---
title: "Signed SIEM export of governance events (NDJSON)"
method: GET
path: "/api/v1/audit/export"
tags: ["Governance"]
---

# Signed SIEM export of governance events (NDJSON)

`GET /api/v1/audit/export`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/audit/export`
- Auth: HTTP bearer

Streams `governance_events` as **signed NDJSON** (one event per line) for log-ingestion pipelines (Splunk / Elastic / Datadog) — the signed complement to the JSON pull of `/v1/events`. Alias: `GET /api/v1/events/export`.

Source is `governance_events` (key lifecycle, spend caps, `citation.broken`, incidents) — NOT `api_usage_stats` telemetry. The `payload` is the allowlisted projection → Zero-Retention by construction.

Same ownership scoping as `/v1/events` (child → own `api_key_id`; master → organization; solo → user).

**Signature (asymmetric — reuses the Ed25519 attestation key, NOT HMAC):** the response body is signed and verifiable OFFLINE against the **same public JWKS** as `GET /api/v1/attestations/keys`, with no shared secret. The signed material is `sha256(t + "." + body)` — the `t=<unix>` timestamp is part of what is signed (#M6), so an offline verifier MUST fold `t` into the digest and reject a header with no `t=`. Response headers:
- `X-Nexus-Export-Signature: t=<unix>,v1=<base64url(EdDSA(sha256(t + "." + body)))>`
- `X-Nexus-Signer-Key-Id: <kid>` — the JWK to verify against.
- `X-Nexus-Export-Count`, `X-Nexus-Export-Has-More`, `X-Nexus-Export-Next-Cursor`, `X-Nexus-Export-Format`, `X-Request-Id`.

Signing is best-effort: if the key is unavailable the export is still served, unsigned. Content-Type `application/x-ndjson`.

## Query parameters

- `type` string
- `since` string, date-time
- `until` string, date-time
- `format` 'jsonl' | 'ocsf'
- `cursor` string
- `limit` integer

## Response `200`

Signed NDJSON page (see signature headers).

## Other responses

- `400`: VALIDATION_ERROR — invalid `since`/`until`/`format`/`limit`/`cursor`.
- `401`: INVALID_API_KEY.
- `429`: RATE_LIMITED — RPM exceeded.

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)