Export shell audit events as CSV or JSON

GET

/api/audit/export

curl --request GET \
  --url 'https://example.com/api/audit/export?organization_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0&format=csv' \
  --header 'Authorization: Bearer <token>'

Stream a full CSV or JSON export of audit events for the organisation.

The export is capped at EXPORT_ROW_CAP rows (default 100 000). Requests that would exceed the cap receive a 413 response. Exporting is itself an auditable event (audit.exported) with the filter params and row count in the payload.

Role required: audit.view.

CSV columns: id, created_at, event_type, actor_id, target_user_id, payload_json, reason, prev_hash, event_hash.

Authorizations

• HTTPBearer

Parameters

Query Parameters

organization_id

required

Organization Id

string format: uuid

user_id

Any of:

string

string format: uuid

null

null

device_id

Any of:

string

string

null

null

session_id

Any of:

string

string

null

null

fleet_id

Any of:

string

string format: uuid

null

null

tier

Any of:

string

string

null

null

event_type

Any of:

string

string

null

null

outcome

Any of:

string

string

null

null

since

Any of:

string

string format: date-time

null

null

until

Any of:

string

string format: date-time

null

null

format

Format

Export format: ‘csv’ (default) or ‘json’.

string

default: csv

Export format: ‘csv’ (default) or ‘json’.

Responses

200

Successful Response

Media type application/json

Example ^generated

example

422

Validation Error

Media type application/json

HTTPValidationError

object

detail

Detail

Array<object>

ValidationError

object

ctx

Context

object

input

Input

loc

required

Location

Array

msg

required

Message

string

type

required

Error Type

string

Example ^generated

{
  "detail": [
    {
      "ctx": {},
      "input": "example",
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example"
    }
  ]
}