The audit trail as CSV, oldest first, streamed.
Organization admins only (403 organization_admin_required). API keys, connected apps and service accounts with audit:read can read and export where the organization has machine identities (otherwise 403 session_required); retention and legal holds change only with a person. Events come from the organization's log and its workspaces' logs and never hold secrets, codes or anything that identifies a head. Being introduced: 404 not_found until it is on for your organization. Columns: id, at, organization_id, workspace_id, source, actor_type, actor_id, actor_name, action, subject, data (JSON), ip. RFC 4180 with CRLF; a cell starting with =, +, - or @ is prefixed with a single quote so spreadsheets do not run it. Same limits and resuming as the JSONL export.
Request
- Base URL: https://api.50heads.com
- URL: https://api.50heads.com/v1/organizations/current/audit/export.csv
- Auth: one of:
- HTTP bearer
- OAuth 2 (authorization code, authorization URL https://auth.50heads.com/authorize, token URL https://auth.50heads.com/token; client credentials, token URL https://auth.50heads.com/token, scopes: audit:read)
Query parameters
<at>|<id> of the last event you have: the list's nextCursor, or the last line of an export to resume it.
Events at or after this time (ISO 8601, or a date).
Events before this time (ISO 8601); a bare date includes that whole day.
A user id, or system for 50heads itself.
An action (domain.added); a group for every action in it (organization, domain, member, sso, scim, question, billing, key, audit); or any action prefix (break_glass).
A workspace (team) id of this organization.
Response
The file.
Changes
No recorded changes to this operation across all 1 revision of this API.