Export

GET /api/bng/audit/export?from=&to=&format=&sources=&q=&only_logins=   read_only

A bulk download for compliance archival and offline analysis, distinct from the
timeline's own format parameter.

from and to are required and accept either epoch seconds or ISO-8601;
naive timestamps are interpreted as UTC. The window is capped at one year.
format is csv, json, or ndjson — note that both json and ndjson
produce newline-delimited JSON. only_logins restricts the export to
authentication events, which is the common compliance query.

The CSV carries a fixed column set — timestamp, source, actor, action, summary,
related event, detail, and the full raw record as embedded JSON — and applies
formula-injection defence: any cell beginning with a character a spreadsheet
would interpret as a formula is prefixed with an apostrophe.

Two behaviours to note. The export degrades rather than fails — a source that
errors is skipped and you receive a partial export with a 200, so verify the
row count against expectation rather than assuming completeness. And the export
itself is audited: an export event is emitted recording the actor, window,
format, filters, and row count.

Validation errors are 400 with an explanatory error string; the messages
cover missing bounds, unparseable timestamps, an inverted range, an over-long
range, and an unknown format.