---
title: "Export the full filtered Event Logs set for a Shield Zone as CSV"
method: POST
path: "/shield/event-logs/{shieldZoneId}/export"
tags: ["Event Logs"]
---

# Export the full filtered Event Logs set for a Shield Zone as CSV

`POST /shield/event-logs/{shieldZoneId}/export`

## Request

- Base URL: `https://api.bunny.net`
- URL: `https://api.bunny.net/shield/event-logs/{shieldZoneId}/export`
- Auth: none declared
- TypeScript: <https://skmtc.dev/bunny/apis/bunny-shield-api/docs/shield/event-logs/:shieldZoneId/export/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `shieldZoneId` integer, required: The ID of the Shield Zone.

## Request body

- EventLogsExportRequest: Request body for exporting a Shield Zone's full filtered Event Logs set as CSV.
  - `from` integer: Window start as Unix time in milliseconds (UTC). Required.
  - `to` integer: Window end as Unix time in milliseconds (UTC). Required; must be after BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsExportRequest.from and within the last 72 hours.
  - `query` string, nullable: Optional free-text search across IP, ruleId, URL, User-Agent and rule name.
  - `filters` EventLogsFilter[], nullable: Optional filters, combined with AND. Repeated values within one filter combine with OR.
    - `field` string, nullable: Dimension to filter on: feature, ruleId, ip, ja4, ua, url, asn, country or action.
    - `op` string, nullable: Operator: eq, in, contains, cidr (ip only, IPv4/IPv6) or wildcard ('*' matches any run).
    - `value` string[], nullable: Value(s) for the filter; multiple values are OR-combined.

## Response `200`

OK

- string, binary

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error

## Changes

- **2026-11-12** `6a424e866a61`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bunny/apis/bunny-shield-api/changes/shield/event-logs/:shieldZoneId/export/post.md)

---

[API](https://skmtc.dev/bunny/apis/bunny-shield-api.md) - [All operations](https://skmtc.dev/bunny/apis/bunny-shield-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bunny/apis/bunny-shield-api/revisions/6a424e866a61?raw)