SQRL/ Docs
GET/api/v1/export-audit-logs

Export the audit log

Exports a workspace's audit log as CSV for external analysis, regulatory reporting, or archival, and records the export itself in the audit log.

AccessRequires a permission in the workspaceVIEW_LOGS

This is the export behind the Reports page, for the cases where a paged read is not what you want: external analysis, regulatory reporting, or archival. It takes the same organisation, workspace, category, and date-range filters as GET /api/v1/get-logs, but no page parameter, and returns everything that matches in one response. The CSV arrives as a string in the csv field of a JSON body rather than as a file download, so write it out yourself before handing it to a spreadsheet or a parser.

Two things gate the call: you need View Logs in the workspace, and you must also be a member of the organisation you name in org_uid. The export is itself an audited action, recorded under the audit category, so a later reader of the log can see who took a copy of it and when. Entries carry the prev_hash and event_hash chain described on GET /api/v1/get-logs, which is what lets a reviewer tell that nothing was removed from the record the export was taken from. See Activity and audit log for the operator view of the same export.

note:
workspace_uid is a string here

On this endpoint workspace_uid is a string, where GET /api/v1/get-logs takes it as a number. A client that shares one query builder across both calls has to account for that.

Query parameters
org_uidstringrequired
The organisation the workspace belongs to. You must be a member of it, as well as holding VIEW_LOGS in the workspace.
workspace_uidstringrequired
The workspace whose audit log to export, as a string on this endpoint.
from_daystringoptional
Earliest day to include, as YYYY-MM-DD.
to_daystringoptional
Latest day to include, as YYYY-MM-DD.
categorystringoptional
Narrows the export to a single event category, matching the value entries carry in their category field.
Was this page helpful?