> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mka1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit exports

> Export your organization's audit records as JSON or CSV and load them into your own SIEM or monitoring.

The MKA1 API exports your organization's audit records over HTTP, so you can pull them on a schedule into your own SIEM, log store, or monitoring. These are the same records the console's **Audit** page shows and exports.

For endpoint details, see the [API Reference](https://docs.mka1.com/api-reference/introduction.md) and open the **Audit** group.

## Requirements

| Requirement | Notes |
| - | - |
| An owner or admin role | Only organization owners and admins can export. Members get `403`. |
| API key with `read:audit` | Grant it in the key form under **Access → API Keys**. Session callers need only the role. |

Every export covers only the organization the API key belongs to. You can't export another organization's records. Requests made on behalf of an end user, with an exchanged token or `X-On-Behalf-Of`, can't export.

## What you can export

| Endpoint | Returns |
| - | - |
| `GET /api/v1/audit/cases/export` | Audit cases, one row per model response |
| `GET /api/v1/audit/requests/export` | API requests as the gateway logged them, one row per request |
| `GET /api/v1/audit/misuse/findings/export` | Misuse findings |
| `GET /api/v1/audit/cases/{response_id}/export` | One case with its timeline (`json`, `html`), or its ledger entries (`csv`, `ndjson`) |
| `GET /api/v1/audit/misuse/findings/{finding_id}/export` | One finding with its actions and ledger events, as CSV |

The three list exports take these query parameters:

* `format`: `json` (the default) returns a JSON array of rows. `csv` returns a header row and one line per row.
* `dateFrom` and `dateTo`: ISO 8601 timestamps that bound the records returned.
* `order` (cases and gateway requests): `newest` (the default) or `oldest`. Gateway requests also accept `slowest`. Misuse findings are always newest first.

Each export is recorded in your organization's audit trail.

## Pull a time window

To load records into a SIEM, export one fixed window per run, for example the previous hour, and load the file.

```ts TypeScript SDK theme={null}
import { SDK } from '@meetkai/mka1';

const sdk = new SDK({ bearerAuth: 'Bearer <mka1-api-key>' });

const { headers, result } = await sdk.audit.exportRequests({
  format: 'json',
  dateFrom: new Date('2026-11-06T10:00:00Z'),
  dateTo: new Date('2026-11-06T11:00:00Z'),
});
console.log(headers['x-export-truncated']); // ["false"] when every matching row was returned
```

```python Python SDK theme={null}
from datetime import datetime, timezone
from meetkai_mka1 import SDK

sdk = SDK(bearer_auth="Bearer <mka1-api-key>")

res = sdk.audit.export_requests(
    format_="json",
    date_from=datetime(2026, 11, 6, 10, tzinfo=timezone.utc),
    date_to=datetime(2026, 11, 6, 11, tzinfo=timezone.utc),
)
print(res.headers["x-export-truncated"])  # ["false"] when every matching row was returned
```

```csharp C# SDK theme={null}
using MeetKai.MKA1;
using MeetKai.MKA1.Types.Requests;

var sdk = new SDK(bearerAuth: "Bearer <mka1-api-key>");

var res = await sdk.Audit.ExportRequestsAsync(new ExportGatewayRequestsRequest
{
    Format = ExportGatewayRequestsFormat.Json,
    DateFrom = new DateTime(2026, 11, 6, 10, 0, 0, DateTimeKind.Utc),
    DateTo = new DateTime(2026, 11, 6, 11, 0, 0, DateTimeKind.Utc),
});
Console.WriteLine(string.Join(",", res.Headers["x-export-truncated"])); // "false" when every matching row was returned
```

```bash CLI theme={null}
mka1 audit export-requests \
  --format-param json \
  --date-from 2026-11-06T10:00:00Z \
  --date-to 2026-11-06T11:00:00Z \
  --include-headers
```

```bash Bash theme={null}
curl -sS -G "https://apigw.mka1.com/api/v1/audit/requests/export" \
  -H "Authorization: Bearer <mka1-api-key>" \
  --data-urlencode "format=json" \
  --data-urlencode "dateFrom=2026-11-06T10:00:00Z" \
  --data-urlencode "dateTo=2026-11-06T11:00:00Z" \
  -D headers.txt \
  -o requests.json
```

## Row limit

A list export returns up to 100,000 rows. Three response headers tell you whether the file is complete:

| Header | Meaning |
| - | - |
| `x-export-total-rows` | Rows that matched your filters |
| `x-export-row-limit` | The most rows one export returns |
| `x-export-truncated` | `true` when more rows matched than the limit |

If `x-export-truncated` is `true`, split the window into smaller `dateFrom`/`dateTo` ranges and export each one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.