---
title: "Export cluster events"
method: GET
path: "/clusters/{cluster_id}/events/export"
tags: ["Cluster Events"]
---

# Export cluster events

`GET /clusters/{cluster_id}/events/export`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/events/export`
- Auth: API key in header `API-Key`

Exports matching events as a CSV file. Returns `422` if the query matches more than 10,000 events
or the date range exceeds 90 days — narrow the filters or date range and retry.

Required scope: `clusters:events:read`

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `category` 'user' | 'admin', required: Keycloak event category.
- `start_time` string, date-time
- `end_time` string, date-time
- `realm` string: Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.
- `realm_id` string, uuid
- `client_ids` string[]
- `user_id` string, uuid
- `username` string
- `types` UserEventType[]
- `operation_types` AdminOperationType[]
- `error` string
- `search` string
- `order` 'asc' | 'desc': Sort direction.

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)