> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kaireonai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Export

> Export audit logs for compliance and verify audit chain integrity.

The Audit Export API provides SOC 2 compliant audit log exports in multiple formats and integrity verification of the audit chain. Rate limited to 10 requests/min. **Admin only.**

## GET /api/v1/audit-export

Export audit logs with filtering and pagination.

### Query Parameters

| Parameter    | Type   | Required | Description                                               |
| ------------ | ------ | -------- | --------------------------------------------------------- |
| `format`     | string | No       | Export format: `json`, `csv`, or `soc2` (default: `json`) |
| `startDate`  | string | No       | ISO 8601 start date filter                                |
| `endDate`    | string | No       | ISO 8601 end date filter                                  |
| `entityType` | string | No       | Filter by entity type (e.g., `offer`, `channel`, `user`)  |
| `action`     | string | No       | Filter by action: `create`, `update`, `delete`            |
| `limit`      | number | No       | Max records (default: 10000, max: 10000)                  |
| `offset`     | number | No       | Pagination offset                                         |

### Example

```bash theme={null}
curl "https://playground.kaireonai.com/api/v1/audit-export?format=csv&startDate=2026-03-01&endDate=2026-03-18" \
  -H "X-Tenant-Id: my-tenant" \
  -o audit-export.csv
```

### Response — JSON Format

The export envelope carries the formatted `data` string plus an `integrity`
block. The `data` field is a JSON-encoded string of the matching audit rows.

```json theme={null}
{
  "format": "json",
  "totalRecords": 1500,
  "exportedAt": "2026-03-18T12:00:00.000Z",
  "dateRange": { "start": "2026-03-01T00:00:00.000Z", "end": "2026-03-18T00:00:00.000Z" },
  "data": "[ { \"id\": \"clx...\", \"action\": \"create\", ... } ]",
  "integrity": {
    "valid": true,
    "verified": 1500,
    "scanned": 1500
  }
}
```

The `integrity` block is computed with the **same content-hash recompute** the
[verify endpoint](#post-api-v1-audit-export) uses — not a link-only check — so a
tampered payload in the exported slice is caught by the export itself. On a
detected tamper, `integrity.valid` is `false` and the block adds
`brokenAtId` and `brokenReason` (`hash_mismatch` or `chain_link_mismatch`):

```json theme={null}
{
  "integrity": {
    "valid": false,
    "verified": 842,
    "scanned": 1500,
    "brokenAtId": "clx...",
    "brokenReason": "hash_mismatch"
  }
}
```

The `soc2` format's `summary.integrityChainStatus` and
`complianceChecks.tamperDetection` reflect the same content-verified verdict.

### Response — CSV Format

Returns a CSV file download with `Content-Disposition: attachment`. The
content-verified integrity verdict is surfaced on the
`X-Audit-Integrity` response header (`valid` or `broken`), with an
`X-Audit-Integrity-Reason` header when broken.

***

## POST /api/v1/audit-export

Verify the integrity of the audit log chain. Recomputes each row's content hash
(honoring the row's hash version) **and** checks the chain links, so an edited
`before`/`after`/`changes` payload is detected even if the chain links are
intact. **Admin only.**

### Request Body

| Field       | Type   | Required | Description                |
| ----------- | ------ | -------- | -------------------------- |
| `action`    | string | Yes      | Must be `verify_integrity` |
| `startDate` | string | No       | ISO 8601 start date        |
| `endDate`   | string | No       | ISO 8601 end date          |

### Example

```bash theme={null}
curl -X POST https://playground.kaireonai.com/api/v1/audit-export \
  -H "Content-Type: application/json" \
  -H "X-Tenant-Id: my-tenant" \
  -d '{ "action": "verify_integrity" }'
```

### Response

```json theme={null}
{
  "valid": true,
  "totalChecked": 15000
}
```

When a break is found, the response reports where and why:

```json theme={null}
{
  "valid": false,
  "brokenAt": "clx...",
  "brokenReason": "hash_mismatch",
  "totalChecked": 8421
}
```

| Field          | Type    | Description                                                                                        |
| -------------- | ------- | -------------------------------------------------------------------------------------------------- |
| `valid`        | boolean | `true` when every checked row's content hash and chain link verify.                                |
| `totalChecked` | number  | Number of rows verified (up to the first break).                                                   |
| `brokenAt`     | string  | Id of the first row that failed (omitted when `valid`).                                            |
| `brokenReason` | string  | `hash_mismatch` (tampered payload) or `chain_link_mismatch` (rewired chain), omitted when `valid`. |