---
title: "exportAuditLogs"
description: "Export agent audit logs as CSV"
canonical: "https://pgbeam.com/docs/ts-sdk/agents/exportAuditLogs"
last-updated: "2026-10-30T13:32:17.000Z"
---

# exportAuditLogs

> Export agent audit logs as CSV

URL: https://pgbeam.com/docs/ts-sdk/agents/exportAuditLogs

{/* Auto-generated from OpenAPI. Do not edit. Run `pnpm generate:sdk-docs` to regenerate. */}

Streams the project's agent audit entries as a CSV file, newest first, honoring the same credential, event, decision, source and date-range filters as the list endpoint. The full filtered set is streamed (no pagination); the result is suitable for spreadsheets, SIEM ingestion, and compliance archives.

## Usage

```typescript
const result = await api.agents.exportAuditLogs({
  pathParams: { project_id: "prj_xxx" },
});
```

## Parameters

| Parameter                 | Type            | Required | Description                                                                                                                                                                                                                          |
| ------------------------- | --------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| pathParams.project_id     | `string`        | Yes      | Unique project identifier (prefixed, e.g. prj_xxx).                                                                                                                                                                                  |
| queryParams.credential_id | `string`        | No       | Filter to a single agent credential.                                                                                                                                                                                                 |
| queryParams.event         | `string`        | No       | Filter to a single event type (e.g. blocked, masked, query).                                                                                                                                                                         |
| queryParams.decision      | `AuditDecision` | No       | Coarse outcome filter that groups events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated. |
| queryParams.source        | `AuditSource`   | No       | Filter by statement origin (wire, mcp, rest, or control).                                                                                                                                                                            |
| queryParams.start         | `string`        | No       | Return entries at or after this timestamp (inclusive lower bound).                                                                                                                                                                   |
| queryParams.end           | `string`        | No       | Return entries strictly older than this timestamp (cursor / upper bound).                                                                                                                                                            |

## Response

`Promise<unknown>`: csv stream of filtered audit entries.

## Example

```typescript
import { PgBeamClient } from "pgbeam";

const client = new PgBeamClient({
  token: "pbu_...",
  baseUrl: "https://api.pgbeam.com",
});

const result = await client.api.agents.exportAuditLogs({
  pathParams: { project_id: "prj_xxx" },
  queryParams: {
    credential_id: "...",
    event: "blocked",
    decision: "...",
    source: "...",
    start: "...",
    end: "...",
  },
});
```

## Errors

| Status | Description                                                                                                                                                                                                                                                                                           |
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400    | The request was rejected. `code` is `INVALID_INPUT`, and `errors` names the offending fields when the failure was a validation one.                                                                                                                                                                   |
| 401    | Missing or invalid authentication. `code` is `UNAUTHORIZED`.                                                                                                                                                                                                                                          |
| 403    | The caller is authenticated but not allowed to perform this operation. `code` is `FORBIDDEN` when the caller's role is insufficient, and `PLAN_LIMIT_REACHED` when the organization's plan is what stands in the way. The two are answered differently, so branch on the code rather than the status. |
| 404    | The resource does not exist, or the caller is not entitled to know that it does. `code` is `NOT_FOUND`.                                                                                                                                                                                               |
| 429    | Rate limited. `code` is `RATE_LIMITED`.                                                                                                                                                                                                                                                               |
| 500    | The request failed for a reason on our side. `code` is `INTERNAL_ERROR`. Quote `request_id` when reporting it.                                                                                                                                                                                        |