> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# enterprise.compliance.export.create
> Creates an audit-event export task. Runs asynchronously — the call returns immediately with status `COMPLIANCE_EXPORT_STATUS_PENDING`. Poll [enterprise.compliance.export.detail](/enterprise/v2/enterprise.compliance.export.detail) until status is `COMPLIANCE_EXPORT_STATUS_COMPLETED`, then call [enterprise.compliance.export.downloadUrl](/enterprise/v2/enterprise.compliance.export.downloadUrl) to fetch the archive. All filters are optional; omit them to export every event your enterprise's teams have captured.
Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).
**Auth:** Requires a **SIEM** enterprise API key (`X-API-Key`).
**Async:** Returns immediately with `COMPLIANCE_EXPORT_STATUS_PENDING`. Poll [enterprise.compliance.export.detail](/enterprise/v2/enterprise.compliance.export.detail) until status is `COMPLIANCE_EXPORT_STATUS_COMPLETED`, then call [enterprise.compliance.export.downloadUrl](/enterprise/v2/enterprise.compliance.export.downloadUrl).
**Filters:** `user` (user ID), `session_uid`, `start_time` (inclusive), `end_time` (exclusive), and `event_names` are all optional. Omit them to export every captured event across your enterprise's teams.
**Payloads:** Set `include_payload=true` to embed chat text, tool arguments, and tool results. Payloads exist only for Tier 2 data (requires a signed SIEM DPA); for Tier 1 (metadata-only) capture this flag has no effect.
**Concurrency:** One export at a time per enterprise. Creating a new export while another is `PENDING` or `PROCESSING` returns `failed_precondition`.
**Audit:** `reason` is logged for compliance review — supply a meaningful value.
**Output:** The archive is a ZIP containing a single `events.ndjson` file. See [Record format](/enterprise/v2/siem-record-format).
**Protocols:** Also callable via Connect RPC. See [Protocols](/enterprise/v2/protocols).
## OpenAPI
````yaml POST /v2/enterprise.compliance.export.create
openapi: 3.1.0
info:
title: Manus Enterprise SIEM Integrations OpenAPI v2
description: >-
API for enterprise administrators to export audit events (agent chat, tool
calls, and results) for compliance and SIEM workflows. Exports run
asynchronously and produce a ZIP archive of newline-delimited JSON (NDJSON).
All responses are wrapped with `{"ok": true, "request_id": "...", ...}` for
success and `{"ok": false, "request_id": "...", "error": {"code": "...",
"message": "..."}}` for errors. Every operation is callable via REST (paths
below) or via Connect RPC at
`/observability.v2.EnterpriseComplianceV2Service/`.
version: 2.0.0
servers:
- url: https://api.manus.im
security:
- ApiKeyAuth: []
paths:
/v2/enterprise.compliance.export.create:
post:
summary: CreateExport
description: >-
Creates an audit-event export task. Runs asynchronously — the call
returns immediately with status `COMPLIANCE_EXPORT_STATUS_PENDING`. Poll
[enterprise.compliance.export.detail](/enterprise/v2/enterprise.compliance.export.detail)
until status is `COMPLIANCE_EXPORT_STATUS_COMPLETED`, then call
[enterprise.compliance.export.downloadUrl](/enterprise/v2/enterprise.compliance.export.downloadUrl)
to fetch the archive. All filters are optional; omit them to export
every event your enterprise's teams have captured.
operationId: observability.v2.EnterpriseComplianceV2Service.CreateExport
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
user:
type: string
description: >-
Filter to a single user by user ID. Omit to include all
users across your enterprise's teams.
example: '114504'
session_uid:
type: string
description: >-
Filter to a single session (task). Omit to include all
sessions.
example: 5YX76pz7Dga3yztNVw97Dh
start_time:
type: string
format: date-time
description: >-
Lower time bound (RFC3339), inclusive. Only events with
`occurred_at` on or after this time are included.
end_time:
type: string
format: date-time
description: >-
Upper time bound (RFC3339), exclusive. Only events with
`occurred_at` strictly before this time are included.
event_names:
type: array
items:
$ref: '#/components/schemas/EventName'
description: Filter by event type. Omit to include all four event types.
include_payload:
type: boolean
description: >-
When true, embed each event's payload (chat text, tool
arguments, tool results) in the export. Payloads are only
available for events captured at Tier 2 (requires a signed
SIEM DPA); for metadata-only (Tier 1) data this has no
effect.
default: false
reason:
type: string
description: >-
Reason for the export. Logged for compliance auditing —
supply a meaningful value.
example: quarterly compliance review
responses:
'200':
description: Export task created successfully.
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example: true
description: Whether the request was successful.
request_id:
type: string
description: >-
Unique identifier for this API request, useful for
debugging.
uid:
type: string
description: >-
Unique identifier of the export task. Use it with
[enterprise.compliance.export.detail](/enterprise/v2/enterprise.compliance.export.detail)
and
[enterprise.compliance.export.downloadUrl](/enterprise/v2/enterprise.compliance.export.downloadUrl).
status:
$ref: '#/components/schemas/ComplianceExportStatus'
description: >-
Initial status. Always `COMPLIANCE_EXPORT_STATUS_PENDING`
for a freshly created task.
created_at:
type: string
format: date-time
description: Task creation time (RFC3339).
4XX:
description: Error response.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
components:
schemas:
EventName:
type: string
description: >-
Type of audit event. Each maps to one step of an agent session:
`USER_CHAT` (the user's message), `AGENT_REPLY` (the agent's response),
`TOOL_CALL` (a tool invocation with its arguments), `TOOL_RESULT` (the
result returned by a tool).
enum:
- EVENT_NAME_UNSPECIFIED
- EVENT_NAME_USER_CHAT
- EVENT_NAME_AGENT_REPLY
- EVENT_NAME_TOOL_CALL
- EVENT_NAME_TOOL_RESULT
ComplianceExportStatus:
type: string
description: >-
Lifecycle status of an export task. Flow: `PENDING` → `PROCESSING` →
`COMPLETED` (or `FAILED`).
enum:
- COMPLIANCE_EXPORT_STATUS_UNSPECIFIED
- COMPLIANCE_EXPORT_STATUS_PENDING
- COMPLIANCE_EXPORT_STATUS_PROCESSING
- COMPLIANCE_EXPORT_STATUS_COMPLETED
- COMPLIANCE_EXPORT_STATUS_FAILED
ErrorResponse:
type: object
description: Standard error response format returned when a request fails.
properties:
ok:
type: boolean
example: false
description: Always false for error responses.
request_id:
type: string
description: >-
Unique identifier for this API request, useful for debugging with
support.
error:
type: object
description: Error details.
properties:
code:
type: string
description: >-
Machine-readable error code: `invalid_argument`,
`unauthenticated`, `not_found`, `failed_precondition` (an export
is already in progress, or the export is not yet complete), or
`internal`.
message:
type: string
description: Human-readable error description explaining what went wrong.
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
````