How to Export Audit Logs

Note
The example script referenced in this article is a working starting point, not a production-ready solution. It's intentionally simple so you can understand what it does and adapt it to your own environment — how you schedule it, store credentials, handle output, and integrate with your SIEM will depend on your infrastructure and tooling

Endpoint	Tracks	Best for
@activityLog	User interactions with the Onna UI — logins, logouts, search queries, navigation, exports, sharing actions, and similar events. Results are returned per-user across your entire account.	General usage monitoring
@auditLog	CRUD operations on your data — workspace and source creation, source removal (by user or retention policy), resource sharing, resource visits, deletions, and custom field changes.	Compliance and data governance.

Both endpoints return events in JSON format and support date range filtering.

Authentification

Onna uses OAuth 2.0 client credentials for API access. The script handles token exchange automatically at runtime — tokens expire after one hour, so there's no static credential to manage or rotate. This method works for all Onna accounts, including those with SSO enforced.

Getting your credentials

An Onna admin opens the Platform API app from the Onna home page and navigates to Manage > Developers.
The admin adds you as a developer by entering your email and selecting Add.
Once you've been granted developer permission, the Platform API app appears on your home page.
Go to Develop > API credentials and select + to create a new credential set.
Give the credentials a name (for example, "SIEM integration") and select Create.
Copy the client_id and client_secret from the dialog. The secret is shown only once, so store it somewhere safe.

For the full walkthrough, see here.

Using the Script

The script export_audit_logs.py fetches a token, pulls both endpoints for a specified date range, and writes two JSON files that can be ingested directly by most SIEMs (Splunk, Elastic/ELK, Sumo Logic, Microsoft Sentinel, and others).

Setup

Requires Python 3.8+. Install the one dependency:

pip install requests

Configuration

Open the script and fill in the config block at the top:

CLIENT_ID     = ""   # From the Platform API app in Onna
CLIENT_SECRET = ""   # From the Platform API app in Onna
ACCOUNT       = ""   # Your Onna account name (e.g. "acmecorp")

FROM_DATE  = "2026-01-01"  # Start date, inclusive (YYYY-MM-DD)
TO_DATE    = "2026-06-18"  # End date, inclusive (YYYY-MM-DD)

OUTPUT_DIR = Path(".")     # Directory to write output files
PAGE_SIZE  = 100           # Batch size per API request

Note
For recurring or automated use (cron jobs, CI pipelines), load CLIENT_ID and CLIENT_SECRET from environment variables or a .env file rather than storing them directly in the script.

Running it

python export_audit_logs.py

This produces two output files:

<account>_activitylog_<from>_to_<to>.json — UI activity events
<account>_auditlog_<from>_to_<to>.json — CRUD/data events

Endpoint Reference

`@activityLog`

GET https://enterprise.onna.com/api/{account}/{account}/@activityLog
    ?epoch_from=<unix_seconds>
    &epoch_to=<unix_seconds>
    &size=<page_size>
    &cursor=<cursor>       (for pagination)

Dates are in Unix epoch seconds.
Paginated via the cursor field in the response.
Response shape: { "items": [...], "cursor": "..." }

Example events tracked:

Event	Description
`login` / `logout`	User authentication events
`search-bar-submit`	A search query was executed
`export-created`	An export was initiated
`sharing`	A resource or source was shared
`confirm-source-deletion`	A source was deleted
`nav-menu-admin-users-management`	User management page accessed

`@auditLog`

POST https://enterprise.onna.com/api/{account}/{account}/@auditLog
Content-Type: application/json

Request body (with date filter):

{
  "size": 100,
  "from": 0,
  "sort": { "field": "@timestamp", "direction": "asc" },
  "advanced": {
    "and": [
      { ">": [{ "var": "@timestamp" }, 1735689600000] },
      { "<": [{ "var": "@timestamp" }, 1750204800000] }
    ]
  }
}

Dates are in Unix epoch milliseconds.
Paginated via the from offset.
Supports additional filters — by IP (payload.ip.keyword), by user, or by action type.

Example events tracked:

Event	Description
`Created Workspace`	A workspace was created
`Datasource Added`	A new source was connected
`Datasource Removed`	A source was removed by user or retention policy
`Datasource Shared`	A source was shared with a user
`Resource visited`	A file or resource was accessed
`Resource removed`	A file was deleted
`Resource removed by retention policy`	A file was removed by a retention rule
`Workspace was shared with user`	Workspace sharing event

Pushing to a SIEM

The script outputs standard JSON arrays. Common ingestion patterns:

SIEM	Ingestion pattern
Splunk	Use the HTTP Event Collector (HEC), or point a file monitor input at the output directory
Elastic (ELK)	Use Filebeat with a JSON log input, or POST directly to the Elasticsearch Bulk API
Sumo Logic	Use a hosted collector with a JSON source pointed at the output directory, or the HTTP source to POST events programmatically
Microsoft Sentinel	Use the Log Analytics Data Collector API or the Azure Monitor Logs ingestion API

Note
The script pulls a fixed date range each time it runs; it does not automatically track where it left off. To avoid gaps or duplicates in your SIEM, run it on a recurring schedule (cron, Windows Task Scheduler, a CI pipeline, etc.) and manage the date window accordingly. A common pattern is to run it daily and set the range to the previous 24 hours.Each run fetches a fresh OAuth token automatically, so no manual token rotation is needed.