Export Audit Log
curl --request GET \
--url http://{host}:{port}/{basePath}/audit/export \
--header 'Authorization: <api-key>'import requests
url = "http://{host}:{port}/{basePath}/audit/export"
headers = {"Authorization": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: '<api-key>'}};
fetch('http://{host}:{port}/{basePath}/audit/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "62437",
CURLOPT_URL => "http://{host}:{port}/{basePath}/audit/export",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://{host}:{port}/{basePath}/audit/export"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://{host}:{port}/{basePath}/audit/export")
.header("Authorization", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("http://{host}:{port}/{basePath}/audit/export")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"apiVersion": "v1",
"kind": "AuditExport",
"metadata": {
"exportedAt": "2026-03-19T16:00:00Z",
"from": "2026-03-01T00:00:00Z",
"to": "2026-03-19T16:00:00Z",
"totalRecords": 1250,
"format": "json"
},
"records": [
{
"id": "audit-20260301-001",
"timestamp": "2026-03-01T00:05:00Z",
"action": "runbook.create",
"user": "admin@empresa.com",
"role": "admin",
"resource": "runbook-disk-cleanup",
"resourceType": "Runbook",
"namespace": "production",
"sourceIP": "10.0.1.10",
"checksum": "sha256:a1b2c3d4..."
}
]
}
Audit
Export Audit
Exports the complete audit log in CSV or JSON format for compliance and external analysis
GET
/
audit
/
export
Export Audit Log
curl --request GET \
--url http://{host}:{port}/{basePath}/audit/export \
--header 'Authorization: <api-key>'import requests
url = "http://{host}:{port}/{basePath}/audit/export"
headers = {"Authorization": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: '<api-key>'}};
fetch('http://{host}:{port}/{basePath}/audit/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "62437",
CURLOPT_URL => "http://{host}:{port}/{basePath}/audit/export",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://{host}:{port}/{basePath}/audit/export"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://{host}:{port}/{basePath}/audit/export")
.header("Authorization", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("http://{host}:{port}/{basePath}/audit/export")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"apiVersion": "v1",
"kind": "AuditExport",
"metadata": {
"exportedAt": "2026-03-19T16:00:00Z",
"from": "2026-03-01T00:00:00Z",
"to": "2026-03-19T16:00:00Z",
"totalRecords": 1250,
"format": "json"
},
"records": [
{
"id": "audit-20260301-001",
"timestamp": "2026-03-01T00:05:00Z",
"action": "runbook.create",
"user": "admin@empresa.com",
"role": "admin",
"resource": "runbook-disk-cleanup",
"resourceType": "Runbook",
"namespace": "production",
"sourceIP": "10.0.1.10",
"checksum": "sha256:a1b2c3d4..."
}
]
}
string
default:"csv"
Export format:
csv, jsonstring
required
Start date in ISO 8601 format (e.g.,
2026-03-01T00:00:00Z)string
End date in ISO 8601 format (default: now)
string
Filter by action type
string
Filter by user
string
Filter by namespace
{
"apiVersion": "v1",
"kind": "AuditExport",
"metadata": {
"exportedAt": "2026-03-19T16:00:00Z",
"from": "2026-03-01T00:00:00Z",
"to": "2026-03-19T16:00:00Z",
"totalRecords": 1250,
"format": "json"
},
"records": [
{
"id": "audit-20260301-001",
"timestamp": "2026-03-01T00:05:00Z",
"action": "runbook.create",
"user": "admin@empresa.com",
"role": "admin",
"resource": "runbook-disk-cleanup",
"resourceType": "Runbook",
"namespace": "production",
"sourceIP": "10.0.1.10",
"checksum": "sha256:a1b2c3d4..."
}
]
}
id,timestamp,action,user,role,resource,resourceType,namespace,sourceIP,checksum
audit-20260301-001,2026-03-01T00:05:00Z,runbook.create,admin@empresa.com,admin,runbook-disk-cleanup,Runbook,production,10.0.1.10,sha256:a1b2c3d4...
audit-20260301-002,2026-03-01T01:15:00Z,incident.acknowledge,carlos.silva@empresa.com,operator,INC-20260301-001,Incident,production,10.0.1.50,sha256:e5f6g7h8...
Content-Type: text/csv header and the Content-Disposition: attachment; filename="audit-export-20260319.csv" header for automatic download.
For large exports (more than 10,000 records), the API returns a 202 Accepted with a link for asynchronous download:
{
"apiVersion": "v1",
"kind": "AuditExportJob",
"metadata": {
"jobId": "export-20260319-001"
},
"status": {
"state": "processing",
"estimatedRecords": 45000,
"downloadUrl": "/api/v1/audit/export/download/export-20260319-001",
"expiresAt": "2026-03-19T22:00:00Z"
}
}
Authorizations
Bearer token issued by the operator. Format: Authorization: Bearer <token>.
Query Parameters
Export format.
Available options:
csv, json Start date (ISO 8601).
Example:
"2026-03-01T00:00:00Z"
End date (ISO 8601). Default: now.
Filter by action type.
Filter by user.
Filter by namespace.
⌘I