Sign in

v101

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-05141179397.6 KB
Audit Logs

Create an audit log export destination

Creates a paused destination. Activate it with a status update once the destination test passes.

post/audit-logs/export/destinations

Request body

type's3' required
regionstring required
bucketstring required
prefixstring required
role_arnstring required
kms_key_idstring
format'jsonl.gz' required

Response

Audit log export destination created

idstring required
type's3' required
regionstring required
bucketstring required
prefixstring required
role_arnstring required
external_idstring required
kernel_role_arnstring required

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

kms_key_idstring
format'jsonl.gz' required
status'active' | 'paused' required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

last_exported_cursorstring

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_atstring date-time
last_errorstring

Sanitized description of the most recent delivery failure.

last_error_atstring date-time
consecutive_failuresinteger required
next_attempt_atstring date-time
created_atstring date-time required
updated_atstring date-time required