Audit Logs
Export audit logs
Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as GET /api/audit-logs. The response is returned as an attachment with a generated filename.
get/api/audit-logs/export
Query parameters
format'json' | 'jsonl' | 'syslog'
Export format. Defaults to json when omitted or unrecognized.
- json: a JSON array of events
- jsonl: JSON Lines, one event per line
- syslog: RFC 5424 syslog format
searchstring
Free-text search across audit event fields.
actionsstring
JSON array of CADF actions to filter by (OR match).
outcomesstring
JSON array of outcomes to filter by (OR match).
event_typesstring
JSON array of event types to filter by (OR match).
start_datestring
Filter events at or after this time (RFC3339 or YYYY-MM-DD).
end_datestring
Filter events at or before this time (RFC3339 or YYYY-MM-DD).
periodstring
Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).
Response
A streamed export of the matching audit logs.
string required