Export the audit log (streamed CSV or JSON)

GET

/admin/audit/export

• Local development behind nginx (port 8088 by default)

Streams the audit log over a date range as CSV or NDJSON (newline-delimited JSON, format=json), with an operator-picked column subset (ADR 0032 §Export). The response is streamed from a keyset cursor, never buffered, so a multi-million-row export runs in bounded memory.

Gated on system.audit.read. Actor IP is redacted for callers without system.audit.pii.read, exactly as the /admin/audit list view redacts it (#425) — the export must not leak what the list withholds. Requesting the ip column without that capability yields an empty ip field, not a 403, so the column layout stays stable.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Query Parameters

format

string

default: csv

Allowed values: csv json

Output format. Defaults to csv.

columns

string

Comma-separated column subset, in order. Defaults to all columns. Recognised: id, event_type, occurred_at, actor_user_ref, subject_user_ref, ip, user_agent, metadata, legal_hold. Unknown names are ignored.

since

string format: date-time

ISO-8601 lower bound on occurred_at (inclusive).

until

string format: date-time

ISO-8601 upper bound on occurred_at (inclusive).

Responses

200

The streamed export.

string format: binary

string format: binary

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed