---
title: "Staff Export Activity Data"
method: GET
path: "/activity/staff-export"
---

# Staff Export Activity Data

`GET /activity/staff-export`

Export Cygnal activity for an explicit organization (Gray Swan staff only).

Mirrors /activity/export, except org scope comes from the ``org_id``
parameter instead of the caller's API key, and only cygnal-code
red-teaming orgs may be exported.

## Query parameters

- `org_id` string, required — Organization ID whose activity to export
- `cursor` string, nullable — Cursor for pagination (ObjectId from previous response)
- `since` string, nullable — ISO 8601 timestamp to filter events after this time
- `until` string, nullable — ISO 8601 timestamp to filter events before this time
- `limit` integer — Maximum number of activity records to return
- `alarm_only` boolean — Only return events where alarm=True

## Response `200`

Successful Response

- ActivityExportResponse — Response format for exporting organization activity records.
  - `activities` object[], required
  - `next_cursor` string, nullable, required
  - `has_more` boolean, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

## Changes

- **2026-08-31** `f380b942ae4b` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/grayswan/apis/gray-swan-ai-api/changes/activity/staff-export/get.md)

---

[API](https://skmtc.dev/grayswan/apis/gray-swan-ai-api.md) · [All operations](https://skmtc.dev/grayswan/apis/gray-swan-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/grayswan/gray-swan-ai-api/revisions/f380b942ae4b/schema)