Audit events

Audit events are GitLab’s record of who changed what, kept for compliance. These actions list them and read one, at each of the three levels GitLab keeps them: the instance, a group and a project. The instance level needs an administrator.

Sample questions

• “Show last week’s audit events for group platform”
• “Who changed the settings of project 42 yesterday?”
• “List instance audit events since 2026-09-01”

How to call it

• Dynamic, the default surface: call gitlab_execute_action with action set to the action’s ID, such as audit_event.get_group, and its parameters in params. gitlab_find_action finds an ID from a description of the task.
• Meta (GITLAB_MCP_TOOL_SURFACE=meta): call gitlab_audit_event with action set to the action’s name, such as get_group, and its parameters in params.
• Individual (GITLAB_MCP_TOOL_SURFACE=individual): call the action’s own tool, such as gitlab_get_group_audit_event, with its parameters as the arguments.

Availability

How many of these actions an instance serves at each tier, out of a total of 6:

• Free: 0
• Premium: 6
• Ultimate: 6

Read-only actions: 6 of 6, the ones a deployment in read-only mode keeps. A token with read_api and not api is served 6 of the 6.

Actions

The description of each action, and of each of its parameters, is the text the server serves for it on the default surface, quoted as served. The token lines say what GitLab 19.4.1 requires of a token for the requests each action sends; on an instance with Admin Mode turned on, an action only an administrator may run also needs admin_mode.

Action	Individual
audit_event.get_group	gitlab_get_group_audit_event
audit_event.get_instance	gitlab_get_instance_audit_event
audit_event.get_project	gitlab_get_project_audit_event
audit_event.list_group	gitlab_list_group_audit_events
audit_event.list_instance	gitlab_list_instance_audit_events
audit_event.list_project	gitlab_list_project_audit_events

audit_event.get_group

Get a single group-level audit event by group_id and ID. Returns: the audit event with author, entity, event name/type, target details, IP address, and timestamp. See also: audit_event.list_group, audit_event.get_project, audit_event.get_instance.

• Meta-tool: gitlab_audit_event, action get_group
• Individual tool: gitlab_get_group_audit_event
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
event_id	integer	yes	Audit event ID
group_id	string/integer	yes	Group ID or URL-encoded path

audit_event.get_instance

Get a single instance-level audit event by ID (administrator only). Returns: the audit event with author, entity, event name/type, target details, IP address, and timestamp. See also: audit_event.list_instance, audit_event.get_group, audit_event.get_project.

• Meta-tool: gitlab_audit_event, action get_instance
• Individual tool: gitlab_get_instance_audit_event
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at instance (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
event_id	integer	yes	Audit event ID

audit_event.get_project

Get a single project-level audit event by project_id and ID. Returns: the audit event with author, entity, event name/type, target details, IP address, and timestamp. See also: audit_event.list_project, audit_event.get_group, audit_event.get_instance.

• Meta-tool: gitlab_audit_event, action get_project
• Individual tool: gitlab_get_project_audit_event
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at project (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
event_id	integer	yes	Audit event ID
project_id	string/integer	yes	Project ID or URL-encoded path

audit_event.list_group

List group-level audit events for a group. Returns: audit events with author, entity, event name/type, details, timestamps, and pagination metadata. See also: audit_event.get_group, audit_event.list_project, audit_event.list_instance.

• Meta-tool: gitlab_audit_event, action list_group
• Individual tool: gitlab_list_group_audit_events
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at group (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
group_id	string/integer	yes	Group ID or URL-encoded path
created_after	string	no	Return events created after this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
created_before	string	no	Return events created before this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
page	integer	no	Page number to fetch, 1-based. Defaults to 1. Use the next_page field from the previous response to paginate forward.
page_token	string	no	Next page of a keyset listing: the next_page_token of the previous response of this action, passed back unchanged. It carries the position and every filter of the listing as GitLab read them, and those are what the next page is asked with, whatever filters are sent beside it. Leave it empty for the first page.
pagination	string	no	Pagination method: ‘keyset’ for keyset-based pagination on large ordered result sets, or ‘offset’ (the default). Keyset avoids deep-offset cost, and a keyset page names the next one in next_page_token rather than next_page.
per_page	integer	no	Items per page. Defaults to 20, minimum 1, maximum 100. Use 100 to minimize round trips when the result set is large.

audit_event.list_instance

List instance-level audit events (administrator only). Returns: audit events with author, entity, event name/type, details, timestamps, and pagination metadata. See also: audit_event.get_instance, audit_event.list_group, audit_event.list_project.

• Meta-tool: gitlab_audit_event, action list_instance
• Individual tool: gitlab_list_instance_audit_events
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at instance (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
created_after	string	no	Return events created after this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
created_before	string	no	Return events created before this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
entity_id	integer	no	Return only events of the entity with this ID. Requires entity_type
entity_type	string (Project, User, Group, Gitlab::Audit::InstanceScope)	no	Return only events of this entity type: Project, User, Group or Gitlab::Audit::InstanceScope
page	integer	no	Page number to fetch, 1-based. Defaults to 1. Use the next_page field from the previous response to paginate forward.
page_token	string	no	Next page of a keyset listing: the next_page_token of the previous response of this action, passed back unchanged. It carries the position and every filter of the listing as GitLab read them, and those are what the next page is asked with, whatever filters are sent beside it. Leave it empty for the first page.
pagination	string	no	Pagination method: ‘keyset’ for keyset-based pagination on large ordered result sets, or ‘offset’ (the default). Keyset avoids deep-offset cost, and a keyset page names the next one in next_page_token rather than next_page.
per_page	integer	no	Items per page. Defaults to 20, minimum 1, maximum 100. Use 100 to minimize round trips when the result set is large.

audit_event.list_project

List project-level audit events for a project. Returns: audit events with author, entity, event name/type, details, timestamps, and pagination metadata. See also: audit_event.get_project, audit_event.list_group, audit_event.list_instance.

• Meta-tool: gitlab_audit_event, action list_project
• Individual tool: gitlab_list_project_audit_events
• Tier: Premium
• Classic or OAuth token: read_api (or api)
• Fine-grained token: Audit Event: Read at project (permissions page)
• Behavior: read-only, idempotent

Parameter	Type	Mandatory	Description
project_id	string/integer	yes	Project ID or URL-encoded path
created_after	string	no	Return events created after this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
created_before	string	no	Return events created before this time: an ISO 8601 timestamp such as 2025-01-01T00:00:00Z, or a date such as 2025-01-01 read as midnight UTC
page	integer	no	Page number to fetch, 1-based. Defaults to 1. Use the next_page field from the previous response to paginate forward.
page_token	string	no	Next page of a keyset listing: the next_page_token of the previous response of this action, passed back unchanged. It carries the position and every filter of the listing as GitLab read them, and those are what the next page is asked with, whatever filters are sent beside it. Leave it empty for the first page.
pagination	string	no	Pagination method: ‘keyset’ for keyset-based pagination on large ordered result sets, or ‘offset’ (the default). Keyset avoids deep-offset cost, and a keyset page names the next one in next_page_token rather than next_page.
per_page	integer	no	Items per page. Defaults to 20, minimum 1, maximum 100. Use 100 to minimize round trips when the result set is large.