Sign in

v101

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-05141179397.6 KB
Audit Logs

Update an audit log export destination

Applies a partial update. Returns 409 when the destination was changed concurrently, because the merged configuration this request validated is no longer the one that would be stored; retry against fresh state. Pausing prevents new delivery attempts, but an S3 upload already in progress may complete after the response.

patch/audit-logs/export/destinations/{id}

Request body

regionstring
bucketstring
prefixstring
role_arnstring
kms_key_idstring

KMS key ID, alias, or ARN. Set to an empty string to remove the configured KMS key; omit or send null to leave unchanged.

status'active' | 'paused'

Response

Audit log export destination updated

idstring required
type's3' required
regionstring required
bucketstring required
prefixstring required
role_arnstring required
external_idstring required
kernel_role_arnstring required

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

kms_key_idstring
format'jsonl.gz' required
status'active' | 'paused' required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

last_exported_cursorstring

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_atstring date-time
last_errorstring

Sanitized description of the most recent delivery failure.

last_error_atstring date-time
consecutive_failuresinteger required
next_attempt_atstring date-time
created_atstring date-time required
updated_atstring date-time required