For tracking purposes, I've requested information on how they intend to handle this:

While working with the beta release of the google/go-github SDK I noted that pagination was not working for this API. After digging into the SDK I discovered the reason for this was that the audit-log API does not return traditional page parameters in the link array of the header. For example this query:

curl -v -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" https://api.github.com/orgs/lindluni-enterprise/audit-log > /dev/null

Returns this link header:

link: <https://api.github.com/organizations/80307827/audit-log?after=MS42MTUzMzYzNzg4MzNlKzEyfFlBdkVhclBZR21reGtQMG5uRng4bVE%3D&before=>; rel="next"

Which unlike the traditional link headers such as this:

link: <https://api.github.com/organizations/<id trunc>/repos?page=2>; rel="next", <https://api.github.com/organizations/<id trunc>/repos?page=124>; rel="last"

The audit log API does not return a page, it returns the traditional graphql After and Before fields. This is despite the fact the API documentation states that the API accepts a page parameter. If I do in fact include a page parameter, such as this query:

 curl -H "Authorization: token $GITHUB_TOKEN" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/orgs/<org trunc>/audit-log?page=1"

The resultant link header does include the page property:

https://api.github.com/organizations/<org trunc>/audit-log?page=1&after=MS42MTcxNjQ3MzUxZSsxMnxNR1h4NFpmTUh6aEFyZGFQVWlWUzhn&before=

However no matter what page I pass in it returns the same dataset, and the page property returned is whatever I pass in.