---
title: "List audit log export destinations"
method: GET
path: "/audit-logs/export/destinations"
tags: ["Audit Logs"]
---

# List audit log export destinations

`GET /audit-logs/export/destinations`

## Query parameters

- `limit` integer
- `offset` integer

## Response `200`

Audit log export destinations for the organization

- AuditLogExportDestination[]
  - `id` string, required
  - `type` 's3', required
  - `region` string, required
  - `bucket` string, required
  - `prefix` string, required
  - `role_arn` string, required
  - `external_id` string, required
  - `kernel_role_arn` string, required — The Kernel role that assumes `role_arn` in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require `external_id` as the `sts:ExternalId` condition. Recreating a destination issues a new `external_id`, which the trust policy has to be updated to match.
  - `kms_key_id` string
  - `format` 'jsonl.gz', required
  - `status` 'active' | 'paused', required — Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.
  - `last_exported_cursor` string — Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens. Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.
  - `last_success_at` string, date-time
  - `last_error` string — Sanitized description of the most recent delivery failure.
  - `last_error_at` string, date-time
  - `consecutive_failures` integer, required
  - `next_attempt_at` string, date-time
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `401` — Unauthorized – missing or invalid authorization token
- `403` — Forbidden – insufficient permissions or plan
- `500` — Internal Server Error

---

[API](https://skmtc.net/kernel/apis/kernel-api.md) · [All operations](https://skmtc.net/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kernel/kernel-api/versions/9e8ce9fcf5e1/schema)