Create risk-event export
curl --request POST \
--url https://api.truthlocks.com/v1/risk/siem/export \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"format": "json",
"event_types": [
"signal",
"decision"
]
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({format: 'json', event_types: ['signal', 'decision']})
};
fetch('https://api.truthlocks.com/v1/risk/siem/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/siem/export"
payload = {
"format": "json",
"event_types": ["signal", "decision"]
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/siem/export"
payload := strings.NewReader("{\n \"format\": \"json\",\n \"event_types\": [\n \"signal\",\n \"decision\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"export_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"format": "json",
"since": "2023-11-07T05:31:56Z",
"until": "2023-11-07T05:31:56Z",
"event_types": [
"signal"
],
"record_count": 123,
"created_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"error_message": "<string>",
"export_data": {}
}Audit & Logs
Create risk-event export
Persist a filtered snapshot job for JSON, CSV, CEF or LEEF.
POST
/
v1
/
risk
/
siem
/
export
Create risk-event export
curl --request POST \
--url https://api.truthlocks.com/v1/risk/siem/export \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"format": "json",
"event_types": [
"signal",
"decision"
]
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({format: 'json', event_types: ['signal', 'decision']})
};
fetch('https://api.truthlocks.com/v1/risk/siem/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/siem/export"
payload = {
"format": "json",
"event_types": ["signal", "decision"]
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/siem/export"
payload := strings.NewReader("{\n \"format\": \"json\",\n \"event_types\": [\n \"signal\",\n \"decision\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"export_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"format": "json",
"since": "2023-11-07T05:31:56Z",
"until": "2023-11-07T05:31:56Z",
"event_types": [
"signal"
],
"record_count": 123,
"created_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"error_message": "<string>",
"export_data": {}
}Submit an object such as
{ "format": "json", "event_types": ["signal", "decision"] }. Save export_id and poll the read endpoint. A 202 response confirms that the job exists; it does not confirm that processing is complete.
Risk exports contain workspace risk signals and decisions. They do not configure automatic audit-log forwarding. See SIEM integration for the distinction.Authorizations
API key for machine-to-machine authentication
Body
application/json
Available options:
json, csv, cef, leef Record categories to include. Empty or omitted includes both; these are not provider names or risk signal subtypes.
Maximum array length:
2Available options:
signal, decision Inclusive lower bound. Defaults to 30 days before until.
Exclusive upper bound. Defaults to request time. Maximum range: 366 days; future ranges rejected.
Response
Job persisted; poll its export_id
Available options:
pending, running, complete, failed Available options:
json, csv, cef, leef Available options:
signal, decision Parsed JSON evidence for json format; text for CSV, CEF and LEEF. Present only when complete.

