Skip to content
Authrim

Export diagnostic logs.

GET
/api/admin/diagnostic-logging/export
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/diagnostic-logging/export?tenantId=example&format=json&includeStats=false&sortMode=session&exportMode=full' \
  --header 'Authorization: Bearer <token>'

Export Diagnostic Logging in the Diagnostic Logging area. Use this operation to retrieve diagnostic logging data without mutating tenant state.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters ”
X-Tenant-Id
string

Tenant selector for multi-tenant admin requests.

Query Parameters

Section titled “Query Parameters ”
tenantId
required
string
<= 128 characters

Tenant whose diagnostic logs are exported.

clientIds
string

Comma-separated client identifiers. When the tenant has merged output on, the export also contains the entries of the same diagnostic sessions that are filed outside these clients’ folders (for example server entries with no client), and each entry names its writer in a source field (server or sdk).

startDate
string

Inclusive ISO 8601 or Unix timestamp lower bound.

endDate
string

Inclusive ISO 8601 or Unix timestamp upper bound.

sessionIds
string

Comma-separated diagnostic session identifiers. An identifier that is not a plain one (a token-shaped value) is stored as a fingerprint; it is found by the value it was written with, as the filter value is normalised the same way.

flowIds
string

Comma-separated Authrim authentication flow identifiers. Use this filter to isolate a single RP conformance test without relying on timestamps alone.

categories
string

Comma-separated diagnostic log categories.

format
string
default: json
Allowed values: json jsonl text
includeStats
boolean
sortMode
string
Allowed values: session category timeline

Order of the entries. Defaults to grouping by session, or to one timeline when the tenant has merged output on (diagnostic-logging.merged_output_enabled).

exportMode
string
Allowed values: full masked minimal

Privacy mode may only make stored data more restrictive. Whatever the mode, secrets (tokens, codes, client secrets, passwords, credential headers, secret parameters in URLs and form bodies) are exported as SHA-256 fingerprints or markers. Entries stored in full mode also have personal data redacted unless the tenant turned diagnostic-logging.filter_pii off. A token validation entry carries its tokenHash among its details, so exports can be matched on it.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Diagnostic log export response. JSON is returned by default; JSONL and text exports are returned as downloadable files when requested by query parameter.

object
logs
required
Array<object>
object
key
additional properties
statistics
object
key
additional properties
key
additional properties
Example 
{
  "logs": [
    {
      "timestamp": 1770000000000,
      "category": "token-validation",
      "tenantId": "default",
      "outcome": "success"
    }
  ],
  "statistics": {
    "total": 1
  }
}