---
title: "Export activity log feed"
method: GET
path: "/v1/audit/export"
tags: ["audit"]
---

# Export activity log feed

`GET /v1/audit/export`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/audit/export`
- Auth: HTTP bearer

Returns the activity log as a feed suitable for a log collector or SIEM tool. Unlike the regular activity log listing, results are returned oldest first, so a collector can page forward from a saved position without missing or re-reading events. Returns newline-delimited JSON by default; pass `?format=json` for a human-readable array. Use the `from` and `to` parameters for a half-open time window, and the `x-brix-next-cursor` and `x-brix-has-more` response headers to page through results.

**Notes.**
- Oldest first. The default body is NDJSON: one `AuditEvent` object per line. The next-page cursor is in the `X-Brix-Next-Cursor` header (empty on the last page) and `X-Brix-Has-More` is `1` or `0`.
- With `format=json` the body is JSON: `{ data: AuditEvent[], nextCursor: string | null }`.

## Query parameters

- `limit` integer
- `cursor` string
- `from` string
- `to` string
- `format` 'json'

## Response `200`

Success. The body is the file itself.

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: The token lacks the permission this operation needs (see `x-brix-permission`).
- `422`: `from` or `to` is not an ISO-8601 timestamp.
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/7c2741bcdb16?raw)