---
title: "Download an audit-log export chunk"
method: GET
path: "/audit-logs/export/chunk"
tags: ["Audit Logs"]
---

# Download an audit-log export chunk

`GET /audit-logs/export/chunk`

Download an organization's audit log records for a time range as a file, for archival, compliance, or offline analysis. For interactive browsing, use GET /audit-logs.

## Query parameters

- `start` string, date-time, required
- `end` string, date-time, required
- `auth_strategy` string
- `service` string
- `method` string
- `exclude_method` string[]
- `search` string
- `search_user_id` string[]
- `cursor` string
- `limit` integer
- `format` 'jsonl' | 'jsonl.gz'

## Response `200`

One chunk of audit log records.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

## Changes

- **2026-07-13** `b1aad48700bb` — 1 breaking
  - for the `query` request parameter `exclude_method`, the type/format was changed from `string`/`` to `array`/``
- **2026-07-01** `cfa11e428190` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/kernel/apis/kernel-api/changes/audit-logs/export/chunk/get.md)

---

[API](https://skmtc.dev/kernel/apis/kernel-api.md) · [All operations](https://skmtc.dev/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kernel/kernel-api/revisions/9e8ce9fcf5e1/schema)