# Export the audit log

`GET /app/audit-log/export`

The same events as CSV, at most 50,000 rows. At most 10 an hour per workspace. Also limited per workspace: 10 a hour.

Scope: `audit:read`.

## Parameters

- `category` (query, string) One of: `auth`, `team`, `settings`, `project`, `asset`, `discovery`, `scan`, `schedule`, `issue`, `assessment`, `ai`, `billing`, `integration`, `workspace`, `platform`, `audit`.
- `action` (query, string) One of: `auth.register`, `auth.register_blocked`, `auth.verify_email`, `auth.forgot_password`, `auth.reset_password`, `auth.resend_verification`, `auth.login_success`, `auth.login_failed`, `auth.login_throttled`, `auth.login_mfa_required`, `auth.mfa_failed`, `auth.mfa_throttled`, `auth.mfa_setup_started`, `auth.mfa_enabled`, `auth.mfa_disabled`, `auth.mfa_codes_regenerated`, `auth.provider_login`, `auth.provider_login_failed`, `auth.provider_signup_started`, `auth.provider_linked`, `auth.provider_unlinked`, `auth.invite_accepted`, `auth.email_change_requested`, `auth.email_change_cancelled`, `auth.email_changed`, `auth.password_changed`, `auth.password_set`, `auth.profile_updated`, `auth.logout`, `auth.session_revoked`, `auth.other_sessions_revoked`, `auth.session_replay_revoked`, `auth.admin_login_success`, `auth.admin_login_failed`, `auth.admin_login_throttled`, `auth.admin_login_mfa_required`, `auth.admin_mfa_failed`, `auth.admin_mfa_throttled`, `auth.admin_mfa_setup_started`, `auth.admin_mfa_enabled`, `auth.admin_mfa_disabled`, `auth.admin_mfa_codes_regenerated`, `auth.admin_email_change_requested`, `auth.admin_email_change_cancelled`, `auth.admin_email_changed`, `auth.admin_password_changed`, `auth.admin_profile_updated`, `auth.admin_logout`, `auth.admin_session_revoked`, `auth.admin_other_sessions_revoked`, `auth.admin_session_replay_revoked`, `account.notification_preferences_updated`, `account.unsubscribed`, `invite.sent`, `invite.cancelled`, `invite.resent`, `member.created`, `member.updated`, `member.role_changed`, `member.password_reset`, `member.removed`, `member.deleted_all`, `workspace.ownership_transferred`, `settings.sla_updated`, `settings.security_updated`, `settings.notifications_updated`, `settings.updated`, `api_key.created`, `api_key.revoked`, `oauth_app.created`, `oauth_app.updated`, `oauth_app.secret_rotated`, `oauth_app.deleted`, `oauth_app.disabled`, `oauth_app.enabled`, `oauth_app.connected`, `oauth_app.disconnected`, `project.created`, `project.updated`, `project.deleted`, `project.deleted_all`, `asset.created`, `asset.updated`, `asset.deleted`, `asset.revalidated`, `asset.ownership_verified`, `asset.ownership_set`, `asset.scanners_changed`, `asset.deleted_all`, `discovery.run_started`, `discovery.hosts_added`, `discovery.host_ignored`, `discovery.host_restored`, `scan.started`, `scan.refused`, `scan.deleted`, `scan.deleted_all`, `schedule.created`, `schedule.updated`, `schedule.deleted`, `issue.status_changed`, `issue.resolved`, `issue.reopened`, `issue.in_progress`, `issue.dismissed`, `issue.undismissed`, `issue.assigned`, `issue.unassigned`, `issue.due_date_changed`, `issue.updated`, `issue.comment_added`, `issue.comment_edited`, `issue.comment_deleted`, `issue.opened`, `issue.auto_resolved`, `issue.auto_reopened`, `issue.severity_changed`, `issue.dismissal_expired`, `issue.created`, `issue.deleted`, `issue.deleted_all`, `finding.deleted`, `finding.deleted_all`, `assessment.generated`, `assessment.shared`, `assessment.share_revoked`, `assessment.deleted`, `ai.conversation_renamed`, `ai.conversation_deleted`, `ai.action_declined`, `billing.plan_chosen`, `billing.upgrade_requested`, `billing.change_scheduled`, `billing.change_cancelled`, `billing.cancelled`, `billing.resumed`, `billing.details_updated`, `billing.card_made_default`, `billing.card_removed`, `billing.plan_set`, `billing.discount_set`, `billing.limits_set`, `billing.invoice_created`, `billing.tax_set`, `billing.invoice_marked_paid`, `billing.invoice_voided`, `billing.receipt_resent`, `billing.unapplied_resolved`, `workspace.created`, `workspace.updated`, `workspace.suspended`, `workspace.reactivated`, `workspace.deleted`, `workspace.deleted_all`, `administrator.created`, `administrator.updated`, `administrator.deleted`, `scanner.updated`, `emerging_threat.released`, `ai_settings.updated`, `ai_logs.cleared`, `scanner_logs.cleared`, `service_logs.cleared`, `ticket.updated`, `ticket.deleted`, `blog.post_created`, `blog.post_updated`, `blog.post_deleted`, `blog.posts_deleted_all`, `blog.image_uploaded`, `integration.connected`, `integration.updated`, `integration.route_created`, `integration.route_updated`, `integration.route_deleted`, `integration.tested`, `integration.paused`, `integration.resumed`, `integration.reconnect_needed`, `integration.reconnected`, `integration.disconnected`, `integration.delivery_resent`, `integration.issues_sent`, `integration.identity_linked`, `integration.identity_unlinked`, `integration.ticket_created`, `integration.ticket_linked`, `integration.ticket_unlinked`, `integration.ticket_closed`, `integration.ticket_reopened`, `issue.fix_reported`, `audit.exported`.
- `actor` (query, string)
- `hideAutomatic` (query, string) One of: `true`, `false`.
- `targetType` (query, string)
- `targetId` (query, string)
- `from` (query, string)
- `to` (query, string)
- `q` (query, string)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/audit-log/export" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The matching events as CSV, newest first, at most 50,000 rows

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.