# AffixIO SIEM and evidence export

Canonical page: https://www.affix-io.com/siem/
API base: https://api.affix-io.com
Connection surfaces index: https://www.affix-io.com/connections/
Site brief: https://www.affix-io.com/llms.txt

Pull the verification events AffixIO holds for your keys as newline-delimited JSON, for a SIEM or for an audit evidence pack.

## Endpoints

- `GET /api/export/siem`
- `GET /api/export/evidence` (identical handler, alternative name)

Authenticate with a Hub session, `Authorization: Bearer <key>`, `X-API-Key: <key>`, or a Hub admin token. Without credentials the response is 401.

Scope: a Hub session covers the keys on that account, an API key alone covers that key, an admin token covers all records.

## Query parameters

- `since` - ISO-8601 lower bound. Invalid values return 400.
- `until` - ISO-8601 upper bound.
- `format` - `ndjson` (default) or `json`. Anything else returns 400.
- `limit` - 1 to 10000, default 10000. When more events match, the most recent are kept.

## Responses

NDJSON: `Content-Type: application/x-ndjson; charset=utf-8`, `Content-Disposition` attachment with a timestamped filename, `X-Affix-Export-Count`, `X-Affix-Export-Truncated` (`1` when the window held more than the limit).

JSON: a single document with `generated_at`, `since`, `until`, `count`, `truncated`, `formats` and `events[]`.

## Line shape

```
{"ts":"<ISO-8601 UTC>","event":"<name>","source":"<record>","key_id":"<id or null>","detail":{ ... }}
```

Lines are sorted ascending by `ts`.

## Event names and sources

- `prove`, `verify`, `gate`, `attest` - from `key-usage-log` (`method`, `path`, `status`) or `decision-log` (`decision`, `circuit_id`, `proof_id`, `proof_digest`, `decision_source`).
- `merkle.leaf` - from `audit-merkle`. Detail: `audit_event`, `digest`, `leaf_hash`, `circuit_id`, `proof_id`.
- `spend`, `revoke` - from `spent-registry`. Detail: `digest`, `circuit_id`, `proof_id`, `spent_source`, `gate_id`.
- `key.revoked` - from `managed-keys`. Detail: `label`, `revoked_via`, `owner_user_id`, `owner_key_id`.
- `webhook.delivery` - from `webhooks`. Detail: `webhook_id`, `label`, `url`, `status`, `failure_count`, `active`, `events`.
- `decision` - a recorded outcome that did not map to prove, verify, gate or attest.
- `api.request` - any other authenticated call. Detail: `method`, `path`, `status`.

## Ingest pattern

Scheduled pull with a watermark: call the endpoint with `since` set to the end of the previous run and `until` set to now, write the response to a spool file, hand it to an existing log shipper. NDJSON needs no transformation for Splunk, Elastic, OpenSearch or Loki pipelines.

Index `ts` as the event time, `event` and `key_id` as keywords, `detail.decision` as a keyword, `detail.digest` as a keyword for joining to Merkle inclusion proofs and webhook payloads.

## Limits

- 10000 events per request.
- Pull only. No push channel, no streaming cursor.
- `webhook.delivery` reflects the last delivery per endpoint, not a delivery history.
- Timestamps come from the API host clock in UTC.
- No personal data. Digests, identifiers, request paths and hashes only.
- The export is not a certification and not an opinion on your controls. See https://www.affix-io.com/compliance/ and https://www.affix-io.com/nist/.

Related: https://www.affix-io.com/webhooks/ for signed pushes, https://api.affix-io.com/v1/merkle/root for the public audit root.

Last updated: 2026-08-14