---
title: "The audit trail as JSON lines (application/x-ndjson), oldest first, streamed."
method: GET
path: "/v1/organizations/current/audit/export.jsonl"
tags: ["organizations"]
---

# The audit trail as JSON lines (application/x-ndjson), oldest first, streamed.

`GET /v1/organizations/current/audit/export.jsonl`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/audit/export.jsonl`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `audit:read`)

Organization admins only (403 `organization_admin_required`). API keys, connected apps and service accounts with `audit:read` can read and export where the organization has machine identities (otherwise 403 `session_required`); retention and legal holds change only with a person. Events come from the organization's log and its workspaces' logs and never hold secrets, codes or anything that identifies a head. Being introduced: 404 `not_found` until it is on for your organization. One AuditEvent per line, newline-terminated. Events written after the export starts are left for the next one. Up to 1,000,000 events per request: to resume, pass `cursor` as the last line's `<at>|<id>`. Each export is itself recorded (`audit.exported`).

## Query parameters

- `cursor` string: `<at>|<id>` of the last event you have: the list's `nextCursor`, or the last line of an export to resume it.
- `from` string: Events at or after this time (ISO 8601, or a date).
- `to` string: Events before this time (ISO 8601); a bare date includes that whole day.
- `actor` string: A user id, or `system` for 50heads itself.
- `action` string: An action (`domain.added`); a group for every action in it (`organization`, `domain`, `member`, `sso`, `scim`, `question`, `billing`, `key`, `audit`); or any action prefix (`break_glass`).
- `workspace` string: A workspace (team) id of this organization.

## Response `200`

JSON lines: one object per line, each newline-terminated. The schema is one line.

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)