---
title: "Update"
method: POST
path: "/api/v1/systemlog/exports/{export_id}"
tags: ["System Log Exporter"]
---

# Update

`POST /api/v1/systemlog/exports/{export_id}`

Update a system log export by providing an export object and an update mask.

## Path parameters

- `export_id` string, required — The exportId field.

## Request body

- C1ApiSystemlogV1ExportServiceUpdateRequestInput — The ExportServiceUpdateRequest message.
  - `exporter` C1ApiSystemlogV1Exporter — The Exporter message. This message contains a oneof named export_to. Only a single field of the following list may be set at a time: - datasource
    - `createdAt` string, date-time, nullable
    - `datasource` C1ApiSystemlogV1ExportToDatasource — The ExportToDatasource message.
      - `datasourceId` string — The datasourceId field.
      - `format` 'EXPORT_FORMAT_UNSPECIFIED' | 'EXPORT_FORMAT_OCSF_JSON_ZSTD' | 'EXPORT_FORMAT_OCSF_JSON_GZIP' — The format field.
      - `prefix` string — The prefix field.
    - `deletedAt` string, date-time, nullable
    - `displayName` string — The displayName field.
    - `exportId` string — The exportId field.
    - `state` 'EXPORT_STATE_UNSPECIFIED' | 'EXPORT_STATE_EXPORTING' | 'EXPORT_STATE_WAITING' | 'EXPORT_STATE_ERROR' — The state field.
    - `updatedAt` string, date-time, nullable
    - `watermarkEventId` string — we've synchorized this far
  - `updateMask` string, nullable

## Response `200`

Successful response

- C1ApiSystemlogV1ExportServiceUpdateResponse — The ExportServiceUpdateResponse message.
  - `exporter` C1ApiSystemlogV1Exporter — The Exporter message. This message contains a oneof named export_to. Only a single field of the following list may be set at a time: - datasource
    - `createdAt` string, date-time, nullable
    - `datasource` C1ApiSystemlogV1ExportToDatasource — The ExportToDatasource message.
      - `datasourceId` string — The datasourceId field.
      - `format` 'EXPORT_FORMAT_UNSPECIFIED' | 'EXPORT_FORMAT_OCSF_JSON_ZSTD' | 'EXPORT_FORMAT_OCSF_JSON_GZIP' — The format field.
      - `prefix` string — The prefix field.
    - `deletedAt` string, date-time, nullable
    - `displayName` string — The displayName field.
    - `exportId` string — The exportId field.
    - `state` 'EXPORT_STATE_UNSPECIFIED' | 'EXPORT_STATE_EXPORTING' | 'EXPORT_STATE_WAITING' | 'EXPORT_STATE_ERROR' — The state field.
    - `updatedAt` string, date-time, nullable
    - `watermarkEventId` string — we've synchorized this far

## Changes

- **2026-08-21** `f2cf3228f366` — 4 breaking, 10 warning, 1 info
  - the request property `updateMask` became not nullable
  - the `exporter` request property type/format changed from `object`/`` to ``/``
  - added `#/components/schemas/c1.api.systemlog.v1.Exporter, subschema #2` to the `exporter` response property `oneOf` list for the response status `200`
  - the `exporter` response's property type/format changed from `object`/`` to ``/`` for status `200`
  - …11 more
- **2025-04-10** `17f9f3bcedd5` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/conductorone/apis/c1-api/changes/api/v1/systemlog/exports/:export_id/post.md)

---

[API](https://skmtc.dev/conductorone/apis/c1-api.md) · [All operations](https://skmtc.dev/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)