Export Audit Log
Downloads your organization's audit log for one period as a CSV file, sign-ins included.
GET /api/organization/audit/export
Returns the audit log of your organization for one period as a CSV file. The log records administrative actions (every write through the dashboard or the API, with old and new value where the action records it) and sign-in events: successful and failed sign-ins of existing accounts, sign-outs, password resets, password changes and ended sessions. Entries are kept for 12 months and cannot be changed or deleted through the application.
Only organization administrators can call it, with a session or an organization-wide API token whose issuer is an admin. Connected apps (MCP agents) cannot. Every export is itself recorded in the audit log.
Query parameters
| Parameter | Type | Description |
|---|---|---|
from | ISO 8601 UTC | Start, inclusive. Default: 30 days before to. |
to | ISO 8601 UTC | End, exclusive. Default: now. |
One export spans at most 366 days and at most 100,000 entries. Split a longer period into several exports. The export only contains entries that are still stored.
Example (cURL)
BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"
curl -o audit-log.csv \
"$BASE_URL/api/organization/audit/export?from=2026-01-01T00:00:00.000Z&to=2026-04-01T00:00:00.000Z" \
-H "Authorization: Bearer $TOKEN"Response
200 with Content-Type: text/csv; charset=utf-8, a Content-Disposition attachment and
Cache-Control: no-store. Rows are sorted oldest first; entries with the same timestamp keep a
stable order. The file is UTF-8 without BOM: in Excel open it via Data > From Text/CSV so
umlauts show correctly.
"time","actor","agent","action","auth","summary","target","changes","ip","user_agent","request_id"
"2026-03-02T08:14:03.512Z","admin@example.com","no","auth.login.succeeded","password","Signed in","user:Xk2f9","","","",""
"2026-03-02T08:15:40.101Z","admin@example.com","no","websites.update","","Website updated","website:46","[{""field"":""checkInterval"",""from"":5,""to"":1}]","","","9b1e2c4a"| Column | Content |
|---|---|
time | When it happened, ISO 8601 UTC |
actor | Email address of the acting user, or their ID; empty for a failed sign-in and a requested password reset |
agent | yes when a connected app (MCP agent) acted on behalf of the user |
action | Event type, for example websites.update or auth.login.failed |
auth | Sign-in events only: method and, for a failed sign-in, the reason code as method:reason (for example password:INVALID_EMAIL_OR_PASSWORD), otherwise just the method (password, password_mfa, sso); empty for all other events |
summary | Short description |
target | Affected object as type:id, for sign-in events the account |
changes | Changed fields as JSON (field, from, to); secrets only as changed |
ip, user_agent | Only when a connected app (MCP agent) acted; empty otherwise, sign-in events included |
request_id | Correlation ID of the request |
Every cell is quoted. A cell that starts with =, +, - or @, also after leading
whitespace, gets a leading ', so spreadsheet applications show it as text instead of running it
as a formula.
Common errors
400 Invalid query(data.code: invalidRequestBody) whenfromortois not an ISO 8601 timestamp in UTC (ending inZ)400(data.code: invalidDateRange) whenfromis not beforeto400(data.code: auditExportRangeTooLarge) when the period is longer than 366 days or holds more than 100,000 entries400 User must belong to an organizationwhen no organization can be derived from the session or token401 Unauthorizedwhen you are not authenticated403 Forbiddenwhen your role is not admin