Skip to main content
GET
/
api
/
v1
/
audit
/
export
Export Audit
curl --request GET \
  --url https://api.example.com/api/v1/audit/export
{
  "apiVersion": "v1",
  "kind": "AuditExport",
  "metadata": {
    "exportedAt": "2026-03-19T16:00:00Z",
    "from": "2026-03-01T00:00:00Z",
    "to": "2026-03-19T16:00:00Z",
    "totalRecords": 1250,
    "format": "json"
  },
  "records": [
    {
      "id": "audit-20260301-001",
      "timestamp": "2026-03-01T00:05:00Z",
      "action": "runbook.create",
      "user": "admin@empresa.com",
      "role": "admin",
      "resource": "runbook-disk-cleanup",
      "resourceType": "Runbook",
      "namespace": "production",
      "sourceIP": "10.0.1.10",
      "checksum": "sha256:a1b2c3d4..."
    }
  ]
}
​
format
string
default:"csv"
Export format: csv, json
​
since
string
required
Start date in ISO 8601 format (e.g., 2026-03-01T00:00:00Z)
​
until
string
End date in ISO 8601 format (default: now)
​
action
string
Filter by action type
​
user
string
Filter by user
​
namespace
string
Filter by namespace
{
  "apiVersion": "v1",
  "kind": "AuditExport",
  "metadata": {
    "exportedAt": "2026-03-19T16:00:00Z",
    "from": "2026-03-01T00:00:00Z",
    "to": "2026-03-19T16:00:00Z",
    "totalRecords": 1250,
    "format": "json"
  },
  "records": [
    {
      "id": "audit-20260301-001",
      "timestamp": "2026-03-01T00:05:00Z",
      "action": "runbook.create",
      "user": "admin@empresa.com",
      "role": "admin",
      "resource": "runbook-disk-cleanup",
      "resourceType": "Runbook",
      "namespace": "production",
      "sourceIP": "10.0.1.10",
      "checksum": "sha256:a1b2c3d4..."
    }
  ]
}

id,timestamp,action,user,role,resource,resourceType,namespace,sourceIP,checksum
audit-20260301-001,2026-03-01T00:05:00Z,runbook.create,admin@empresa.com,admin,runbook-disk-cleanup,Runbook,production,10.0.1.10,sha256:a1b2c3d4...
audit-20260301-002,2026-03-01T01:15:00Z,incident.acknowledge,carlos.silva@empresa.com,operator,INC-20260301-001,Incident,production,10.0.1.50,sha256:e5f6g7h8...
The CSV export returns the Content-Type: text/csv header and the Content-Disposition: attachment; filename="audit-export-20260319.csv" header for automatic download. For large exports (more than 10,000 records), the API returns a 202 Accepted with a link for asynchronous download: 
{
  "apiVersion": "v1",
  "kind": "AuditExportJob",
  "metadata": {
    "jobId": "export-20260319-001"
  },
  "status": {
    "state": "processing",
    "estimatedRecords": 45000,
    "downloadUrl": "/api/v1/audit/export/download/export-20260319-001",
    "expiresAt": "2026-03-19T22:00:00Z"
  }
}