Log export

What you can export

The Enterprise plan keeps three organization-wide logs: the audit log, Agent Chats, and Agent Runs. It also makes all three portable — each page carries Export CSV and Export JSON buttons that serialize the log and hand you a signed download link. Use it to feed a SIEM, keep an evidence archive, or answer a compliance request without screenshots.

How an export works

Exports are synchronous and self-contained: the file is produced on the spot, stored with your organization's assets, and opened through a time-limited signed URL. Each export covers up to 50,000 rows; for histories larger than that, pull date-bounded windows through the API (below). CSV exports always include a stable header row — the columns never change order, so downstream tooling can key on them — and JSON exports are an array of objects with the same fields.

Only owners and admins can export, exports respect the same access rules as the log pages themselves, and every export is itself recorded in the audit log — the record of who took the records is part of the records.

What's in each export

• Audit log — id, occurredAt, category, action, actorType, actorUserId, actorDisplay, projectId, environmentId, resourceType, resourceId, summary, and metadata.
• Agent chats — id, occurredAt, conversationId, conversationTitle, projectId, projectName, environmentId, userId, userDisplay, role, status, and the message text.
• Agent runs — id, startedAt, finishedAt, kind, status, projectId, environmentId, conversationId, model, durationMs, costMicros, failureReason, and interrupted.

Exporting via the API

The same export is available programmatically through the GraphQL API, with optional time bounds — the natural shape for scheduled pulls into your own storage:

mutation {
  exportAccountLogs(input: {
    accountId: "acct_...",
    kind: AUDIT,            # or AGENT_CHATS, AGENT_RUNS
    format: JSON,           # or CSV
    occurredAfter: "2026-07-01T00:00:00Z",
    occurredBefore: "2026-08-01T00:00:00Z",
    idempotencyKey: "…"
  }) { url rowCount }
}