---
title: "Export a team’s audit log – Superbot API"
canonical_url: "https://superbot.gg/developers/teams/exportTeamAuditLog"
summary: "The team’s audit log, oldest first, as NDJSON (default) or CSV: who, on which device and through which agent, used which credential class for what, and the outcome. Rows are kept for a year. Owners and admins only; a member gets 403 and a caller outside the team 404. At most `limit` rows per request; when more remain, the `x-next-cursor` header carries the cursor for the next page. Columns, in CSV order: ts, org_id, actor_user_id, actor_email, device_id, agent, credential_class, credential_ref, action, target, outcome, request_id, ip, ua."
---

> Markdown of https://superbot.gg/developers/teams/exportTeamAuditLog. Site index: /llms.txt.

# Export a team’s audit log

`GET /v1/org/{id}/audit`

The team’s audit log, oldest first, as NDJSON (default) or CSV: who, on which device and through which agent, used which credential class for what, and the outcome. Rows are kept for a year. Owners and admins only; a member gets 403 and a caller outside the team 404. At most `limit` rows per request; when more remain, the `x-next-cursor` header carries the cursor for the next page. Columns, in CSV order: ts, org_id, actor_user_id, actor_email, device_id, agent, credential_class, credential_ref, action, target, outcome, request_id, ip, ua.

- Operation id: `exportTeamAuditLog`
- Group: [Teams](https://superbot.gg/developers/teams.md)
- Auth: A caller key holding `teams:read` (`Authorization: Bearer sbc_…` or `x-api-key: sbc_…`), or a signed-in session.
- Scopes: `teams:read`

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | required | The team id (`org_…`). |

## Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `format` | string | optional | Attachment format; default ndjson. One of `ndjson`, `csv`. |
| `since` | string (date-time) | optional | Rows at or after this time; default a year ago. |
| `until` | string (date-time) | optional | Rows before this time; default now. |
| `cursor` | string | optional | The previous page’s `x-next-cursor`. |
| `limit` | integer | optional | Rows per page; default 1000, and anything above 5000 is read as 5000. |

## Response 200

The rows, as an attachment.

`application/x-ndjson`: string.

`text/csv`: string.

## Errors

Every refusal carries `error`, `message`, `doc_url` and `request_id`; the gateway routes answer in the dialect you dialed.

| Status | Codes | When |
| --- | --- | --- |
| 400 | [`invalid_request`](https://superbot.gg/developers#errors-invalid_request) | The request is malformed or a parameter is invalid; `param` names the field. |
| 401 | [`unauthorized`](https://superbot.gg/developers#errors-unauthorized) | The bearer is missing, malformed or unknown. |
| 403 | [`insufficient_scope`](https://superbot.gg/developers#errors-insufficient_scope) | The key lacks a scope (insufficient_scope), is revoked, or may not call this route. |
| 404 | [`not_found`](https://superbot.gg/developers#errors-not_found) | No such resource on this account. |
| 503 | — | The audit store is unavailable; retry later. |

## Examples

```sh
curl -sS -X GET "https://superbot.gg/v1/org/$ID/audit" \
  -H "Authorization: Bearer $SUPERBOT_API_KEY"
```

```js
const id = 'ID';
const res = await fetch(`https://superbot.gg/v1/org/${id}/audit`, {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SUPERBOT_API_KEY}`,
  },
});
console.log(res.status, await res.json());
```

```python
import os
import requests

id = "ID"
res = requests.request(
    "GET",
    f"https://superbot.gg/v1/org/{id}/audit",
    headers={
        "Authorization": f"Bearer {os.environ['SUPERBOT_API_KEY']}",
    },
)
print(res.status_code, res.json())
```