> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create risk-event export

> Persist a filtered snapshot job for JSON, CSV, CEF or LEEF.

Submit an object such as `{ "format": "json", "event_types": ["signal", "decision"] }`. Save `export_id` and poll the read endpoint. A 202 response confirms that the job exists; it does not confirm that processing is complete.

Risk exports contain workspace risk signals and decisions. They do not configure automatic audit-log forwarding. See [SIEM integration](/guides/siem-integration) for the distinction.


## OpenAPI

````yaml mint-openapi.yaml POST /v1/risk/siem/export
openapi: 3.0.3
info:
  title: Truthlocks API
  description: >
    Truthlocks is a universal verification infrastructure for documents,
    credentials, and digital assets.

    This specification defines the canonical API for interacting with Truthlocks
    services.


    ## Base URLs

    - **Production**: `https://api.truthlocks.com`

    - **Sandbox**: `https://sandbox-api.truthlocks.com`


    ## Authentication

    - **API Keys**: Use `X-API-Key` header for machine-to-machine operations

    - **Bearer Tokens**: Use `Authorization: Bearer <jwt>` for user-initiated
    operations


    ## Tenant Identity

    In production, tenant identity is derived from the authenticated context
    (API key or JWT).

    The `X-Tenant-ID` header is ignored in production to prevent spoofing.
  version: 1.0.0
  contact:
    name: Truthlocks Support
    url: https://truthlocks.com/support
    email: support@truthlocks.com
servers:
  - url: https://api.truthlocks.com
    description: Production API
  - url: https://sandbox-api.truthlocks.com
    description: Sandbox Environment
security:
  - APIKey: []
  - BearerAuth: []
tags:
  - name: Authentication
    description: API key and token management
  - name: Issuers
    description: Issuer registration and trust management
  - name: Keys
    description: Cryptographic key management for issuers
  - name: Attestations
    description: Attestation lifecycle (mint, revoke, supersede)
  - name: Verification
    description: Attestation verification and proof bundles
  - name: Governance
    description: Issuer governance workflows (admin only)
  - name: Identity
    description: Organization, user, and role management
  - name: Audit
    description: Audit event queries
  - name: Tenant Console
    description: Tenant profile and lifecycle endpoints
  - name: Health
    description: Service health and readiness endpoints
  - name: Risk
    description: Risk signal ingestion and fraud detection
  - name: Risk Enforcement
    description: Risk enforcement actions — block, challenge, quarantine, and configuration
  - name: Billing
    description: Billing, subscription, and addon management
  - name: Machine Identity
    description: >-
      Machine Agent Identity Protocol (MAIP) — agent registration, sessions,
      trust, witness, compliance, orchestration, and observability
externalDocs:
  description: Transparency read-only API (separate service spec)
  url: >-
    https://github.com/truthlocks/truthlock/blob/main/docs/transparency/openapi.yaml
paths:
  /v1/risk/siem/export:
    post:
      tags:
        - Risk Exports
      summary: Create risk-event export
      description: >-
        Persist a bounded snapshot job for this workspace. This does not
        configure log forwarding or a SIEM destination. Poll the returned
        export_id to retrieve the result and resume pending processing after a
        restart.
      operationId: audit.siem.create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                format:
                  type: string
                  enum:
                    - json
                    - csv
                    - cef
                    - leef
                  default: json
                event_types:
                  type: array
                  maxItems: 2
                  items:
                    type: string
                    enum:
                      - signal
                      - decision
                  description: >-
                    Record categories to include. Empty or omitted includes
                    both; these are not provider names or risk signal subtypes.
                since:
                  type: string
                  format: date-time
                  description: Inclusive lower bound. Defaults to 30 days before until.
                until:
                  type: string
                  format: date-time
                  description: >-
                    Exclusive upper bound. Defaults to request time. Maximum
                    range: 366 days; future ranges rejected.
            example:
              format: json
              event_types:
                - signal
                - decision
      responses:
        '202':
          description: Job persisted; poll its export_id
          content:
            application/json:
              schema:
                type: object
                properties:
                  export_id:
                    type: string
                    format: uuid
                  status:
                    type: string
                    enum:
                      - pending
                      - running
                      - complete
                      - failed
                  format:
                    type: string
                    enum:
                      - json
                      - csv
                      - cef
                      - leef
                  since:
                    type: string
                    format: date-time
                  until:
                    type: string
                    format: date-time
                  event_types:
                    type: array
                    items:
                      type: string
                      enum:
                        - signal
                        - decision
                  record_count:
                    type: integer
                  created_at:
                    type: string
                    format: date-time
                  completed_at:
                    type: string
                    format: date-time
                  error_message:
                    type: string
                  export_data:
                    description: >-
                      Parsed JSON evidence for json format; text for CSV, CEF
                      and LEEF. Present only when complete.
                    oneOf:
                      - type: object
                      - type: array
                        items: {}
                      - type: string
        '400':
          description: Invalid export options or ID
        '401':
          description: Authentication required
        '503':
          description: Storage or processing unavailable; retry the existing export ID
      security:
        - APIKey: []
components:
  securitySchemes:
    APIKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for machine-to-machine authentication
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT for user-initiated operations

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.