CentralCSP
APIAudit Logs

Export audit logs

Streams every matching entry as CSV, newest first, with the same filters as the list endpoint and no pagination. Each line carries the time, the action, who did it, what was affected, and the details of the change as JSON. Suitable as evidence for an assessor or for keeping your own archive.

Requires the admin role on the workspace.

GET
/v1/workspaces/{workspaceId}/audit-logs/export

Authorization

AuthorizationBearer <token>

An OpenID Connect access token issued by Keycloak, acting as the signed-in user.

In: header

Path Parameters

workspaceId*string

The workspace's id.

Query Parameters

action?string

Only entries for this action. Send an empty string for all.

Value in

  • ""
  • "workspace.updated"
  • "workspace.ownership_transferred"
  • "workspace.mfa_enforcement_changed"
  • "workspace.ai_integrations_changed"
  • "member.role_updated"
  • "member.removed"
  • "invitation.created"
  • "invitation.revoked"
  • "invitation.accepted"
  • "website.created"
  • "website.updated"
  • "website.settings_updated"
  • "website.deleted"
  • "website.reports_reset"
  • "website.subdomain_claimed"
  • "access.member_granted"
  • "access.member_revoked"
  • "access.group_granted"
  • "access.group_revoked"
  • "group.created"
  • "group.updated"
  • "group.deleted"
  • "group.member_added"
  • "group.member_removed"
  • "api_key.created"
  • "api_key.revoked"
  • "alert_channel.created"
  • "alert_channel.updated"
  • "alert_channel.deleted"
  • "alert_rule.created"
  • "alert_rule.updated"
  • "alert_rule.deleted"
  • "payment_page.created"
  • "payment_page.updated"
  • "payment_page.deleted"
  • "inventory_rule.created"
  • "inventory_rule.updated"
  • "inventory_rule.deleted"
  • "usage_alerts.recipients_updated"
actorId?string

Only changes made by this user.

targetType?string

Only entries about this kind of thing. Send an empty string for all.

Value in

  • ""
  • "workspace"
  • "member"
  • "invitation"
  • "website"
  • "group"
  • "access_grant"
  • "api_key"
  • "alert_channel"
  • "alert_rule"
  • "payment_page"
  • "inventory_rule"
targetId?string

Only entries about this specific thing.

from?string

Only entries at or after this time.

Formatdate-time
to?string

Only entries at or before this time.

Formatdate-time
search?string

Match part of the action, the target, or the actor's name or email.

Response Body

text/csv

curl -X GET "https://example.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/audit-logs/export"
"string"

Revoke an API key DELETE

Deletes the key. Requests using it are rejected from the next call onwards. There is no way to restore it, so issue a new key first if something depends on it.

List audit logs GET

Lists administrative changes made in this workspace, newest first: role changes, invitations, website and access changes, group edits, and API key activity.