Export audit logs to CSV

POST https://{tenant}.atomicwork.com/api/v1/audit-logs/export

Triggers an export of audit logs to CSV file. The export is processed asynchronously and an email with download link is sent upon completion.

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
`attribute`	string	The field to filter on (see Supported attributes below)
`operator`	string	Comparison operator (see Available operators below)
`values`	array	One or more `\{ "value": \<scalar> \}` objects

Export audit logs to CSV · Atomicwork | Product

Attribute	Typical operator	Description
`event_at`	`IS_BETWEEN`	Event timestamp. Requires exactly two values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted.
`actor_id`	`IS_ANY_OF`	Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`).
`module`	`IS_ANY_OF`	Module integer ID (not the name). See the Module IDs reference table below.
`event_type`	`IS_ANY_OF`	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Operator	Meaning
`EQUALS`	Exact match
`NOT_EQUALS`	Exclude exact match
`IN` / `IS_ANY_OF`	Match any value in the list
`IS_NOT_ANY_OF`	Exclude all listed values
`IS_BETWEEN`	Inclusive range — pass exactly two values: `[start, end]`
`IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER`	Date/time boundary comparisons
`CONTAINS` / `TEXT_CONTAINS`	Substring or set membership
`IS_NULL` / `IS_NOT_NULL`	Null checks — `values` array can be empty
`STARTS_WITH` / `ENDS_WITH`	String prefix/suffix match

ID	Module	What it covers
`0`	APPS	Third-party app connections (connect / disconnect / update)
`1`	USERS	User creation and profile updates
`2`	WORKFLOWS	Automation workflow changes
`3`	SERVICE_CATALOG	Service catalog items
`4`	SECURITY	Login, logout, API key creation / deletion
`5`	SKILL	AI skill changes
`6`	WORKSPACES	Workspace settings changes
`7`	TENANT_MIGRATION	Sandbox import / export
`8`	AGENT_GROUPS	Agent group changes
`9`	ACCESS_MANAGEMENT	Role and access control changes
`10`	AI_AGENTS	AI agent changes
`11`	AGENT_AVAILABILITY	Agent availability updates
`12`	CUSTOM_OBJECTS	Custom object type changes

ID	Event Type
`0`	CONNECTED
`1`	DISCONNECTED
`2`	CREATED
`3`	UPDATED
`4`	ENABLED
`5`	DISABLED
`6`	DELETED
`7`	IMPORT
`8`	EXPORT
`9`	RESTORED
`10`	LOGIN
`12`	LOGOUT

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]

cURL

curl -X POST 'https://{tenant}.atomicwork.com/api/v1/audit-logs/export' \
  -H 'X-Api-Key: <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"search_key": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "cc_emails": ["string"]}'

Export audit logs to CSV

Filtering

Export audit logs to CSV

Filtering

Authorization

Headers

Body

Response

Filtering

Filtering

Authorization

Headers

Body

properties

Response