> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Export the organisation audit log with an API token

> Bearer twin of GET /org/organisation/audit-logs/export for scheduled jobs such as SIEM forwarding. Accepts a personal or service-account API token; the token (its scopes and its role) must hold audit.read in the organisation. Same filters, formats, 100000-row cap and organisation scope as the session export. The organisation is the token's own, or the one named by the X-Ankra-Organisation-Id header when the token's user is a member of it; a service-account token cannot leave its organisation.



## OpenAPI

````yaml https://platform.ankra.app/openapi.json get /api/v1/org/organisation/audit-logs/export
openapi: 3.1.0
info:
  title: FastAPI
  version: 0.1.0
servers:
  - url: https://platform.ankra.app
security: []
tags:
  - name: Organisation IAM
    description: >-
      Custom organisation roles and scoped role assignments for member and
      service-account identities.
  - name: Clusters
    description: Create, inspect and manage clusters, and the stacks deployed on them.
  - name: Managed Clusters
    description: Provider-managed control planes, driven through one common surface.
  - name: Imported Clusters
    description: Clusters that already existed and were connected to Ankra.
  - name: Cluster Access
    description: Kubeconfigs, service-account tokens and per-cluster access grants.
  - name: Kubernetes
    description: Read and act on the Kubernetes objects inside a cluster.
  - name: AWS Clusters
    description: >-
      Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in
      your own VPC.
  - name: Ankra Cloud Clusters
    description: >-
      Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud
      servers: a private network, a NAT router and a bastion per cluster.
  - name: DigitalOcean Clusters
    description: Provision and manage DigitalOcean Kubernetes clusters.
  - name: Hetzner Clusters
    description: Provision and manage Hetzner Kubernetes clusters.
  - name: OVH Clusters
    description: Provision and manage OVH Kubernetes clusters.
  - name: Scaleway Clusters
    description: Provision and manage Scaleway Kapsule clusters.
  - name: UpCloud Clusters
    description: Provision and manage UpCloud Kubernetes clusters.
  - name: Applications
    description: Deploy, configure and observe applications across the fleet.
  - name: Pipelines
    description: Pipeline definitions and the approval of the authority they declare.
  - name: Backups
    description: >-
      Backup vaults, restore points, protection posture and captures for stacks
      and application deployments; a completed capture is not a verified
      restore.
  - name: Stack Profiles
    description: Reusable stack definitions, their versions and sharing.
  - name: Services
    description: >-
      Versioned service packages and explicit sharing. Runtime admission is
      separate from publication.
  - name: Charts
    description: Browse the chart catalogue behind stacks and addons.
  - name: Helm
    description: Helm registries, credentials and the charts they expose.
  - name: Executions
    description: Long-running platform executions and their jobs.
  - name: Operations
    description: Cancel in-flight cluster operations and their jobs.
  - name: Chat
    description: Conversational sessions, plans and confirmable actions.
  - name: AI Management
    description: >-
      Customer agent lifecycle, authenticated identity and organisation
      automation controls.
  - name: AI Agent Runs
    description: Autonomous agent runs and their outcomes.
  - name: AI Tickets
    description: The AI ticket board, its sync connections and settings.
  - name: AI Playbooks
    description: Reusable playbooks the AI lanes execute.
  - name: AI Conditions
    description: Conditions that gate AI autonomy.
  - name: AI Remediation
    description: >-
      The organisation's auto-remediation policy: what the AI lanes may fix by
      themselves, and who approves the rest.
  - name: AI Engineering Handoffs
    description: Work the AI lanes escalate to a human engineer.
  - name: AI Environment
    description: The environment and base stacks AI demos deploy into.
  - name: Security
    description: Findings, advisories, SBOMs, compliance and posture.
  - name: Cost
    description: Cluster and fleet cost, rate cards and cost settings.
  - name: Decisions
    description: >-
      The decision ledger behind the Security and Cost queues: proposals a
      surface computed, the approve and set-aside decisions people took on them,
      and the receipts of running them.
  - name: Billing
    description: Subscription and spend caps.
  - name: Organisation
    description: Members, invitations, audit logs and organisation settings.
  - name: Account Tokens
    description: Personal access tokens for the API and CLI.
  - name: Credentials
    description: The shared credential store.
  - name: AWS Credentials
    description: >-
      AWS credentials: access keys or CloudFormation-onboarded STS roles for
      cost, EKS and self-managed provisioning.
  - name: Ankra Cloud Credentials
    description: >-
      Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud
      lanes.
  - name: Azure Credentials
    description: Azure credentials and SSH keys.
  - name: DigitalOcean Credentials
    description: DigitalOcean credentials and SSH keys.
  - name: Hetzner Credentials
    description: Hetzner credentials and SSH keys.
  - name: OVH Credentials
    description: OVH credentials and SSH keys.
  - name: Scaleway Credentials
    description: Scaleway credentials.
  - name: UpCloud Credentials
    description: UpCloud credentials and SSH keys.
  - name: Data Source Credentials
    description: Credentials for metrics and log sources.
  - name: DNS Credentials
    description: Credentials for DNS providers.
  - name: Object Storage Buckets
    description: >-
      Buckets Ankra creates and manages on an organisation's own provider
      credentials.
  - name: DNS
    description: DNS zones and records, including custom organisation zones.
  - name: Cloudflare
    description: Cloudflare domains and the credentials behind them.
  - name: Variables
    description: Organisation- and cluster-scoped variables.
  - name: SOPS
    description: Encrypt and decrypt values with the organisation SOPS config.
  - name: Alerts
    description: Alert integrations and ingest credentials.
  - name: Notifications
    description: Notification routes and their delivery targets.
  - name: Support
    description: Support tickets.
  - name: AI Settings
    description: Organisation AI provider, model catalog and per-function model settings
paths:
  /api/v1/org/organisation/audit-logs/export:
    get:
      tags:
        - Organisation
      summary: Export the organisation audit log with an API token
      description: >-
        Bearer twin of GET /org/organisation/audit-logs/export for scheduled
        jobs such as SIEM forwarding. Accepts a personal or service-account API
        token; the token (its scopes and its role) must hold audit.read in the
        organisation. Same filters, formats, 100000-row cap and organisation
        scope as the session export. The organisation is the token's own, or the
        one named by the X-Ankra-Organisation-Id header when the token's user is
        a member of it; a service-account token cannot leave its organisation.
      operationId: export_org_audit_logs_api_v1
      parameters:
        - description: >-
            Download format; csv answers text/csv, json answers the
            OrgAuditLogExportResponse document.
          in: query
          name: format
          required: false
          schema:
            default: csv
            enum:
              - csv
              - json
            type: string
        - in: query
          name: search
          required: false
          schema:
            type: string
        - in: query
          name: user_id
          required: false
          schema:
            type: string
            format: uuid
        - in: query
          name: action_type
          required: false
          schema:
            type: string
        - in: query
          name: resource_type
          required: false
          schema:
            type: string
        - in: query
          name: start_date
          required: false
          schema:
            type: string
            format: date-time
        - in: query
          name: end_date
          required: false
          schema:
            type: string
            format: date-time
        - in: query
          name: actor_type
          required: false
          schema:
            enum:
              - agent
              - human
              - system
            type: string
        - in: query
          name: outcome
          required: false
          schema:
            enum:
              - succeeded
              - failed
            type: string
        - description: Narrow the export to one cluster's slice of the organisation trail.
          in: query
          name: cluster_id
          required: false
          schema:
            type: string
            format: uuid
        - in: query
          name: agent_task_id
          required: false
          schema:
            type: string
            format: uuid
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgAuditLogExportResponse'
            text/csv:
              schema:
                type: string
          description: >-
            The audit trail as an attachment, capped at 100000 rows; a capped
            CSV carries the X-Ankra-Export-Truncated: true response header, a
            capped JSON document sets truncated.
        '400':
          description: >-
            Missing bearer token or malformed Authorization /
            X-Ankra-Organisation-Id header
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgAuditDetailError'
        '401':
          description: Invalid, expired or revoked API token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgAuditDetailError'
        '403':
          description: >-
            The token's scopes or the principal's role lack audit.read, or the
            token's user is not a member of the requested organisation
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/SecurityPermissionDenied'
                  - $ref: '#/components/schemas/OrgAuditDetailError'
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Request validation error
        '500':
          description: Internal server error
        '503':
          description: Authorisation service unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrgAuditDetailError'
      security:
        - BearerAuth: []
components:
  schemas:
    OrgAuditLogExportResponse:
      properties:
        entries:
          items:
            $ref: '#/components/schemas/OrgAuditLogExportEntry'
          type: array
        truncated:
          type: boolean
      required:
        - entries
        - truncated
      type: object
    OrgAuditDetailError:
      properties:
        detail:
          type: string
      required:
        - detail
      type: object
    SecurityPermissionDenied:
      properties:
        detail:
          enum:
            - permission_denied
          type: string
        permission:
          type: string
        scope_type:
          type: string
      required:
        - detail
        - permission
        - scope_type
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    OrgAuditLogExportEntry:
      properties:
        action_type:
          type: string
        actor_type:
          enum:
            - agent
            - human
            - system
          type: string
        cluster_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
        cluster_name:
          anyOf:
            - type: string
            - type: 'null'
        created_at:
          type: string
          format: date-time
        details:
          type: object
        ip_address:
          anyOf:
            - type: string
            - type: 'null'
        outcome:
          enum:
            - succeeded
            - failed
            - unknown
          type: string
        resource_id:
          anyOf:
            - type: string
            - type: 'null'
        resource_type:
          type: string
        target_kind:
          type: string
        target_name:
          type: string
        user_email:
          type: string
        user_id:
          anyOf:
            - type: string
              format: uuid
            - type: 'null'
      required:
        - created_at
        - user_email
        - user_id
        - action_type
        - resource_type
        - resource_id
        - ip_address
        - details
        - cluster_id
        - cluster_name
        - actor_type
        - target_kind
        - target_name
        - outcome
      type: object
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    BearerAuth:
      bearerFormat: PAT
      scheme: bearer
      type: http

````