Start an asynchronous CSV export of audit events and poll the job until the download link is ready.

Bulk Export Endpoints

Exports audit events to CSV as a background job instead of a single synchronous response. Start an export with a filter set, then poll the job until it completes and returns a signed download link. Requires a JWT Bearer token; creating an export requires manage level on the audit_log RBAC object.

Start an Export

Two endpoints start an export job. One is scoped to the whole organization, the other to a single project. Both accept the same filter body and return the same job object.

POST /v1/{org}/audit/export

Starts an org-scoped CSV export of audit events matching the given filters.

POST /v1/{org}/projects/{proj}/audit/export

Starts a project-scoped CSV export of audit events matching the given filters.

Path Parameters

Parameter	Type	Required	Description
`org`	integer	Yes	Numeric organization ID
`proj`	integer	Yes (project-scoped endpoint only)	Numeric project ID

Request Body

Content-Type: application/json

All fields are optional. Omitting every filter exports all events within the retention window.

Field	Type	Description
`from`	string (date-time)	Start of time range (ISO 8601)
`to`	string (date-time)	End of time range (ISO 8601)
`range`	string	Predefined time range shorthand: `24h`, `7d`, `30d`, `90d`, `all`. Overrides `from` and `to`.
`outcome`	string	Filter by event outcome: `success`, `failure`, `denied`
`severity`	string	Filter by severity, comma-separated (e.g. `warning,critical`)
`actorId`	string	Filter by actor ID
`actorType`	string	Filter by actor type: `user`, `system`, `api_key`, `integration`
`targetType`	string	Filter by target resource type
`targetId`	string	Filter by target resource ID
`action`	string	Filter by action prefix
`q`	string	Full-text search query

Examples

Start an Org-Scoped Export: Last 30 Days, Critical Only

const response = await fetch(
  "https://api.intempt.com/v1/123/audit/export",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": "Bearer YOUR_JWT_TOKEN"
    },
    body: JSON.stringify({
      range: "30d",
      severity: "critical"
    })
  }
);

Start a Project-Scoped Export: Failed Logins for One Actor

const response = await fetch(
  "https://api.intempt.com/v1/123/projects/456/audit/export",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": "Bearer YOUR_JWT_TOKEN"
    },
    body: JSON.stringify({
      action: "auth.login",
      outcome: "failure",
      actorId: "u_42"
    })
  }
);

Responses

202 Accepted

Export job created. The job starts in pending status.

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "orgId": 123,
  "projectId": null,
  "status": "pending",
  "filters": {
    "range": "30d",
    "severity": "critical"
  },
  "rowCount": null,
  "downloadUrl": null,
  "error": null,
  "createdAt": "2026-04-22T12:00:00Z",
  "completedAt": null,
  "expiresAt": null
}

400 Bad Request

{
  "error": "invalid_parameter",
  "message": "The 'limit' parameter must be between 1 and 200.",
  "details": {
    "parameter": "limit",
    "provided": 500,
    "maximum": 200
  }
}

401 Unauthorized

{
  "error": "unauthorized",
  "message": "Missing or invalid Bearer token."
}

403 Forbidden

{
  "error": "forbidden",
  "message": "You do not have 'view' permission on the audit_log resource."
}

Check Export Status

GET /v1/{org}/audit/export/{jobId}

Returns the current status of an export job. When status is completed, the response includes a signed downloadUrl valid for 1 hour. Export files expire 24 hours after creation.

Path Parameters

Parameter	Type	Required	Description
`org`	integer	Yes	Numeric organization ID
`jobId`	string (uuid)	Yes	Export job identifier

Examples

const response = await fetch(
  "https://api.intempt.com/v1/123/audit/export/550e8400-e29b-41d4-a716-446655440000",
  {
    headers: { "Authorization": "Bearer YOUR_JWT_TOKEN" }
  }
);

Responses

200 OK: Completed

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "orgId": 123,
  "projectId": null,
  "status": "completed",
  "filters": {
    "range": "30d",
    "severity": "critical"
  },
  "rowCount": 3847,
  "downloadUrl": "https://storage.intempt.com/audit-exports/550e8400.csv?sig=abc123&exp=1714000000",
  "error": null,
  "createdAt": "2026-04-22T12:00:00Z",
  "completedAt": "2026-04-22T12:02:30Z",
  "expiresAt": "2026-04-23T12:00:00Z"
}

200 OK: Still Running

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "orgId": 123,
  "projectId": null,
  "status": "running",
  "filters": {
    "range": "30d",
    "severity": "critical"
  },
  "rowCount": null,
  "downloadUrl": null,
  "error": null,
  "createdAt": "2026-04-22T12:00:00Z",
  "completedAt": null,
  "expiresAt": null
}

404 Not Found

{
  "error": "event_not_found",
  "message": "No audit event found with the given ID."
}

Response Fields

Fields on the export job object, returned by both the start-export endpoints and the status endpoint.

Field	Type	Description
`id`	string (uuid)	Unique job identifier
`orgId`	integer	Organization ID
`projectId`	integer, nullable	Project ID for project-scoped exports, null for org-scoped
`status`	string	Job status: `pending`, `running`, `completed`, `failed`
`filters`	object	Snapshot of the filters applied to this export
`rowCount`	integer, nullable	Number of events exported. Set when status is `completed`.
`downloadUrl`	string (uri), nullable	Signed URL for the CSV file, valid for 1 hour. Only present when status is `completed`.
`error`	string, nullable	Error message when status is `failed`
`createdAt`	string (date-time)	When the export job was created
`completedAt`	string (date-time), nullable	When the job finished (completed or failed)
`expiresAt`	string (date-time), nullable	When the export file is deleted, 24 hours after creation

Notes

Authentication is a JWT Bearer token, validated on every request. See API Overview & Authentication for how to obtain one.
The audit_log RBAC object gates access. Starting an export requires manage level. The service's general access model uses view level for reading events.

Bulk Export Endpoints

On this page