Export shell audit events as CSV or JSON

GET

/api/audit/export

Stream a full CSV or JSON export of audit events for the organisation.

The export is capped at EXPORT_ROW_CAP rows (default 100 000). Requests that would exceed the cap receive a 413 response. Exporting is itself an auditable event (audit.exported) with the filter params and row count in the payload.

Role required: audit.view.

CSV columns: id, created_at, event_type, actor_id, target_user_id, payload_json, reason, prev_hash, event_hash.

Authorizations

• HTTPBearer

Parameters

Query Parameters

organization_id

required

string format: uuid

user_id

Any of:

string

string format: uuid

null

null

device_id

Any of:

string

string

null

null

session_id

Any of:

string

string

null

null

fleet_id

Any of:

string

string format: uuid

null

null

tier

Any of:

string

string

null

null

event_type

Any of:

string

string

null

null

outcome

Any of:

string

string

null

null

since

Any of:

string

string format: date-time

null

null

until

Any of:

string

string format: date-time

null

null

format

Export format: ‘csv’ (default) or ‘json’.

string

default: csv

Export format: ‘csv’ (default) or ‘json’.

Responses

200

Successful Response

422

Validation Error

object

detail

Array<object>

object

loc

required

Array

msg

required

string

type

required

string