered when a custom role is deleted. {check-circle} Yes {check-circle} Yes GitLab 16.9
member_role_updated Event triggered when a custom role is updated. {check-circle} Yes {check-circle} Yes GitLab 16.9

Portfolio management

Name Description Saved to database Streamed Introduced in
delete_epic Event triggered on successful epic deletion {dotted-circle} No {check-circle} Yes GitLab 15.4
epic_closed_by_project_bot Triggered when an epic is closed by a group access token {check-circle} Yes {check-circle} Yes GitLab 16.1
epic_created_by_project_bot Triggered when an epic is created by a group access token {check-circle} Yes {check-circle} Yes GitLab 16.1
epic_reopened_by_project_bot Triggered when an epic is reopened by a group access token {check-circle} Yes {check-circle} Yes GitLab 16.1

Project

Name Description Saved to database Streamed Introduced in
project_access_token_created Event triggered on creating a project access token {check-circle} Yes {check-circle} Yes GitLab 15.2
project_access_token_creation_failed Event triggered on failure to create a project access token {check-circle} Yes {check-circle} Yes GitLab 15.2
project_access_token_deleted Event triggered on creating a project access token {check-circle} Yes {check-circle} Yes GitLab 15.2
project_access_token_deletion_failed Event triggered on failure to delete a project access token {check-circle} Yes {check-circle} Yes GitLab 15.2

Quality management

Name Description Saved to database Streamed Introduced in
test_case_closed_by_project_bot Triggered when a test case is closed using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
test_case_created_by_project_bot Triggered when a test case is created using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
test_case_reopened_by_project_bot Triggered when a test case is reopened using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1

Runner

Name Description Saved to database Streamed Introduced in
set_runner_associated_projects Event triggered on successful assignment of associated projects to a CI runner {check-circle} Yes {check-circle} Yes GitLab 15.4

Security policy management

Name Description Saved to database Streamed Introduced in
policy_project_updated This event is triggered whenever the security policy project is updated for a project. {check-circle} Yes {check-circle} Yes GitLab 15.6

Source code management

Name Description Saved to database Streamed Introduced in
approval_rule_created Triggered when a merge request approval rule is created {check-circle} Yes {check-circle} Yes GitLab 15.2
approval_rule_deleted Triggered on successful approval rule deletion {check-circle} Yes {check-circle} Yes GitLab 14.9
group_push_rules_author_email_regex_updated Event triggered when a groups push rules settings is changed for author email regex. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_branch_name_regex_updated Event triggered when a groups push rules settings is changed for branch name regex. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_commit_committer_check_updated Triggered when group push rule setting is updated for reject unverified users. {check-circle} Yes {check-circle} Yes GitLab 15.0
group_push_rules_commit_message_negative_regex_updated Event triggered when a groups push rules settings is changed for commit message negative regex. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_commit_message_regex_updated Event triggered when a groups push rules settings is changed for commit message regex. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_file_name_regex_updated Event triggered when a groups push rules settings is changed for filename regex. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_max_file_size_updated Event triggered when a groups push rules settings is changed for max file size. {check-circle} Yes {check-circle} Yes GitLab 15.7
group_push_rules_prevent_secrets_updated Triggered when group push rule setting is updated to prevent pushing secret files. {check-circle} Yes {check-circle} Yes GitLab 15.0
group_push_rules_reject_deny_delete_tag_updated Triggered when group push rule setting is updated to deny deletion of tags using Git push. {check-circle} Yes {check-circle} Yes GitLab 15.0
group_push_rules_reject_member_check_updated Triggered when group push rule setting is updated to check if commit author is a GitLab user. {check-circle} Yes {check-circle} Yes GitLab 15.0
group_push_rules_reject_non_dco_commits_updated Triggered when group push rule setting is updated for reject non DCO certified commits. {check-circle} Yes {check-circle} Yes GitLab 15.0
group_push_rules_reject_unsigned_commits_updated Triggered when group push rule setting is updated for reject unsigned commits. {check-circle} Yes {check-circle} Yes GitLab 15.0
merged_merge_request_deleted Audit event triggered when a merged merge request is deleted {dotted-circle} No {check-circle} Yes GitLab 16.0
merged_merge_request_deletion_started Audit event triggered when a merged merge request's deletion is started {dotted-circle} No {check-circle} Yes GitLab 16.1
project_fork_operation Audit event triggered when a project is forked {check-circle} Yes {check-circle} Yes GitLab 15.2
project_fork_relationship_removed Event triggered on successful removal of project's fork relationship {check-circle} Yes {check-circle} Yes GitLab 15.6
project_push_rules_commit_committer_check_updated Triggered when project push rule setting is updated for reject unverified users. {check-circle} Yes {check-circle} Yes GitLab 16.5
protected_branch_code_owner_approval_required_updated audit when protected branch code owner approval required setting is updated {check-circle} Yes {check-circle} Yes GitLab 15.8
protected_branch_created Triggered when a protected branch is created {check-circle} Yes {check-circle} Yes GitLab 15.2
protected_branch_removed Triggered when a protected branch is removed {check-circle} Yes {check-circle} Yes GitLab 15.2
protected_branch_updated Event triggered on the setting for protected branches is update {check-circle} Yes {check-circle} Yes GitLab 15.8
repository_git_operation Triggered when authenticated users push, pull, or clone a project using SSH, HTTP(S), or the UI {dotted-circle} No {check-circle} Yes GitLab 14.9
manually_trigger_housekeeping Triggered when manually triggering housekeeping via API or admin UI {check-circle} Yes {check-circle} Yes GitLab 15.9

Subgroup

Name Description Saved to database Streamed Introduced in
group_access_token_created Event triggered on creating a group access token {check-circle} Yes {check-circle} Yes GitLab 15.2
group_access_token_creation_failed Event triggered on failing to create a group access token {check-circle} Yes {check-circle} Yes GitLab 15.2
group_access_token_deleted Event triggered on deleting a group access token {check-circle} Yes {check-circle} Yes GitLab 15.2
group_access_token_deletion_failed Event triggered on failure to delete a group access token {check-circle} Yes {check-circle} Yes GitLab 15.2

System access

Name Description Saved to database Streamed Introduced in
application_setting_updated Triggered when Application setting is updated {check-circle} Yes {check-circle} Yes GitLab 16.3
ip_restrictions_changed Event triggered on any changes in the IP AllowList {check-circle} Yes {check-circle} Yes GitLab 15.0
login_failed_with_otp_authentication Triggered when the login fails due to an incorrect OTP {check-circle} Yes {check-circle} Yes GitLab 16.4
login_failed_with_standard_authentication Triggered when login to GitLab fails with standard authentication like password. {check-circle} Yes {check-circle} Yes GitLab 16.4
login_failed_with_webauthn_authentication Triggered when login fails via WebAuthn device {check-circle} Yes {check-circle} Yes GitLab 16.4
update_mismatched_group_saml_extern_uid Triggered when the external UID is changed on a SAML identity. {check-circle} Yes {check-circle} Yes GitLab 15.7
user_access_locked Event triggered when user access to the instance is locked {check-circle} Yes {check-circle} Yes GitLab 16.2
user_access_unlocked Event triggered when user access to the instance is unlocked {check-circle} Yes {check-circle} Yes GitLab 16.2
user_disable_two_factor Audit event triggered when user disables two factor authentication {check-circle} Yes {check-circle} Yes GitLab 15.1
user_enable_admin_mode Event triggered on enabling Admin Mode {check-circle} Yes {check-circle} Yes GitLab 15.7

Team planning

Name Description Saved to database Streamed Introduced in
comment_by_project_bot Triggered when a comment is added to an issue or an MR using the project access token {dotted-circle} No {check-circle} Yes GitLab 16.1
delete_issue Event triggered on successful issue deletion {dotted-circle} No {check-circle} Yes GitLab 15.4
delete_work_item Event triggered on successful work item deletion {dotted-circle} No {check-circle} Yes GitLab 15.4
issue_closed_by_project_bot Triggered when an issue is closed using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
issue_created_by_project_bot Triggered when an issue is created using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
issue_reopened_by_project_bot Triggered when an issue is reopened using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
task_closed_by_project_bot Triggered when a task is closed using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
task_created_by_project_bot Triggered when a task is created using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1
task_reopened_by_project_bot Triggered when a task is reopened using a project access token {check-circle} Yes {check-circle} Yes GitLab 16.1

User management

Name Description Saved to database Streamed Introduced in
authenticated_with_group_saml Triggered after successfully signing in with SAML authentication {check-circle} Yes {check-circle} Yes GitLab 12.10
ban_user Event triggered on user ban action {check-circle} Yes {check-circle} Yes GitLab 15.11
change_membership_state Event triggered on a users membership is updated {check-circle} Yes {check-circle} Yes GitLab 15.1
password_reset_failed Event triggered when a password reset fails for a user {dotted-circle} No {check-circle} Yes GitLab 16.4
unban_user Event triggered on user unban action {check-circle} Yes {check-circle} Yes GitLab 15.11
unblock_user Event triggered on user unblock action {check-circle} Yes {check-circle} Yes GitLab 15.11
user_activate Event triggered on user activate action {check-circle} Yes {check-circle} Yes GitLab 16.1
user_approved Event triggered when a user is approved for an instance {check-circle} Yes {dotted-circle} No GitLab 15.11
user_blocked Event triggered when a user is blocked {check-circle} Yes {dotted-circle} No GitLab 15.11
user_created Event triggered when a user is created {check-circle} Yes {check-circle} Yes GitLab 15.10
user_deactivate Event triggered on user deactivate action {check-circle} Yes {check-circle} Yes GitLab 16.0
user_destroyed Event triggered when a user is scheduled for removal from the instance {check-circle} Yes {dotted-circle} No GitLab 15.11
user_email_changed_and_user_signed_in audit when user emailed changed and user signed in {check-circle} Yes {check-circle} Yes GitLab 15.8
user_impersonation Triggered when an instance administrator starts or stops impersonating a user {check-circle} Yes {check-circle} Yes GitLab 14.8
user_password_updated audit when user password is updated {check-circle} Yes {check-circle} Yes GitLab 15.7
user_rejected Event triggered when a user registration is rejected {check-circle} Yes {dotted-circle} No GitLab 15.11

User profile

Name Description Saved to database Streamed Introduced in
email_confirmation_sent Triggered when users add or change and email address and it needs to be confirmed. {dotted-circle} No {check-circle} Yes GitLab 16.3
remove_ssh_key Audit event triggered when a SSH key is removed {check-circle} Yes {check-circle} Yes GitLab 14.1
user_admin_status_updated Adds an audit event when a user is either made an administrator, or removed as an administrator {check-circle} Yes {check-circle} Yes GitLab 14.1
user_auditor_status_updated Adds an audit event when a user is either made an auditor, or removed as an auditor {check-circle} Yes {check-circle} Yes GitLab 16.6
user_email_address_updated Adds an audit event when a user updates their email address {check-circle} Yes {check-circle} Yes GitLab 10.1
user_profile_visiblity_updated Triggered when user toggles private profile user setting {dotted-circle} No {check-circle} Yes GitLab 16.3
user_username_updated Event triggered on updating a user's username {check-circle} Yes {check-circle} Yes GitLab 15.7

Verify security

Name Description Saved to database Streamed Introduced in
secure_ci_job_token_inbound_disabled Event triggered when CI_JOB_TOKEN permissions disabled for inbound {check-circle} Yes {check-circle} Yes GitLab 16.0
secure_ci_job_token_inbound_enabled Event triggered when CI_JOB_TOKEN permissions enabled for inbound {check-circle} Yes {check-circle} Yes GitLab 16.0
secure_ci_job_token_project_added Event triggered when project added to inbound CI_JOB_TOKEN scope {check-circle} Yes {check-circle} Yes GitLab 16.0
secure_ci_job_token_project_removed Event triggered when project removed from inbound CI_JOB_TOKEN scope {check-circle} Yes {check-circle} Yes GitLab 16.0