Export audit logs to CSV
Triggers an export of audit logs to CSV file. The export is processed asynchronously and an email with download link is sent upon completion.
### Filtering
Use the `filters` field to narrow results. Pass an empty array or omit the field to retrieve all records.
Each filter object has the following fields:
| Field | Type | Description |
|---|---|---|
| `attribute` | string | The field to filter on (see Supported attributes below) |
| `operator` | string | Comparison operator (see Available operators below) |
| `values` | array | One or more `{ "value": <scalar> }` objects |
**Supported attributes**
| Attribute | Typical operator | Description |
|---|---|---|
| `event_at` | `IS_BETWEEN` | Event timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted. |
| `actor_id` | `IS_ANY_OF` | Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`). |
| `module` | `IS_ANY_OF` | Module **integer ID** (not the name). See the Module IDs reference table below. |
| `event_type` | `IS_ANY_OF` | Event type **integer ID** (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results. |
**Available operators**
| Operator | Meaning |
|---|---|
| `EQUALS` | Exact match |
| `NOT_EQUALS` | Exclude exact match |
| `IN` / `IS_ANY_OF` | Match any value in the list |
| `IS_NOT_ANY_OF` | Exclude all listed values |
| `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` |
| `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons |
| `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership |
| `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty |
| `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match |
**Module IDs** (use with `attribute: "module"`)
| ID | Module | What it covers |
|---|---|---|
| `0` | APPS | Third-party app connections (connect / disconnect / update) |
| `1` | USERS | User creation and profile updates |
| `2` | WORKFLOWS | Automation workflow changes |
| `3` | SERVICE_CATALOG | Service catalog items |
| `4` | SECURITY | Login, logout, API key creation / deletion |
| `5` | SKILL | AI skill changes |
| `6` | WORKSPACES | Workspace settings changes |
| `7` | TENANT_MIGRATION | Sandbox import / export |
| `8` | AGENT_GROUPS | Agent group changes |
| `9` | ACCESS_MANAGEMENT | Role and access control changes |
| `10` | AI_AGENTS | AI agent changes |
| `11` | AGENT_AVAILABILITY | Agent availability updates |
| `12` | CUSTOM_OBJECTS | Custom object type changes |
**Event Type IDs** (use with `attribute: "event_type"`)
| ID | Event Type |
|---|---|
| `0` | CONNECTED |
| `1` | DISCONNECTED |
| `2` | CREATED |
| `3` | UPDATED |
| `4` | ENABLED |
| `5` | DISABLED |
| `6` | DELETED |
| `7` | IMPORT |
| `8` | EXPORT |
| `9` | RESTORED |
| `10` | LOGIN |
| `12` | LOGOUT |
**Module → valid event types**
| Module | Valid event type IDs |
|---|---|
| APPS (0) | 0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED) |
| USERS (1) | 2 (CREATED), 3 (UPDATED) |
| WORKFLOWS (2) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| SERVICE_CATALOG (3) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| SECURITY (4) | 2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT) |
| SKILL (5) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| WORKSPACES (6) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| TENANT_MIGRATION (7) | 7 (IMPORT), 8 (EXPORT) |
| AGENT_GROUPS (8) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| ACCESS_MANAGEMENT (9) | 2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED) |
| AI_AGENTS (10) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| AGENT_AVAILABILITY (11) | 3 (UPDATED) |
| CUSTOM_OBJECTS (12) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
**Example**
```json
[
{
"attribute": "event_at",
"operator": "IS_BETWEEN",
"values": [
{
"value": "2024-01-01T00:00:00Z"
},
{
"value": "2024-12-31T23:59:59Z"
}
]
},
{
"attribute": "module",
"operator": "IS_ANY_OF",
"values": [
{
"value": 1
},
{
"value": 9
}
]
},
{
"attribute": "event_type",
"operator": "IS_ANY_OF",
"values": [
{
"value": 2
},
{
"value": 3
}
]
},
{
"attribute": "actor_id",
"operator": "IS_ANY_OF",
"values": [
{
"value": 123
}
]
}
]
```
Authentication
X-Api-Keystring
API Key authentication via header
Headers
X-Workspace-Id
Request
This endpoint expects an object.
search_key
Text search across log text, actor name, email, source IP, and event data
filters
Structured filters (same shape as /audit-logs/list). Supported attributes - actor_id, module, event_type, event_at. If event_at is not supplied, defaults to the last 6 months.
cc_emails
CC email addresses for the export notification
Response
Successful response
