Skip to main content
GET
/
audit
/
export
Export Audit Log
curl --request GET \
  --url http://{host}:{port}/{basePath}/audit/export \
  --header 'Authorization: <api-key>'
{
  "apiVersion": "v1",
  "kind": "AuditExport",
  "metadata": {
    "exportedAt": "2026-03-19T16:00:00Z",
    "from": "2026-03-01T00:00:00Z",
    "to": "2026-03-19T16:00:00Z",
    "totalRecords": 1250,
    "format": "json"
  },
  "records": [
    {
      "id": "audit-20260301-001",
      "timestamp": "2026-03-01T00:05:00Z",
      "action": "runbook.create",
      "user": "admin@empresa.com",
      "role": "admin",
      "resource": "runbook-disk-cleanup",
      "resourceType": "Runbook",
      "namespace": "production",
      "sourceIP": "10.0.1.10",
      "checksum": "sha256:a1b2c3d4..."
    }
  ]
}
​
format
string
default:"csv"
Export format: csv, json
​
since
string
required
Start date in ISO 8601 format (e.g., 2026-03-01T00:00:00Z)
​
until
string
End date in ISO 8601 format (default: now)
​
action
string
Filter by action type
​
user
string
Filter by user
​
namespace
string
Filter by namespace
{
  "apiVersion": "v1",
  "kind": "AuditExport",
  "metadata": {
    "exportedAt": "2026-03-19T16:00:00Z",
    "from": "2026-03-01T00:00:00Z",
    "to": "2026-03-19T16:00:00Z",
    "totalRecords": 1250,
    "format": "json"
  },
  "records": [
    {
      "id": "audit-20260301-001",
      "timestamp": "2026-03-01T00:05:00Z",
      "action": "runbook.create",
      "user": "admin@empresa.com",
      "role": "admin",
      "resource": "runbook-disk-cleanup",
      "resourceType": "Runbook",
      "namespace": "production",
      "sourceIP": "10.0.1.10",
      "checksum": "sha256:a1b2c3d4..."
    }
  ]
}

id,timestamp,action,user,role,resource,resourceType,namespace,sourceIP,checksum
audit-20260301-001,2026-03-01T00:05:00Z,runbook.create,admin@empresa.com,admin,runbook-disk-cleanup,Runbook,production,10.0.1.10,sha256:a1b2c3d4...
audit-20260301-002,2026-03-01T01:15:00Z,incident.acknowledge,carlos.silva@empresa.com,operator,INC-20260301-001,Incident,production,10.0.1.50,sha256:e5f6g7h8...
The CSV export returns the Content-Type: text/csv header and the Content-Disposition: attachment; filename="audit-export-20260319.csv" header for automatic download. For large exports (more than 10,000 records), the API returns a 202 Accepted with a link for asynchronous download: 
{
  "apiVersion": "v1",
  "kind": "AuditExportJob",
  "metadata": {
    "jobId": "export-20260319-001"
  },
  "status": {
    "state": "processing",
    "estimatedRecords": 45000,
    "downloadUrl": "/api/v1/audit/export/download/export-20260319-001",
    "expiresAt": "2026-03-19T22:00:00Z"
  }
}

Authorizations

​
Authorization
string
header
required

Bearer token issued by the operator. Format: Authorization: Bearer <token>.

Query Parameters

​
format
enum<string>
default:csv

Export format.

Available options:
csv,
json
​
since
string<date-time>
required

Start date (ISO 8601).

Example:

"2026-03-01T00:00:00Z"

​
until
string<date-time>

End date (ISO 8601). Default: now.

​
action
string

Filter by action type.

​
user
string

Filter by user.

​
namespace
string

Filter by namespace.

Response

Audit export (sync). Content-Type depends on format.

​
apiVersion
string
Example:

"v1"

​
kind
string
Example:

"AuditExport"

​
metadata
object
​
records
object[]