GET /audit-log/export.
Only owners and admins can export it. An export holds only your organization’s events, and every export is itself recorded in the log, with the range and filters you chose.
Choose the events
The file
Choose Download CSV or Download JSON Lines. Events are oldest first, one per row or line, with these fields:event_id, occurred_at (UTC), organization_id, action, outcome (success, failure or denied), actor_type, actor_is_human, actor_user_id, actor_subject, resource_type, resource_id, request_id, correlation_id and metadata.
In the CSV, metadata is one JSON-encoded cell, and a cell that would start a spreadsheet formula begins with ' so a spreadsheet shows it as text. JSON Lines keeps every value as it was recorded.
One export holds at most 100,000 events. If a range may hold more, export it in shorter ranges.