Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Export the audit log as CSV

GET

/v1/exports/audit-log.csv

const url = 'http://localhost:8080/v1/exports/audit-log.csv';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:8080/v1/exports/audit-log.csv \
  --header 'Authorization: Bearer <token>'

Streams the audit log for the caller’s mode (test or live), newest first, with no row limit. Settings changes are recorded in test mode, so they appear only in a test-mode export. Takes the same filters as the audit-log list, so the dashboard’s filters and its export give the same rows. The date filters are date_from/date_to; from/to are ignored here.

The export’s own export row is written before the file is sent. An unfiltered export includes it as the first data row; a filtered export includes it only if it matches the filters. Columns: id, created_at, actor_type, actor_id, actor_name, action, resource_type, resource_id, resource_label, ip_address, request_id, sim_effective_at, test_clock_id, metadata_json.

EXPORT_INCOMPLETE marker and formula escaping work as in the customers export.

Authorizations

BearerAuth

Parameters

Query Parameters

date_from

string

Lower bound on created_at, inclusive. RFC 3339 or YYYY-MM-DD.

date_to

string

Upper bound on created_at, inclusive. RFC 3339 or YYYY-MM-DD (end of that day, UTC).

resource_type

string

resource_id

string

action

string

actor_id

string

test_clock_id

string

Only rows from this test clock’s simulation.

sim_from

string

Lower bound on simulated time (sim_effective_at). RFC 3339 or YYYY-MM-DD.

sim_to

string

Upper bound on simulated time (sim_effective_at). RFC 3339 or YYYY-MM-DD.

Responses

200

CSV file (sent as an attachment).

text/csv

string

422

A date filter is malformed, or an upper bound is before its lower bound.

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

500

The export’s audit row could not be written; nothing was sent.

application/json

object

error

object

type

string

code

string

message

string

request_id

string

param

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}