Events

Export the whole filtered event set as CSV or JSON

Takes the SAME body as /api/get_all_events_with_count/ and returns every matching event as a downloadable file rather than one page as JSON. It shares that endpoint's request parsing, so the filters, the monthly per-view quota, the suppression bucket and the impact-tag predicate all mean exactly what they mean on the events page: the file covers the rows the screen was showing, never a different set. Any cursor in the body is ignored, because an export is the whole set rather than the page you had scrolled to. Unlike the list, every row carries the heavy fields (page URL and call site, origin, repr_created and trace), since a finding you cannot reproduce is not worth exporting. taint_chain is the forensic chain and is blank for non-admin accounts, matching GET /api/event/{id}; the column is present either way so a non-admin file and an admin file stay diffable. The export is capped at 50000 rows: CSV announces the cap as a final row beginning TRUNCATED, and JSON sets truncated to true, because a silent stop at the cap is indistinguishable from having found exactly that many events.

This is a read: a read-only API key may call it.

post/api/events_export

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/events_export
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Query parameters

formatstring

csv (the default) or json. Any other value is a 400 naming the two, never a silent fallback.

Request body

cursorstring

Opaque pagination cursor from a prior next_cursor.

sortstring

List order: newest (the default) or severity (critical first, then high, medium, low and info, newest first within each; events with no recognised severity last). Both orders list the same events. A cursor only continues the order that produced it: a cursor from the other order is a 400, so start again without one when changing order. Any other value is a 400.

whitelist_reprstring regex

Show only events whose sink label (the where field) matches this regex, case-insensitively. Despite the name, it is not matched against the repr. An invalid regex is a 400.

blacklist_reprstring regex

Hide events whose sink label (the where field) matches this regex, case-insensitively. Despite the name, it is not matched against the repr. An invalid regex is a 400.

fromstring

Lower time bound (RFC3339 or YYYY-MM-DD).

tostring

Upper time bound (RFC3339 or YYYY-MM-DD, inclusive of the whole day).

machinestring

Restrict to one machine by display name (exact match).

severitystring[]

Severity levels to include: critical, high, medium, low, info. Unknown values are ignored.

sourcesstring[]

Taint-source categories to include, matched against the event's origin: socket, file, stdin, env, argv, manual, fuzzer, foreign. Unknown values are ignored.

tagsstring[]

Restrict to events carrying any of these impact class labels (e.g. sqli, xss). An unknown label is a 400.

labelsinteger[]

Restrict to events carrying any of these triage label ids (your own, from GET /api/event_labels/).

xss_onlyboolean

es-chromium only: keep just the events whose sink can end in script execution. Must be sent with view=browser; with any other view it is a 400.

scopeobject

The events page's scope bar, as {mode, value, include_empty}: mode is is, ends (suffix) or regex, matched against the event's scope key (see scope on GET /api/event_view_counts/). A scope with no mode or no value is ignored; an unknown mode or an invalid regex is a 400.

advancedobject

The condition builder, as {match, conditions}: match is all (default) or any, and each condition is {field, op, value, negate}. The fields available depend on the view; an unknown field or an invalid value is a 400.

viewstring

Agent kind to include: python, browser, go, c, cpp, rust, node, solidity, java, bash, ruby or php. Omitted or empty = every view your account holds, which is what the pre-views clients this field exists for still get. Naming a view your account does not hold is a 403; if no products are enabled at all, even the omitted form is a 403. Any unrecognised value is a 400, never a silent empty page.

bucketstring

Sanitizer visibility bucket: live (the default, unsuppressed rows only), suppressed, or all. This was briefly named view during development; view now always means the agent kind above.

Response

OK.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.