---
title: "Export the audit log as CSV."
method: GET
path: "/api/audit/export"
tags: ["Audit Log"]
---

# Export the audit log as CSV.

`GET /api/audit/export`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/audit/export`
- Auth: HTTP bearer

Returns the audit log for a range of whole days as CSV, most recent first. from and to are dates (YYYY-MM-DD), both inclusive, read in zone (an IANA time zone such as UTC or America/New_York), or in the server's time zone when zone is omitted. to may be at most 30 days after from. Returns up to limit events (default 100, at most 1000; a larger value is treated as the maximum, and zero or less as the default). The X-Philter-Export-Truncated header is true when more remain, and X-Philter-Export-Next-Cursor then gives the cursor to request the next page with. Events are ordered by timestamp and then id, and a cursor continues after the last event of its page, so paging by cursor returns each event exactly once even while events are being written, including each page's own audit event. offset, with X-Philter-Export-Next-Offset, is kept for paging a range that is no longer receiving events; on a range that includes the current day it can repeat events across pages. Give offset or cursor, not both. Timestamps in the CSV are UTC. The export is itself audited. Requires an administrator as well as the audit:read scope. Requires the `audit:read` scope.

## Query parameters

- `from` string
- `to` string
- `zone` string
- `offset` integer
- `cursor` string
- `limit` integer

## Headers

- `Authorization` string, required

## Response `200`

The CSV. Headers give the row count, whether it was truncated, and the time zone used.

## Other responses

- `400`: A date is missing or not YYYY-MM-DD, the range is reversed or longer than the maximum, the zone is not a time zone, offset is negative or not a number, the cursor is not one from an export page, both offset and cursor were given, or limit is not a number. The body says which.
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold audit:read, or the caller is not an administrator.
- `404`: Not Found
- `406`: No representation matches Accept.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-17** `fddc8a37e181`: 1 breaking
  - the response's body type changed from `object` to `string` for status `200`
- **2026-10-10** `a3caeefae524`: 1 breaking, 1 info
  - for the `query` request parameter `offset`, default value `0` was removed
  - added the new optional `query` request parameter `cursor`
- **2026-10-10** `c4f85daa9208`: 13 info
  - added the non-success response with the status `404`
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `413` status
  - …9 more
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more
- **2026-10-05** `acc95b1441ef`: 2 info
  - added the new optional `query` request parameter `limit`
  - added the new optional `query` request parameter `offset`

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/audit/export/get.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)