Skip to main content
GET
List audit log export destinations

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

limit
integer
default:20

Limit the number of destinations to return.

Required range: 1 <= x <= 100
offset
integer
default:0

Offset the number of destinations to return.

Required range: x >= 0

Response

Audit log export destinations for the organization

bucket
string
required
Required string length: 3 - 63
consecutive_failures
integer
required
read-only
Required range: x >= 0
created_at
string<date-time>
required
read-only
external_id
string
required
read-only
Maximum string length: 128
format
enum<string>
required
Available options:
jsonl.gz
id
string
required
read-only
Maximum string length: 128
kernel_role_arn
string
required
read-only

The Kernel role that assumes role_arn in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require external_id as the sts:ExternalId condition.

Recreating a destination issues a new external_id, which the trust policy has to be updated to match.

Maximum string length: 2048
prefix
string
required
Maximum string length: 512
region
string
required
Required string length: 1 - 128
role_arn
string
required
Required string length: 1 - 2048
status
enum<string>
required

Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed.

Available options:
active,
paused
type
enum<string>
required
Available options:
s3
updated_at
string<date-time>
required
read-only
kms_key_id
string
Maximum string length: 2048
last_error
string
read-only

Sanitized description of the most recent delivery failure.

last_error_at
string<date-time>
read-only
last_exported_cursor
string
read-only

Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens.

Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery.

last_success_at
string<date-time>
read-only
next_attempt_at
string<date-time>
read-only