Read risk-event export
curl --request GET \
--url https://api.truthlocks.com/v1/risk/siem/export/{id} \
--header 'X-API-Key: <api-key>'const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.truthlocks.com/v1/risk/siem/export/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/siem/export/{id}"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/siem/export/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"export_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"format": "json",
"since": "2023-11-07T05:31:56Z",
"until": "2023-11-07T05:31:56Z",
"event_types": [
"signal"
],
"record_count": 123,
"created_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"error_message": "<string>",
"export_data": {}
}Audit & Logs
Read risk-event export
Poll an export and retrieve its completed evidence.
GET
/
v1
/
risk
/
siem
/
export
/
{id}
Read risk-event export
curl --request GET \
--url https://api.truthlocks.com/v1/risk/siem/export/{id} \
--header 'X-API-Key: <api-key>'const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.truthlocks.com/v1/risk/siem/export/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/siem/export/{id}"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/siem/export/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"export_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "pending",
"format": "json",
"since": "2023-11-07T05:31:56Z",
"until": "2023-11-07T05:31:56Z",
"event_types": [
"signal"
],
"record_count": 123,
"created_at": "2023-11-07T05:31:56Z",
"completed_at": "2023-11-07T05:31:56Z",
"error_message": "<string>",
"export_data": {}
}Supply the
export_id from creation as the path parameter. No request body is required. Polling resumes pending work after a restart. Read status before consuming export_data; a failed job includes an explanation. If the window contains more than 10,000 records, create a new export with a narrower date range.
Risk exports contain workspace risk signals and decisions. They do not configure automatic audit-log forwarding. See SIEM integration for the distinction.Authorizations
API key for machine-to-machine authentication
Path Parameters
export_id returned by creation
Response
Current job and completed evidence, if available
Available options:
pending, running, complete, failed Available options:
json, csv, cef, leef Available options:
signal, decision Parsed JSON evidence for json format; text for CSV, CEF and LEEF. Present only when complete.

