Get an audit export

GET /v1/audit-exports/{export_id} · permission audit-exports:read

Returns an export job and its status: queued, running, completed, failed or expired.

Request

Parameter	In	Required	Description
`export_id`	path	yes	Export job id, prefixed with `aex_`.

Response

200 OK and the job. Empty fields are null.

record_count, file and manifest_sha256 are filled only for completed and expired jobs. file describes records.ndjson.gz inside the package (sha256 is hexadecimal).
failure_reason is filled only for failed jobs: too_many_records, checkpoint_unavailable, integrity_error or attempts_exhausted.
The file is deleted at expires_at (completed_at plus 7 days); the job then shows expired and can no longer be downloaded.

{
  "id": "aex_01j9xk3m7q8r2s4t6v8w0y2z4e",
  "status": "completed",
  "filter": {
    "stream": "admin",
    "from": "2026-07-01T00:00:00Z",
    "to": "2026-10-01T00:00:00Z",
    "action": "user.",
    "category": null,
    "actor_type": null,
    "actor_id": null,
    "target_type": null,
    "target_id": null,
    "org_id": null,
    "outcome": null,
    "request_id": null,
    "correlation_id": null,
    "agent_only": false
  },
  "include_ip": false,
  "record_count": 18240,
  "file": {
    "name": "records.ndjson.gz",
    "sha256": "9f2c4b8e1d7a3f6c0b5e8d2a4c7f1e3b6a9d0c2e5f8b1a4d7c0e3f6a9b2c5d8e",
    "size": 2381904
  },
  "manifest_sha256": "3b7e1f9c2d5a8e0b4f6c1a3d7e9b2f5c8a0d4e6b1c3f7a9e2d5b8c0f4a6e1d3b",
  "failure_reason": null,
  "created_at": "2026-10-19T09:00:00Z",
  "started_at": "2026-10-19T09:00:02Z",
  "completed_at": "2026-10-19T09:01:10Z",
  "expires_at": "2026-10-26T09:01:10Z",
  "recorded_before": "2026-10-19T09:00:00Z",
  "requested_by": {"type": "api_key", "id": "key_01j9xk3m7q8r2s4t6v8w0y2z4d"}
}

Errors

Every error is an application/problem+json body with a stable code.

HTTP	`code`	When
401	`unauthenticated`	The API key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks `audit-exports:read`.
404	`not_found`	The job does not exist, belongs to another environment, or the id is malformed.
429	`rate_limited`	The rate limit was exceeded; honor `Retry-After`.
503	`service_unavailable`	A dependency is temporarily unavailable; retry later.

Example

curl https://api.eu.keenauth.com/v1/audit-exports/aex_01j9xk3m7q8r2s4t6v8w0y2z4e \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth audit-exports get aex_01j9xk3m7q8r2s4t6v8w0y2z4e

Personal data

This endpoint carries personal data: audit events. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.