Skip to main content
POST
Create risk-event export
Submit an object such as { "format": "json", "event_types": ["signal", "decision"] }. Save export_id and poll the read endpoint. A 202 response confirms that the job exists; it does not confirm that processing is complete. Risk exports contain workspace risk signals and decisions. They do not configure automatic audit-log forwarding. See SIEM integration for the distinction.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Body

application/json
format
enum<string>
default:json
Available options:
json,
csv,
cef,
leef
event_types
enum<string>[]

Record categories to include. Empty or omitted includes both; these are not provider names or risk signal subtypes.

Maximum array length: 2
Available options:
signal,
decision
since
string<date-time>

Inclusive lower bound. Defaults to 30 days before until.

until
string<date-time>

Exclusive upper bound. Defaults to request time. Maximum range: 366 days; future ranges rejected.

Response

Job persisted; poll its export_id

export_id
string<uuid>
status
enum<string>
Available options:
pending,
running,
complete,
failed
format
enum<string>
Available options:
json,
csv,
cef,
leef
since
string<date-time>
until
string<date-time>
event_types
enum<string>[]
Available options:
signal,
decision
record_count
integer
created_at
string<date-time>
completed_at
string<date-time>
error_message
string
export_data

Parsed JSON evidence for json format; text for CSV, CEF and LEEF. Present only when complete.