Skip to main content
GET
Read risk-event export
Supply the export_id from creation as the path parameter. No request body is required. Polling resumes pending work after a restart. Read status before consuming export_data; a failed job includes an explanation. If the window contains more than 10,000 records, create a new export with a narrower date range. Risk exports contain workspace risk signals and decisions. They do not configure automatic audit-log forwarding. See SIEM integration for the distinction.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

id
string<uuid>
required

export_id returned by creation

Response

Current job and completed evidence, if available

export_id
string<uuid>
status
enum<string>
Available options:
pending,
running,
complete,
failed
format
enum<string>
Available options:
json,
csv,
cef,
leef
since
string<date-time>
until
string<date-time>
event_types
enum<string>[]
Available options:
signal,
decision
record_count
integer
created_at
string<date-time>
completed_at
string<date-time>
error_message
string
export_data

Parsed JSON evidence for json format; text for CSV, CEF and LEEF. Present only when complete.