Bulk Export Endpoints

Bulk Export Endpoints

Exports audit events to CSV as a background job instead of a single synchronous response. Start an export with a filter set, then poll the job until it completes and returns a signed download link. Requires a JWT Bearer token; creating an export requires manage level on the audit_log RBAC object.

Start an Export

Two endpoints start an export job. One is scoped to the whole organization, the other to a single project. Both accept the same filter body and return the same job object.

POST /v1/{org}/audit/export

Starts an org-scoped CSV export of audit events matching the given filters.

POST /v1/{org}/projects/{proj}/audit/export

Starts a project-scoped CSV export of audit events matching the given filters.

Path Parameters

Request Body

Content-Type: application/json

from and to are required — the API rejects a request that's missing either one, even if range is set. All other fields are optional.

Examples

Start an Org-Scoped Export: Last 30 Days, Critical Only

const response = await fetch(
  "https://api.intempt.com/v1/{orgName}/audit/export",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": "Bearer YOUR_JWT_TOKEN"
    },
    body: JSON.stringify({
      from: "2026-03-23T00:00:00Z",
      to: "2026-04-22T00:00:00Z",
      range: "30d",
      severity: "critical"
    })
  }
);

Start a Project-Scoped Export: Failed Logins for One Actor

const response = await fetch(
  "https://api.intempt.com/v1/{orgName}/projects/{projectName}/audit/export",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": "Bearer YOUR_JWT_TOKEN"
    },
    body: JSON.stringify({
      from: "2026-04-15T00:00:00Z",
      to: "2026-04-22T00:00:00Z",
      action: "auth.login",
      outcome: "failure",
      actorId: "u_42"
    })
  }
);

Responses

202 Accepted

Export job created. The job starts in pending status. At this point the response only includes the fields that are already known — rowCount, downloadUrl, completedAt, and expiresAt aren't set yet and are omitted entirely (not returned as null).

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "pending",
  "createdAt": "2026-04-22T12:00:00Z"
}

400 Bad Request

Returned when from/to are missing (even if range is set):

{
  "errors": [
    {
      "message": "Export requires 'from' and 'to' date range"
    }
  ]
}

401 Unauthorized

{
  "error": "unauthorized",
  "message": "Missing or invalid Bearer token."
}

403 Forbidden

{
  "error": "forbidden",
  "message": "You do not have 'view' permission on the audit_log resource."
}

Check Export Status

GET /v1/{org}/audit/export/{jobId}

Returns the current status of an export job. When status is completed, the response includes a downloadUrl — a relative API path (call it with the same Bearer token to download the CSV), not an absolute signed storage URL. Export files expire 24 hours after creation.

Path Parameters

Examples

const response = await fetch(
  "https://api.intempt.com/v1/{orgName}/audit/export/550e8400-e29b-41d4-a716-446655440000",
  {
    headers: { "Authorization": "Bearer YOUR_JWT_TOKEN" }
  }
);

Responses

200 OK: Completed

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "rowCount": 3847,
  "downloadUrl": "/v1/123/audit/export/550e8400-e29b-41d4-a716-446655440000/download",
  "createdAt": "2026-04-22T12:00:00Z",
  "completedAt": "2026-04-22T12:02:30Z",
  "expiresAt": "2026-04-23T12:00:00Z"
}

200 OK: Still Running

Same shape as pending — fields not yet known (rowCount, downloadUrl, completedAt, expiresAt) are omitted:

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "running",
  "createdAt": "2026-04-22T12:00:00Z"
}

400 Bad Request

Returned for a job ID that doesn't exist (not 404):

{
  "errors": [
    {
      "message": "Export job not found: 550e8400-e29b-41d4-a716-446655440000"
    }
  ]
}

Response Fields

Fields on the export job object, returned by both the start-export endpoints and the status endpoint.

Notes

• Authentication is a JWT Bearer token, validated on every request. See API Overview & Authentication for how to obtain one.
• The audit_log RBAC object gates access. Starting an export requires manage level. The service's general access model uses view level for reading events.