Activity log export
The admin can download the activity log of an organization as a file. This page describes the file, so you can load it into your own systems, such as a security monitor or an archive. The user guide describes the log itself.
The export is part of the activity log option of the plan. An owner or an admin of the organization starts it in the admin, from Activity log; the person who does so is recorded in the log as having exported it.
The request#
The admin calls this address for you. You can call it from a script with the ID token of a signed-in owner or admin:
GET https://hotlayout.com/api/audit/export?orgId=<organization id>&from=2026-01-01&to=2026-01-31&format=csv
Authorization: Bearer <ID token>| Parameter | Meaning |
|---|---|
orgId |
the id of the organization |
from, to |
the period. A date (2026-01-31) or an instant in UTC (2026-01-31T10:00:00Z). from is included. A date in to means the end of that day. A period is up to 366 days |
format |
csv (the default) or jsonl |
The answer is a file, sent as it is prepared. Its name is hotlayout-audit-<organization id>-<from>-<to>.<csv or jsonl>.
A request is refused with a status and a short code in the body when:
| Status | Code | Why |
|---|---|---|
| 400 | bad_request, bad_period |
a parameter is missing or malformed, from is not before to, or the period is over 366 days |
| 400 | too_many_rows |
more than 200,000 events in the period; choose a shorter one |
| 401 | unauthenticated |
no valid token |
| 403 | forbidden |
the person is not an owner or an admin of the organization |
| 403 | embed_session |
the person came through embedding; they cannot export |
| 403 | not_licensed |
the licence is not active or does not include the activity log |
| 429 | rate_limited |
more than ten exports for the organization in an hour |
CSV#
UTF-8 with a byte order mark, so that Excel reads it right; lines end with CRLF; cells follow RFC 4180. A cell that would start a formula in a spreadsheet (it begins with =, +, -, @, a tab or a carriage return) gets a leading ', so it shows as text. Times are ISO 8601, in UTC.
The columns, in this order:
at,kind,actorKind,actorEmail,actorName,actorExternalId,actorUid,projectId,documentId,target,details,claimed,source,eventId| Column | Meaning |
|---|---|
at |
when it happened |
kind |
what happened, as area.action, for example document.published |
actorKind |
the kind of the actor |
actorEmail, actorName |
who did it, as they were at that moment |
actorExternalId |
for a person from your system, their user.id |
actorUid |
the internal id of the account or of the person from your system. For a service (actorKind is service) and for the HotLayout team (platform) it is the name of what acted, never the id of a person; a row nobody could vouch for has unsigned |
projectId, documentId |
where, when the event concerns one |
target |
the name of what the event is about, as it was then |
details |
more about the event, as JSON |
claimed |
what the editor reported and the server could not check, as JSON; empty when there is nothing |
source |
where the record came from |
eventId |
the unique id of the record |
Each export is itself recorded as an audit.exported event. Its details.rows is the number of events in the file, not counting the header line of a CSV.
JSON Lines#
One JSON object per line, in a file with the .jsonl extension; read it line by line. The fields are those of the record in the log:
| Field | Meaning |
|---|---|
eventId |
the unique id of the record |
at |
when it happened, ISO 8601, UTC |
kind |
what happened |
actor |
an object: kind, and when known uid, email, name, externalId, principal |
target |
an object: projectId, documentId, label, each when it applies |
details |
an object with more about the event |
claimed |
present only when the editor reported something the server could not check |
source |
where the record came from |
expireAt |
when the record will be deleted |
New fields can be added over time. Read the ones you need and ignore the rest.
What is in the file, and what is not#
The same as in the log: who did what and when, not the content of edits and not reading. Secrets never get into it. Records are kept 400 days, or 7 years with the activity log option, so a file can reach that far back and no further.