--- title: "How to Export Audit Logs" slug: "how-to-export-audit-logs" updated: 2026-09-08T09:51:28Z published: 2026-09-08T09:51:28Z canonical: "docs.revealdata.com/how-to-export-audit-logs" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Export Audit Logs ![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/how-to-share-and-manage-exports-image-5b7f8llh.png) #### **In this article:** - The two endpoints - Authentification - Using the Script - Endpoint Reference - Pushing to a SIEM Onna provides two API endpoints for retrieving platform activity: @activityLog and @auditLog. This article walks through what each endpoint returns, how to authenticate, and how to use the included Python script to pull logs on a schedule and feed them into a SIEM or log management system. > [!NOTE] > Note > > The example script referenced in this article is a working starting point, not a production-ready solution. It's intentionally simple so you can understand what it does and adapt it to your own environment — how you schedule it, store credentials, handle output, and integrate with your SIEM will depend on your infrastructure and tooling | Endpoint | Tracks | Best for | | --- | --- | --- | | @activityLog | User interactions with the Onna UI — logins, logouts, search queries, navigation, exports, sharing actions, and similar events. Results are returned per-user across your entire account. | General usage monitoring | | @auditLog | CRUD operations on your data — workspace and source creation, source removal (by user or retention policy), resource sharing, resource visits, deletions, and custom field changes. | Compliance and data governance. | Both endpoints return events in JSON format and support date range filtering. ## Authentification Onna uses OAuth 2.0 client credentials for API access. The script handles token exchange automatically at runtime — tokens expire after one hour, so there's no static credential to manage or rotate. This method works for all Onna accounts, including those with SSO enforced. ### Getting your credentials 1. An Onna admin opens the **Platform API** app from the Onna home page and navigates to **Manage > Developers**. 2. The admin adds you as a developer by entering your email and selecting **Add**. 3. Once you've been granted developer permission, the **Platform API** app appears on your home page. 4. Go to **Develop > API credentials** and select **+** to create a new credential set. 5. Give the credentials a name (for example, "SIEM integration") and select **Create**. 6. Copy the **client_id** and **client_secret** from the dialog. The secret is shown only once, so store it somewhere safe. For the full walkthrough, see [here.](https://dev.onna.com/get-started/authentication/) ## Using the Script The script [export_audit_logs.py](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/export_audit_logs.py) fetches a token, pulls both endpoints for a specified date range, and writes two JSON files that can be ingested directly by most SIEMs (Splunk, Elastic/ELK, Sumo Logic, Microsoft Sentinel, and others). ### Setup Requires Python 3.8+. Install the one dependency: ```bash pip install requests ``` ### Configuration Open the script and fill in the config block at the top: ```python CLIENT_ID     = ""   # From the Platform API app in Onna CLIENT_SECRET = ""   # From the Platform API app in Onna ACCOUNT       = ""   # Your Onna account name (e.g. "acmecorp") FROM_DATE  = "2026-01-01"  # Start date, inclusive (YYYY-MM-DD) TO_DATE    = "2026-06-18"  # End date, inclusive (YYYY-MM-DD) OUTPUT_DIR = Path(".")     # Directory to write output files PAGE_SIZE  = 100           # Batch size per API request ``` > [!NOTE] > Note > > For recurring or automated use (cron jobs, CI pipelines), load `CLIENT_ID` and `CLIENT_SECRET` from environment variables or a `.env` file rather than storing them directly in the script. ### Running it ```bash python export_audit_logs.py ``` This produces two output files: - `<account>_activitylog_<from>_to_<to>.json` — UI activity events - `<account>_auditlog_<from>_to_<to>.json` — CRUD/data events ## Endpoint Reference #### `@activityLog` ```plaintext GET https://enterprise.onna.com/api/{account}/{account}/@activityLog    ?epoch_from=    &epoch_to=    &size=    &cursor=       (for pagination) ``` - Dates are in **Unix epoch seconds**. - Paginated via the `cursor` field in the response. - Response shape: `{ "items": [...], "cursor": "..." }` **Example events tracked:** | Event | Description | | --- | --- | | `login` / `logout` | User authentication events | | `search-bar-submit` | A search query was executed | | `export-created` | An export was initiated | | `sharing` | A resource or source was shared | | `confirm-source-deletion` | A source was deleted | | `nav-menu-admin-users-management` | User management page accessed | #### `@auditLog` ```plaintext POST https://enterprise.onna.com/api/{account}/{account}/@auditLog Content-Type: application/json ``` **Request body (with date filter):** ```json {  "size": 100,  "from": 0,  "sort": { "field": "@timestamp", "direction": "asc" },  "advanced": {    "and": [      { ">": [{ "var": "@timestamp" }, 1735689600000] },      { "<": [{ "var": "@timestamp" }, 1750204800000] }    ]  } } ``` - Dates are in **Unix epoch milliseconds**. - Paginated via the `from` offset. - Supports additional filters — by IP (`payload.ip.keyword`), by user, or by action type. **Example events tracked:** | Event | Description | | --- | --- | | `Created Workspace` | A workspace was created | | `Datasource Added` | A new source was connected | | `Datasource Removed` | A source was removed by user or retention policy | | `Datasource Shared` | A source was shared with a user | | `Resource visited` | A file or resource was accessed | | `Resource removed` | A file was deleted | | `Resource removed by retention policy` | A file was removed by a retention rule | | `Workspace was shared with user` | Workspace sharing event | ## Pushing to a SIEM The script outputs standard JSON arrays. Common ingestion patterns: | SIEM | Ingestion pattern | | --- | --- | | Splunk | Use the HTTP Event Collector (HEC), or point a file monitor input at the output directory | | Elastic (ELK) | Use Filebeat with a JSON log input, or POST directly to the Elasticsearch Bulk API | | Sumo Logic | Use a hosted collector with a JSON source pointed at the output directory, or the HTTP source to POST events programmatically | | Microsoft Sentinel | Use the Log Analytics Data Collector API or the Azure Monitor Logs ingestion API | > [!NOTE] > Note > > The script pulls a fixed date range each time it runs; it does not automatically track where it left off. To avoid gaps or duplicates in your SIEM, run it on a recurring schedule (cron, Windows Task Scheduler, a CI pipeline, etc.) and manage the date window accordingly. A common pattern is to run it daily and set the range to the previous 24 hours.Each run fetches a fresh OAuth token automatically, so no manual token rotation is needed.