Export your workspace's events

Last updated: October 12, 2026

Export your workspace's audit log events as a file, to keep your own records, answer an audit or feed a security tool. The export runs over the API, and the audit log gives you the command to start it.

Before you start

The audit log is part of the Enterprise plan. See Plans and what they include.
You need the Export events permission. The Admin role includes it; an admin can add it to another role in Roles.
You run the command from a terminal, or from a script or scheduled job, with a token that authenticates as you or as a service account.

Steps

Open the workspace menu in the sidebar, choose Settings, then Audit Log under Security. Select Export at the top of the page. The Export events dialog shows a ready-made command for your workspace, covering the last month. Select Copy command.
Close the dialog and open Access Tokens under Account.
Select Create token, name it after what it is for, create it and copy the token. It is shown only once.
In the command, replace <YOUR_TOKEN> with the token, and change start_date and end_date to the period you want, in ISO 8601 format (2026-09-01T00:00:00Z). Run it. The response is an export_id.
Check the export with a GET to the same address followed by / and the export_id, with the same Authorization header. Repeat until status is completed.
```
curl "https://app.layer.ai/backend/api/v1/workspaces/<WORKSPACE_ID>/events/exports/<EXPORT_ID>" \
  -H "Authorization: Bearer <YOUR_TOKEN>"
```
Download the file from download_url before the time in expiration_date.

Result

A gzipped CSV file (.csv.gz) with one row per event and the columns timestamp, event_type, event_name, user_email and data. The data column holds the event's details as JSON, the same details you see when you expand an event in the audit log.

Production tips

Export a whole organisation. In a parent workspace, add "include_descendants": true to the request body to include the events of every child workspace. The file then has two more columns, workspace_id and workspace_name.
Automate with a service account. A personal access token acts as you, with all your permissions, and stops working if you leave. For a scheduled export, create a service account with a role that has Export events and use its key instead. See Authentication in the developer docs.
Export in month-sized ranges. Schedule one export a month for the previous month, so each run is small and none overlap.
Feed a SIEM or data warehouse. Every row carries event_type and event_name, so you can route invitations and role changes to access reviews and asset exports to content tracking.
Treat the token like a password. Keep it in a secret manager, give it an expiry, and revoke it in Access Tokens when the job is retired.

If something goes wrong

There is no Export button. Your role does not include Export events. Ask an admin to add it to your role, or to run the export.
The request returns 403. The token belongs to someone, or a service account, without Export events in this workspace. Use a token from an account that has it.
The request returns an error about end_date. end_date must be after start_date, and the range has a maximum length. Split a long period into monthly exports.
status is failed, or the download link has expired. Run the export again to get a new export_id and a fresh link.