Export audit logs (deprecated path)

Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as GET /api/audit-logs. The response is returned as an attachment with a generated filename.

GET /api/audit-logs/export

Error

A valid request URL is required to generate request examples

200

"<string>"

This path is deprecated and will be removed in the following major release. Use /api/governance/audit-logs/export instead.

This endpoint is available in Bifrost Enterprise only.

Authorizations

ManagementBearerAuthBasicAuth

Authorization · string · header · required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

• a Bifrost management API key,
• a dashboard session token issued by POST /api/session/login,
• base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Query Parameters

format · enum<string> · default: json

Export format. Defaults to json when omitted or unrecognized.

• json: a JSON array of events
• jsonl: JSON Lines, one event per line
• syslog: RFC 5424 syslog format

Available options: json, jsonl, syslog

search · string

Free-text search across audit event fields.

actions · string

JSON array of CADF actions to filter by (OR match).

outcomes · string

JSON array of outcomes to filter by (OR match).

event_types · string

JSON array of event types to filter by (OR match).

start_date · string

Filter events at or after this time (RFC3339 or YYYY-MM-DD).

end_date · string

Filter events at or before this time (RFC3339 or YYYY-MM-DD).

period · string

Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).

Response

200

application/json

A streamed export of the matching audit logs.

The response is of type string.