Skip to main content
GET
Export Audit Log
string
Filter by the namespace of the AuditEvent. Omit it to list every namespace.
string
Filter by eventType (exact match), e.g. issue_created, issue_resolved, issue_escalated, issue_contained, remediation_started, remediation_completed, remediation_failed, approval_requested, approval_approved, approval_rejected, approval_expired, notification_sent, slo_violation, sla_breach
string
Filter by severity: info, warning, critical
string
Filter by the affected resource name (exact match on resourceName)
string
Only events at or after this RFC 3339 timestamp (spec.timestamp, falling back to the creation time)
string
Only events at or before this RFC 3339 timestamp
Minimum role: viewer. Takes the same filters as List Audit Events, but returns every matching event in one synchronous 200 response, with no pagination. The body is JSON only (there is no CSV or format option and no asynchronous export job), sent with Content-Disposition: attachment; filename=audit-events-<YYYYMMDD-HHMMSS>.json.

Authorizations

X-API-Key
string
header
required

API key sent in the X-API-Key header. Keys are read from the Secret chatcli-operator-secrets, key api-keys (fallback: ConfigMap chatcli-operator-config, key api-keys) in the operator namespace, as a YAML list of {key, role, name, description} (name is the identity recorded on approval decisions); the operator chart creates it only with apiKeys.create: true. Roles: viewer < operator < admin — any other role string is denied everywhere. Changes are picked up within about 30 seconds; deleting both the Secret and the ConfigMap revokes every key. With no keys configured every /api/ call returns 401, unless CHATCLI_OPERATOR_DEV_MODE=true, which grants admin without a key (development only).

Query Parameters

namespace
string

Kubernetes namespace. Empty means all namespaces.

type
string

Exact match on spec.eventType: issue_created, issue_resolved, issue_escalated, issue_contained, remediation_started, remediation_completed, remediation_failed, approval_requested, approval_approved, approval_rejected, approval_expired, notification_sent, slo_violation or sla_breach.

severity
string

Exact match on spec.severity.

resource
string

Exact match on spec.resource.name.

from
string<date-time>

Start of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-01T00:00:00Z"

to
string<date-time>

End of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-19T23:59:59Z"

Response

Audit export

apiVersion
string
Example:

"v1"

kind
string
Example:

"AuditEventExport"

exportedAt
string<date-time>
totalCount
integer
items
object[]