Export audit records as evidence

Every stored audit record in a range of at most 366 days, oldest first, as one JSON document (anlyon.audit.export.v1) or CSV, streamed as an attachment. Filter by environment, event type, category or governed action. Taking an export is itself recorded (audit.export.created) before any record is sent. Records older than the hot window are read back from the audit archive, checked against their checksums, and included in the same order; 503 AUDIT_ARCHIVE_UNAVAILABLE when the range holds archived records this server cannot reach, and the stream stops with AUDIT_ARCHIVE_INTEGRITY rather than leave out a record whose archived copy fails its check. Enterprise edition and Team plan. Needs audit:read.

GET/api/v2/audit/export

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Query parameters

fromstring<date-time>required

tostring<date-time>required

formatstring

default: "json"

Allowed:jsoncsv

environmentIdstring<uuid>

typestring

max length 1000

categoryAuditCategory

Allowed:approvalinvocationpolicyactionaccessenvironmentconnectionlimitaudit

actionstring

max length 200

endUserIdstring

max length 160

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Responses

200

Streamed attachment of every matching record, oldest first.

schemastringrequired

Allowed:anlyon.audit.export.v1

generatedAtstring<date-time>required

workspaceIdstring<uuid>required

filtersobjectrequired

eventsAuditEvent[]required

Show properties

Array of AuditEvent

schemastringrequired

Allowed:anlyon.audit.v1

idstringrequired

sequenceintegerrequired

typestringrequired

categoryAuditCategoryrequired

Allowed:approvalinvocationpolicyactionaccessenvironmentconnectionlimitaudit

occurredAtstring<date-time>required

workspaceIdstring<uuid>required

environmentIdstring<uuid> | nullrequired

Null for workspace-level records such as members and keys.

actorAuditActorrequired

Show properties

typestringrequired

Allowed:userapi_keyoauth_clientassistantpolicysystem

idstring | nullrequired

User id

onBehalfOfstring | null

For an OAuth client

resourceobject | nullrequired

Show properties

typestringrequired

idstringrequired

outcomestring | nullrequired

dataobjectrequired

Type-specific detail. Invocation records carry a receipt; approval records carry the policy decision.

contextobject | nullrequired

Show properties

requestIdstring

ipstring

userAgentstring

testboolean

Present only on a test event.

Allowed:true

backfilledboolean

Present only on a record created from history by the one-time backfill

Allowed:true

endUserIdstring

Present only on a record of an act for one of your end users. erased~<hash> once that end user is erased.

countintegerrequired

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

503

A required provider or platform dependency is not configured or available.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.fromquery*toquery*formatqueryenvironmentIdquerytypequerycategoryqueryactionqueryendUserIdquery

Request

curl -X GET 'https://api.anlyon.com/api/v2/audit/export?from=2019-08-24T14%3A15%3A22Z&to=2019-08-24T14%3A15%3A22Z' \
  -H 'Authorization: Bearer YOUR_TOKEN'

const response = await fetch("https://api.anlyon.com/api/v2/audit/export?from=2019-08-24T14%3A15%3A22Z&to=2019-08-24T14%3A15%3A22Z", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://api.anlyon.com/api/v2/audit/export?from=2019-08-24T14%3A15%3A22Z&to=2019-08-24T14%3A15%3A22Z",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "schema": "anlyon.audit.export.v1",
  "generatedAt": "2019-08-24T14:15:22Z",
  "workspaceId": "ef0efa32-d1c1-43d4-a5e2-fe7b4f00403c",
  "filters": {},
  "events": [
    {
      "schema": "anlyon.audit.v1",
      "id": "aud_V1StGXR8Z5jdHi6BmyT4a9Qe",
      "sequence": 1042,
      "type": "approval.vote",
      "category": "approval",
      "occurredAt": "2019-08-24T14:15:22Z",
      "workspaceId": "ef0efa32-d1c1-43d4-a5e2-fe7b4f00403c",
      "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
      "actor": {
        "type": "user",
        "id": "string",
        "onBehalfOf": "string"
      },
      "resource": {
        "type": "approval",
        "id": "apr_123"
      },
      "outcome": "approve",
      "data": {},
      "context": {
        "requestId": "string",
        "ip": "string",
        "userAgent": "string"
      },
      "test": true,
      "backfilled": true,
      "endUserId": "string"
    }
  ],
  "count": 0
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}