API reference
Audit export
Export the tamper-evident audit log as JSON or CSV — GET /v1/audit.
GET /v1/audit
Streams the org's audit chain, ordered by seq. Returns JSON
by default, or CSV with format=csv. Optionally appends a server-computed integrity summary.
Requires the audit:read scope and a Pro (or higher) plan.
Query parameters
| Param | Type | Default | Notes |
|---|---|---|---|
from | ISO 8601 | — | Only events at or after this time. |
to | ISO 8601 | — | Only events at or before this time. |
type | enum | — | Filter by audit event type. |
action | string | — | Filter by the action inside the event data. |
agent | string | — | Filter by the agent inside the event data. |
after | number | — | Cursor: return events with seq greater than this. |
limit | number | 500 | Page size, 1–1000. |
format | enum | json | json or csv. |
verify | boolean | false | Append an integrity summary. JSON only. |
verify=true with format=csv is rejected with 422 — the integrity summary is a JSON object,
so it is only emitted in the JSON response.
JSON response
{
"events": [
{
"seq": 1,
"prevHash": "0000000000000000000000000000000000000000000000000000000000000000",
"hash": "9f2b…",
"type": "approval.created",
"actor": "{\"type\":\"api_key\",\"id\":\"key_123\"}",
"data": { "action": "wire.transfer" },
"createdAt": "2026-07-05T12:00:00.000Z"
}
],
"verification": { "intact": true, "count": 1 }
}verification is present only when verify=true. See
audit hash chain for how to recompute intact offline.
Examples
# Full chain as JSON, with a server-side integrity check
curl "https://api.your-org.com/v1/audit?verify=true" \
-H "authorization: Bearer sk_live_..."
# One agent's events for June, as CSV
curl "https://api.your-org.com/v1/audit?agent=finance-bot&from=2026-06-01T00:00:00Z&to=2026-07-01T00:00:00Z&format=csv" \
-H "authorization: Bearer sk_live_..." -o audit.csv
# Page forward from a cursor
curl "https://api.your-org.com/v1/audit?after=500&limit=500" \
-H "authorization: Bearer sk_live_..."| Status | When |
|---|---|
200 | streams the export |
402 | plan below Pro |
403 | key lacks audit:read |
422 | invalid query (e.g. verify=true&format=csv) |