Source: https://atomicwork-preview.docs-staging.pageloop.ai/api-reference/auditlogs/postapi-v-1-audit-logs-export # Export audit logs to CSV POST `https://{tenant}.atomicwork.com/api/v1/audit-logs/export` Triggers an export of audit logs to CSV file. The export is processed asynchronously and an email with download link is sent upon completion. ### Filtering Use the `filters` field to narrow results. Pass an empty array or omit the field to retrieve all records. Each filter object has the following fields: | Field | Type | Description | | ----------- | ------ | ------------------------------------------------------- | | `attribute` | string | The field to filter on (see Supported attributes below) | | `operator` | string | Comparison operator (see Available operators below) | | `values` | array | One or more `\{ "value": \ \}` objects | **Supported attributes** | Attribute | Typical operator | Description | | ------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `event_at` | `IS_BETWEEN` | Event timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted. | | `actor_id` | `IS_ANY_OF` | Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`). | | `module` | `IS_ANY_OF` | Module **integer ID** (not the name). See the Module IDs reference table below. | | `event_type` | `IS_ANY_OF` | Event type **integer ID** (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results. | **Available operators** | Operator | Meaning | | ------------------------------------ | --------------------------------------------------------- | | `EQUALS` | Exact match | | `NOT_EQUALS` | Exclude exact match | | `IN` / `IS_ANY_OF` | Match any value in the list | | `IS_NOT_ANY_OF` | Exclude all listed values | | `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` | | `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons | | `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership | | `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty | | `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match | **Module IDs** (use with `attribute: "module"`) | ID | Module | What it covers | | ---- | ------------------- | ----------------------------------------------------------- | | `0` | APPS | Third-party app connections (connect / disconnect / update) | | `1` | USERS | User creation and profile updates | | `2` | WORKFLOWS | Automation workflow changes | | `3` | SERVICE\_CATALOG | Service catalog items | | `4` | SECURITY | Login, logout, API key creation / deletion | | `5` | SKILL | AI skill changes | | `6` | WORKSPACES | Workspace settings changes | | `7` | TENANT\_MIGRATION | Sandbox import / export | | `8` | AGENT\_GROUPS | Agent group changes | | `9` | ACCESS\_MANAGEMENT | Role and access control changes | | `10` | AI\_AGENTS | AI agent changes | | `11` | AGENT\_AVAILABILITY | Agent availability updates | | `12` | CUSTOM\_OBJECTS | Custom object type changes | **Event Type IDs** (use with `attribute: "event_type"`) | ID | Event Type | | ---- | ------------ | | `0` | CONNECTED | | `1` | DISCONNECTED | | `2` | CREATED | | `3` | UPDATED | | `4` | ENABLED | | `5` | DISABLED | | `6` | DELETED | | `7` | IMPORT | | `8` | EXPORT | | `9` | RESTORED | | `10` | LOGIN | | `12` | LOGOUT | **Module → valid event types** | Module | Valid event type IDs | | ------------------------ | --------------------------------------------------- | | APPS (0) | 0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED) | | USERS (1) | 2 (CREATED), 3 (UPDATED) | | WORKFLOWS (2) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | SERVICE\_CATALOG (3) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | SECURITY (4) | 2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT) | | SKILL (5) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | WORKSPACES (6) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | TENANT\_MIGRATION (7) | 7 (IMPORT), 8 (EXPORT) | | AGENT\_GROUPS (8) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | ACCESS\_MANAGEMENT (9) | 2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED) | | AI\_AGENTS (10) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | AGENT\_AVAILABILITY (11) | 3 (UPDATED) | | CUSTOM\_OBJECTS (12) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | **Example** ```json [ { "attribute": "event_at", "operator": "IS_BETWEEN", "values": [ { "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" } ] }, { "attribute": "module", "operator": "IS_ANY_OF", "values": [ { "value": 1 }, { "value": 9 } ] }, { "attribute": "event_type", "operator": "IS_ANY_OF", "values": [ { "value": 2 }, { "value": 3 } ] }, { "attribute": "actor_id", "operator": "IS_ANY_OF", "values": [ { "value": 123 } ] } ] ``` ## Authorization #### X-Api-Key (header, string, required) ## Headers #### X-Workspace-Id (header, string) ## Body #### search\_key (body, string) Text search across log text, actor name, email, source IP, and event data #### filters (body, array of object) Structured filters (same shape as /audit-logs/list). Supported attributes - actor\_id, module, event\_type, event\_at. If event\_at is not supplied, defaults to the last 6 months. #### properties #### attribute (string) #### operator (enum (string)) #### values (array of object) #### cc\_emails (body, array of string) CC email addresses for the export notification ## Response #### 200 Successful response #### Request ```bash cURL curl -X POST 'https://{tenant}.atomicwork.com/api/v1/audit-logs/export' \ -H 'X-Api-Key: ' \ -H 'Content-Type: application/json' \ -d '{"search_key": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "cc_emails": ["string"]}' ``` ```javascript JavaScript const res = await fetch('https://{tenant}.atomicwork.com/api/v1/audit-logs/export', { method: 'POST', headers: { 'X-Api-Key': '', 'Content-Type': 'application/json', }, body: JSON.stringify({"search_key": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "cc_emails": ["string"]}), }); const data = await res.json(); ``` ```python Python import requests res = requests.post( 'https://{tenant}.atomicwork.com/api/v1/audit-logs/export', headers={'X-Api-Key': ''}, json={"search_key": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "cc_emails": ["string"]} ) data = res.json() ```