Sign in
Audit Logs

Create an audit log export destination

Create a paused destination. Activate it with a status update once the destination test passes. Requires an active Enterprise plan.

post/audit-logs/export/destinations

Request body

bucketstring required
format'jsonl.gz' required
kms_key_idstring
prefixstring required
regionstring required
role_arnstring required
type's3' required

Response

Audit log export destination created

bucketstring required
consecutive_failuresinteger required
created_atstring date-time required
external_idstring required
format'jsonl.gz' required
idstring required
kernel_role_arnstring required

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

kms_key_idstring
last_errorstring

Sanitized description of the most recent delivery failure.

last_error_atstring date-time
last_exported_cursorstring

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_atstring date-time
next_attempt_atstring date-time
prefixstring required
regionstring required
role_arnstring required
status'active' | 'paused' required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

type's3' required
updated_atstring date-time required

Changes