Skip to content
MCP Gateway

Create an async metadata-only audit evidence export job.

POST
/v1/audit/exports

Uses the same filters as audit search. Actor identity is derived from auth context; clients must not send actor_id. Every accepted export request is audited by export_id and filters hash, not raw rows.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
object
tenant_id
string
>= 1 characters
environment_id
string
>= 1 characters
user_id
string
agent_id
string
server_id
string
tool_id
string
client_surface_id
string
client_session_id
string
backend_session_id
string
request_id

Optional request-chain filter.

string
>= 1 characters
outcome
Allowed values: succeeded denied failed
event_type
string
policy_decision
Allowed values: allow deny block error
credential_resolution_status
Allowed values: not_required resolved missing denied disabled revoked expired backend_unavailable
connector_id
string
route_reason
string
/^[a-z0-9_]+$/
time_range
required
object
from
required
string format: date-time
to
required
string format: date-time
format
required
Allowed values: csv jsonl
columns
Array
>= 1 items
Allowed values: event_id timestamp event_type outcome tenant_id environment_id server_id tool_id request_id actor_id user_id agent_id agent_instance_id client_surface_id client_session_id backend_session_id policy_decision policy_reason policy_rule_id policy_version denial_reason_code credential_mode credential_binding_id credential_resolution_status connector_id route_decision route_reason upstream_attempted latency_ms redaction_status payload_logged secret_material_logged
reason_code

Required for exports over 30 days or above the configured large-export row threshold.

string
/^[a-z0-9_]+$/
reason
string
<= 500 characters

Responses

Section titled “ Responses ”

202

Section titled “202 ”

Export job accepted. The job may already be completed for small local exports.

object
export_id
required
string
>= 1 characters
status
required
Allowed values: queued running completed failed expired
requested_by
required
string
>= 1 characters
requested_at
required
string format: date-time
expires_at
required
string format: date-time
estimated_count
required
integer
row_count
required
integer | null
byte_size
required
integer | null
sha256
required
Any of:
string
/^[a-f0-9]{64}$/
error_reason
required
string | null
download_url
required
string | null
manifest
required
Any of:
object
schema_version
required
export_id
required
string
>= 1 characters
generated_at
required
string format: date-time
generated_by
required
string
>= 1 characters
tenant_id
required
string
>= 1 characters
environment_id
required
string
>= 1 characters
filters
required

Metadata-only export filters. Raw payloads, bodies, prompts, tokens, and secrets are never present.

object
filters_hash
required
string
/^[a-f0-9]{64}$/
format
required
Allowed values: csv jsonl
row_count
required
integer
sha256
required

Hash for the exported rowset recorded in the manifest; the job sha256 verifies the downloaded artifact bytes.

string
/^[a-f0-9]{64}$/

400

Section titled “400 ”

Invalid filters

403

Section titled “403 ”

Caller lacks audit.read for the scoped tenant/environment.

422

Section titled “422 ”

Export exceeds configured max row count.

429

Section titled “429 ”

Actor exceeded audit export rate limit.

Type set in Geist, Source Serif 4, and Departure Mono.