KEkernel
Audit Logs

Retrieve an audit log export destination

Changed on

Retrieve details for a single audit log export destination by its ID.

get/audit-logs/export/destinations/{id}

Request

  • Base URL
    https://api.onkernel.com
  • URL
    https://api.onkernel.com/audit-logs/export/destinations/{id}
  • Auth
    HTTP bearer

Response

Audit log export destination

bucketstring required
consecutive_failuresinteger required
created_atstring date-time required
external_idstring required
format'jsonl.gz' required
idstring required
kernel_role_arnstring required

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

kms_key_idstring
last_errorstring

Sanitized description of the most recent delivery failure.

last_error_atstring date-time
last_exported_cursorstring

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_atstring date-time
next_attempt_atstring date-time
prefixstring required
regionstring required
role_arnstring required
status'active' | 'paused' required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

type's3' required
updated_atstring date-time required

Changes