Signed SIEM export of governance events (NDJSON)
Streams governance_events as signed NDJSON (one event per line) for log-ingestion pipelines (Splunk / Elastic / Datadog) — the signed complement to the JSON pull of /v1/events. Alias: GET /api/v1/events/export.
Source is governance_events (key lifecycle, spend caps, citation.broken, incidents) — NOT api_usage_stats telemetry. The payload is the allowlisted projection → Zero-Retention by construction.
Same ownership scoping as /v1/events (child → own api_key_id; master → organization; solo → user).
Signature (asymmetric — reuses the Ed25519 attestation key, NOT HMAC): the response body is signed and verifiable OFFLINE against the same public JWKS as GET /api/v1/attestations/keys, with no shared secret. The signed material is sha256(t + "." + body) — the t=<unix> timestamp is part of what is signed (#M6), so an offline verifier MUST fold t into the digest and reject a header with no t=. Response headers:
- X-Nexus-Export-Signature: t=<unix>,v1=<base64url(EdDSA(sha256(t + "." + body)))>
- X-Nexus-Signer-Key-Id: <kid> — the JWK to verify against.
- X-Nexus-Export-Count, X-Nexus-Export-Has-More, X-Nexus-Export-Next-Cursor, X-Nexus-Export-Format, X-Request-Id.
Signing is best-effort: if the key is unavailable the export is still served, unsigned. Content-Type application/x-ndjson.
Request
- Base URL: https://legal.nexusquantum.legal
- URL: https://legal.nexusquantum.legal/api/v1/audit/export
- Auth: HTTP bearer
Query parameters
Comma-separated event types to filter (e.g. citation.broken,spend_cap.reached).
Only events with created_at >= since (ISO 8601).
Only events with created_at <= until (ISO 8601).
jsonl (raw NDJSON) or ocsf (OCSF Security Finding, class_uid 2001).
Opaque keyset cursor from a previous X-Nexus-Export-Next-Cursor.
Page size (default 1000, cap 10 000). Use cursor for more.
Response
Signed NDJSON page (see signature headers).
Changes
No recorded changes to this operation across all 1 revision of this API.