> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit export handler

> **Required scope:** read

**Required scope:** `read`

### Query parameters

<ParamField query="since_ms" type="integer (int64)">
  Unix millis lower bound
</ParamField>

<ParamField query="until_ms" type="integer (int64)">
  Unix millis upper bound
</ParamField>

<ParamField query="limit" type="integer">
  Max events (default 1000, capped at 10000)
</ParamField>

### Response

`AuditExportResponse`

<ResponseField name="event_count" type="integer" required />

<ResponseField name="events" type="AuditEvent[]" required>
  <Expandable title="AuditEvent">
    <ResponseField name="api_key_prefix" type="string">
      First 8 chars of API key (for identification without exposure)
    </ResponseField>

    <ResponseField name="client_ip" type="string">
      Client IP address
    </ResponseField>

    <ResponseField name="context" type="object">
      Additional context
    </ResponseField>

    <ResponseField name="duration_ms" type="integer (int64)" required>
      Request duration in milliseconds
    </ResponseField>

    <ResponseField name="error" type="string">
      Error message if applicable
    </ResponseField>

    <ResponseField name="event_type" type="AuditEventType" required />

    <ResponseField name="method" type="string" required>
      HTTP method
    </ResponseField>

    <ResponseField name="operation" type="string">
      Operation performed
    </ResponseField>

    <ResponseField name="path" type="string" required>
      Request path
    </ResponseField>

    <ResponseField name="request_id" type="string" required>
      Unique request identifier
    </ResponseField>

    <ResponseField name="resource_type" type="string">
      Type of resource affected
    </ResponseField>

    <ResponseField name="status" type="integer (int32)" required>
      Response status code
    </ResponseField>

    <ResponseField name="timestamp" type="string" required>
      ISO 8601 timestamp string
    </ResponseField>

    <ResponseField name="timestamp_ms" type="integer (int64)" required>
      Unix timestamp in milliseconds
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="generated_at" type="string (date-time)" required />

<ResponseField name="org_id" type="string" required />

<ResponseField name="total_available" type="integer" required />

### Status codes

| Code  | Meaning                                            |
| ----- | -------------------------------------------------- |
| `200` | Audit events for the caller's org                  |
| `401` | Unauthorized                                       |
| `403` | Forbidden — the key/token lacks the required scope |
| `429` | Rate limited — see Retry-After / X-RateLimit-Reset |

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET \
    --url 'https://api.nsr.stateset.com/api/v1/audit/export' \
    --header 'X-API-Key: YOUR_API_KEY'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "event_count": 1,
    "events": [
      {
        "api_key_prefix": "YOUR_API_KEY",
        "client_ip": "203.0.113.42",
        "context": null,
        "duration_ms": 8,
        "error": "string",
        "event_type": "api_request",
        "method": "string",
        "operation": "string",
        "path": "string",
        "request_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "resource_type": "string",
        "status": 1,
        "timestamp": "2026-08-31T14:22:05Z",
        "timestamp_ms": 250
      }
    ],
    "generated_at": "2026-08-31T14:22:05Z",
    "org_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "total_available": 1
  }
  ```
</ResponseExample>