Create Organization Audit Log Export

(v2)

POST

Starts a background export of your organization's audit logs — every audited action across every project — as a gzipped CSV, and responds 202 with the export to poll.

Poll GET /v2/organization/audit-logs/exports/{exportId} until status is COMPLETED, then call GET /v2/organization/audit-logs/exports/{exportId}/download for the file; ERRORED is terminal. One export runs at a time per organization and caller, so starting a second returns 409, and a period matching no audit logs, or more than 10,000,000 audit logs, is rejected with 400.

POST/v2/organization/audit-logs/exports

curl -X POST "https://api.confident-ai.com/v2/organization/audit-logs/exports" \
  -H "CONFIDENT_API_KEY: <ORGANIZATION-API-KEY>" \
  -H "Content-Type: application/json" \
  -d '{
  "startTime": "2025-01-01T00:00:00.000Z",
  "endTime": "2025-04-01T00:00:00.000Z",
  "searchTerm": "jane@acme.com"
}'

202

{
  "success": true,
  "data": {
    "id": "<AUDIT-LOG-EXPORT-ID>",
    "projectId": null,
    "organizationId": "<ORGANIZATION-ID>",
    "userId": "api",
    "status": "IN_PROGRESS",
    "exportType": "AUDIT_LOGS",
    "startTime": "2025-01-01T00:00:00.000Z",
    "endTime": "2025-04-01T00:00:00.000Z",
    "rowCount": 18432,
    "errorMessage": null,
    "createdAt": "2025-04-02T09:15:00.000Z",
    "completedAt": "2025-04-02T09:17:42.000Z"
  },
  "deprecated": false
}

Headers

CONFIDENT_API_KEYstringRequired
The organization API key for your Confident AI organization.

Request body

startTimestring
Start of the period to export, inclusive, as an ISO 8601 timestamp. Omit along with endTime to export all time.
endTimestring
End of the period to export, inclusive, as an ISO 8601 timestamp. Must be after startTime. Omit along with startTime to export all time.
searchTermstring
Only export audit logs matching this term. Matched as a substring against the actor email, API key name, API key id, actor type, action, HTTP method, IP address, resource id, user agent, and status code.

Response

Create Organization Audit Log Export succeeded.

successboolean
Indicates if the request was successful.
dataobject
One run of an audit log export: the period it covers, where it is in its lifecycle, and how many audit logs its file holds once it completes.
Show 12 propertiesHide 12 properties
- idstring
  The id of the export, a UUID generated by Confident AI. Poll and download the export by this id.
- projectIdstring | null
  The project whose audit logs the export covers, or null for an organization-wide export covering every project.
- organizationIdstring
  The organization the export belongs to.
- userIdstring
  The actor that started the export. api for an export started with an organization API key, or the user's id when started through an MCP OAuth session. An export is only visible to the actor that started it.
- statusenum
  Where an export is in its lifecycle. It is created IN_PROGRESS, becomes COMPLETED once its file is written to storage, and becomes ERRORED if the run failed. Only a COMPLETED export has a file to download, and both COMPLETED and ERRORED are terminal.
  Show 3 enum valuesHide 3 enum values
  - IN_PROGRESS
  - COMPLETED
  - ERRORED
- exportTypeenum
  The kind of data the file contains. Always AUDIT_LOGS for an export started at an audit log export endpoint.
  Show 7 enum valuesHide 7 enum values
  - TRACES
  - TRACES_WITH_SPANS
  - CONVERSATIONS
  - CONVERSATION_METRICS
  - ANNOTATIONS
  - TEST_RUNS
  - AUDIT_LOGS
- startTimestring | null
  Start of the period the export covers, inclusive. For an all-time export this is the timestamp of the oldest audit log matched.
- endTimestring | null
  End of the period the export covers, inclusive. For an all-time export this is the timestamp of the newest audit log matched.
- rowCountinteger | null
  How many audit logs were written to the file. Null until the export completes.
- errorMessagestring | null
  Why the export failed, when status is ERRORED. Null otherwise.
- createdAtstring
  When the export was started.
- completedAtstring | null
  When the export finished or failed. Null while it is still running.
deprecatedboolean
Indicates if this endpoint is deprecated.

Built byConfident AI