<!-- llms.txt: https://workos.com/llms.txt -->

# Audit Log Export

An object representing an Audit Log Export.

## Create Export

Create an Audit Log Export. Exports are scoped to a single organization within a specified date range.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/audit_logs/exports" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
        "range_start": "2022-07-02T18:09:06.996Z",
        "range_end": "2022-09-02T18:09:06.996Z",
        "actions": [
            "user.signed_in"
        ],
        "actor_names": [
            "Jon Smith"
        ],
        "targets": [
            "team"
        ]
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const auditLogExport = await workos.auditLogs.createExport({
  organizationId: 'org_01EHWNCE74X7JSDV0X3SZ3KJNY',
  rangeStart: new Date('2022-07-02T18:09:06.996Z'),
  rangeEnd: new Date('2022-09-02T18:09:06.996Z'),
  actions: ['user.signed_in'],
  actors: ['Jon Smith'],
  targets: ['team'],
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.audit_logs.create_export(
  organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT",
  range_start: "2022-07-02T18:09:06.996Z",
  range_end: "2022-09-02T18:09:06.996Z"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.audit_logs.create_export(
    organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT",
    range_start="2022-07-02T18:09:06.996Z",
    range_end="2022-09-02T18:09:06.996Z",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.AuditLogs().CreateExport(context.Background(), &workos.AuditLogsCreateExportParams{
		OrganizationID: "org_01EHZNVPK3SFK441A1RGBFSHRT",
		RangeStart:     "2022-07-02T18:09:06.996Z",
		RangeEnd:       "2022-09-02T18:09:06.996Z",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->auditLogs()
    ->createExport(
        organizationId: "org_01EHZNVPK3SFK441A1RGBFSHRT",
        rangeStart: "2022-07-02T18:09:06.996Z",
        rangeEnd: "2022-09-02T18:09:06.996Z",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.auditlogs.AuditLogsApi.CreateExportOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateExportOptions options = CreateExportOptions.builder()
                                  .organizationId("org_01EHZNVPK3SFK441A1RGBFSHRT")
                                  .rangeStart("2022-07-02T18:09:06.996Z")
                                  .rangeEnd("2022-09-02T18:09:06.996Z")
                                  .build();

workos.auditLogs.createExport(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.AuditLogs.CreateExportAsync(new AuditLogsCreateExportOptions {
    OrganizationId = "org_01EHZNVPK3SFK441A1RGBFSHRT",
    RangeStart = "2022-07-02T18:09:06.996Z",
    RangeEnd = "2022-09-02T18:09:06.996Z",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::audit_logs::CreateExportParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .audit_logs()
        .create_export(
            CreateExportParams {
                organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT".into(),
                range_start: "2022-07-02T18:09:06.996Z".into(),
                range_end: "2022-09-02T18:09:06.996Z".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "audit_log_export",
  "id": "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V",
  "state": "pending",
  "created_at": "2022-09-02T17:14:57.094Z",
  "updated_at": "2022-09-02T17:14:57.094Z"
}
```

:::

## Get Export

Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/audit_logs/exports/audit_log_export_01GBZK5MP7TD1YCFQHFR22180V" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const auditLogExport = await workos.auditLogs.getExport(
  'audit_log_export_01GBZK5MP7TD1YCFQHFR22180V',
);
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.audit_logs.get_export(audit_log_export_id: "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.audit_logs.get_export(
    audit_log_export_id="audit_log_export_01GBZK5MP7TD1YCFQHFR22180V"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.AuditLogs().GetExport(context.Background(), "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->auditLogs()
    ->getExport(
        auditLogExportId: "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.auditLogs.getExport("audit_log_export_01GBZK5MP7TD1YCFQHFR22180V");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.AuditLogs.GetExportAsync("audit_log_export_01GBZK5MP7TD1YCFQHFR22180V");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .audit_logs()
        .get_export("audit_log_export_01GBZK5MP7TD1YCFQHFR22180V")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "audit_log_export",
  "id": "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V",
  "state": "ready",
  "url": "https://exports.audit-logs.com/audit-log-exports/export.csv",
  "created_at": "2022-09-02T17:14:57.094Z",
  "updated_at": "2022-09-02T17:14:57.094Z"
}
```

:::

> The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.

### audit_log_export

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "audit_log_export" | Yes | Distinguishes the Audit Log Export object. |
| `id` | string | Yes | The unique ID of the Audit Log Export. |
| `created_at` | string | Yes | The timestamp when the Audit Log Export was created. |
| `updated_at` | string | Yes | The timestamp when the Audit Log Export was last updated. |
| `state` | "pending" \| "ready" \| "error" | Yes | The state of the export. Possible values: `pending` `ready` `error`. |
| `url` | string | No | A URL to the CSV file. Only defined when the Audit Log Export is ready. |

### POST /audit_logs/exports

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | Yes | The unique ID of the Organization. |
| `range_start` | string | Yes | ISO-8601 value for start of the export range. |
| `range_end` | string | Yes | ISO-8601 value for end of the export range. |
| `actions` | string[] | No | List of actions to filter against. |
| `actors` | string[] | No | Deprecated. Use `actor_names` instead. |
| `actor_names` | string[] | No | List of actor names to filter against. |
| `actor_ids` | string[] | No | List of actor IDs to filter against. |
| `targets` | string[] | No | List of target types to filter against. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `audit_log_export` | object | Distinguishes the Audit Log Export object. |

### GET /audit_logs/exports/{auditLogExportId}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `auditLogExportId` | string | Yes | The unique ID of the Audit Log Export. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `audit_log_export` | object | Distinguishes the Audit Log Export object. |