Sign in
latestOpenAPI 3.1.02026-08-22154287463.4 KB

858365328f92

Audit Logs

Update an audit log export destination

Apply a partial update to a destination. Requires an active Enterprise plan. Returns 409 when the destination was changed concurrently, because the merged configuration this request validated is no longer the one that would be stored; retry against fresh state. Pausing prevents new delivery attempts, but an S3 upload already in progress may complete after the response.

patch/audit-logs/export/destinations/{id}

Request body

bucketstring
kms_key_idstring

KMS key ID, alias, or ARN. Set to an empty string to remove the configured KMS key; omit or send null to leave unchanged.

prefixstring
regionstring
role_arnstring
status'active' | 'paused'

Response

Audit log export destination updated

bucketstring required
consecutive_failuresinteger required
created_atstring date-time required
external_idstring required
format'jsonl.gz' required
idstring required
kernel_role_arnstring required

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

kms_key_idstring
last_errorstring

Sanitized description of the most recent delivery failure.

last_error_atstring date-time
last_exported_cursorstring

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_atstring date-time
next_attempt_atstring date-time
prefixstring required
regionstring required
role_arnstring required
status'active' | 'paused' required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

type's3' required
updated_atstring date-time required