Export the audit log

The sync server keeps an audit log for each team: who joined, who signed in and how, who was given which vault, which items of team vaults were added, changed or deleted, which device was revoked, and what the owner changed. Exporting it adds nothing to it except one event saying that an export was made. It never holds the contents of items: the server cannot read them.

Who can export

• The team owner, always, on every plan and without a licence.
• On a team with roles, a member whose role has the audit export permission (the built-in admin role does), when the team’s plan includes admin exports.

Every export is itself recorded, as audit.exported with the format, the date range and the event types asked for.

From the desktop app

1. Settings › Account & Sync › Teams › (your team) › Audit, then Export….
2. Choose CSV or NDJSON, the first and last day (both included, in your computer’s time zone; leave either empty for no limit) and, if you like, only some event types.
3. Choose where to save the file.

From the phone

Settings › Account & Sync › Teams › (the team) › Audit log › Export the audit log (CSV) sends the whole log, oldest first, to the share sheet. For a range or event types, use the desktop app or the API.

The file holds team members’ email addresses: keep it where you keep other team records.

From the API

GET /api/v1/teams/<team id>/audit/export?format=csv&from=<epoch ms>&to=<epoch ms>&types=member.added,vault.shared
Authorization: Bearer <session token>

Parameter	Meaning
format	csv (the default) or ndjson
from	Milliseconds since 1970, included. Absent: from the first event.
to	Milliseconds since 1970, not included. Absent: up to now. Must be after from.
types	Event types separated by commas. Absent: every type.

The answer is streamed, oldest first. An export whose range reaches now can miss an event that was still being saved; one whose to is a few seconds in the past is complete. The file name is sternway-audit-<date>.csv or .ndjson.

The fields

The fields and their order are stable; a later version may add fields at the end.

Field	Content
id	The event’s number. It only grows, so it also orders the events.
at	When it happened, ISO 8601 in UTC.
teamId	The team.
type	The event type.
actorId	The account that did it.
actorEmail	That account’s email address now.
userId	The account the event is about (the member added, the person given a vault), or empty.
userEmail	That account’s email address now, or empty.
meta	Details as a JSON object, such as {"vaultId":"…","permission":"edit"}.

In CSV, a cell that a spreadsheet would run as a formula (starting with =, +, -, @, a tab or a carriage return) gets a leading '. In NDJSON each line is one JSON object, meta is an object and empty fields are null.

Event types

auth.signin (with meta.method: password, sso, saml or recovery, and meta.secondFactor), item.changed (an item of a team vault created, updated or deleted, with its id, type and vault; never its contents), team.created, team.updated, team.deleted, team.digest.updated, team.saml.updated, team.saml.removed, auth.saml.signin, auth.sso.refused, account.passkey.added, account.passkey.removed, account.passkey.used, team.transfer.started, team.transfer.cancelled, team.transfer.declined, team.transfer.accepted, team.statement (a new signed member list), invite.created, member.added, member.removed, vault.created, vault.shared, vault.unshared, vault.access_expired, vault.rotated, vault.deleted, device.revoked, audit.exported.

Teams with policies and roles add: team.policy.relaxed, team.signer.tail_share, team.checkpoint_needed, team.proposal.created, team.proposal.resolved, team.attestation.overruled, vault.soft_deleted, vault.restored, vault.purged, vault.rotation_limited, report.exported, portal.ticket.issued, licence.loaded, licence.clock.reset and team.plan.set.

Push every event to a SIEM (self-hosted, Enterprise)

On a server you run, with a licence that includes audit push, the server can send every audit event to an HTTPS endpoint of yours, such as a SIEM’s HTTP event collector, about a minute after it happens. Set STERNWAY_AUDIT_PUSH_URL (and STERNWAY_AUDIT_PUSH_TOKEN if the endpoint wants one) on the server (Run the sync server). Then:

• it POSTs batches of up to 500 events as application/x-ndjson, each line exactly an NDJSON export line, with Authorization: Bearer <token> when a token is set;
• it starts with the events after the newest one when it first sees the endpoint (use the export for the past);
• it moves on only after a 2xx answer, and otherwise sends the same batch again after 10 seconds, then 20, 40 and so on up to every 15 minutes, for as long as it fails;
• it delivers at least once, not exactly once: deduplicate by id.

Without a licence that includes it, nothing is sent and the server’s log says why; the events stay in the database and the export has them.

Your own activity, without a team

Settings › Logs › Export my activity saves what this device already keeps about your own use, as CSV or NDJSON: your connection history and the session logs and recordings you have. The file is made on the device; nothing is sent. The fields are at, kind (connection, session_log or recording), hostId, hostLabel, detail and endedAt.