Audit Export
Export your audit log for compliance and analysis.
Formats
Events can be exported as CSV or JSON.
How to Export
Click the CSV or JSON export buttons on your app's Requests page. The default range is 30 days and
days accepts up to 365, but you can only export what has not yet
been pruned: retention is 30 days on Starter, 90 on Growth and 2 years on Compliance, after which events are deleted
permanently. If you need an audit trail that outlives that window, export before it closes. Export is
available on every plan.
Dashboard export URL
GET /dashboard/apps/:app_id/export?format=json&days=30
This URL needs a logged-in browser session; it is not callable with a Bearer token, so there is no
programmatic export today. It also accepts period=1h,
24h or 7d in place of
days.
Exported fields
CSV has a fixed set of columns, in this order:
id,type,event_id,request_id,environment,provider,model,timestamp,decision,prompt_text,output_text,unavailable_fields
JSON returns {"events": [...]}, where each event has
id, type,
event_id, request_id,
environment, provider,
model, metadata,
payload and timestamp.
Token counts, cost and violations are not separate columns. In JSON they are inside
payload — usage
and cost_usd on an
ai.response — and violations are their own
policy.violation events, exported as rows like any other.
CSV carries neither metadata nor
payload, so use JSON if you need them.
The export contains your stored content in clear. Both formats decrypt every encrypted
field on the way out, after any redaction your rules applied, so the file leaves SignalVault's encryption
behind — treat it as sensitive.
In CSV the prompt and response are the prompt_text and
output_text columns. In JSON, mind the key names: every payload key ending in
_encrypted, such as payload.prompt_text_encrypted or
payload.tool_input_encrypted, holds plaintext, despite what it is called.
If a stored value cannot be decrypted, it is exported empty and its key is listed in the row's
unavailable_fields.