Contraforce Export API
The Export API from Contraforce — 1 operation(s) for export.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/contraforce:contraforce-export-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: ContraForce Export API
description: ContraForce platform API for security operations management.
version: '2.0'
tags:
- name: Export
paths:
/api/v2/workspaces/{workspaceId}/export/audit:
get:
tags:
- Export
summary: Export audit events
operationId: v2-export-audit-events
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
format: uuid
- name: startTime
in: query
schema:
type: string
format: date-time
- name: endTime
in: query
schema:
type: string
format: date-time
- name: nextPageToken
in: query
schema:
type: string
- name: pageSize
in: query
schema:
pattern: ^-?(?:0|[1-9]\d*)$
type:
- integer
- string
format: int32
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ExportAuditResponse'
'400':
description: Bad request — validation or parameter binding failed.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'403':
description: Forbidden — insufficient scope or workspace access.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'429':
description: Too Many Requests
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'401':
description: Unauthorized — missing or invalid Bearer token.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'404':
description: Not found — workspace or resource is missing.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'500':
description: Internal server error.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
components:
schemas:
ProblemDetails:
type: object
properties:
type:
type:
- 'null'
- string
title:
type:
- 'null'
- string
status:
pattern: ^-?(?:0|[1-9]\d*)$
type:
- 'null'
- integer
- string
format: int32
detail:
type:
- 'null'
- string
instance:
type:
- 'null'
- string
ExportAuditResponse:
required:
- value
type: object
properties:
value:
type:
- 'null'
- array
items:
description: One workspace audit event in the machine-export shape.
$ref: '#/components/schemas/ExportedAuditEventDto'
description: The audit events in this page.
nextPageToken:
type:
- 'null'
- string
description: URL-safe token for the next page, or `null` when this is the last page.
description: Response envelope for the workspace audit-export endpoint.
ExportedAuditEventDto:
required:
- id
- timeGenerated
- workspaceId
- discriminator
- activityType
- activityAction
- actorId
- targetResourceType
- targetResourceId
type: object
properties:
id:
type: string
description: The audit entry's unique id.
format: uuid
timeGenerated:
type: string
description: When the audited activity happened (UTC).
format: date-time
workspaceId:
type: string
description: The ContraForce workspace the event belongs to.
format: uuid
discriminator:
type:
- 'null'
- string
description: The audit domain, e.g. `WorkspaceManagement` or `IncidentInvestigation`.
activityType:
type:
- 'null'
- string
description: The activity type name, e.g. `WorkspaceRoleChanged`.
activityAction:
type:
- 'null'
- string
description: The activity action name, e.g. `Update`.
actorId:
type: string
description: The id of the user or agent that performed the activity.
format: uuid
actorName:
type:
- 'null'
- string
description: The display name of the actor, when recorded.
actorEmail:
type:
- 'null'
- string
description: The email of the actor, when recorded.
targetResourceType:
type:
- 'null'
- string
description: The type of the resource the activity targeted, e.g. `Incident` or `User`.
targetResourceId:
type:
- 'null'
- string
description: The id of the resource the activity targeted.
targetResourceName:
type:
- 'null'
- string
description: The human-readable name of the target resource, when recorded.
metadata:
type:
- 'null'
- string
description: 'The entry''s activity-specific metadata serialized as a JSON string (including its
`$type` discriminator), or `null` when the entry carries none.'
description: One workspace audit event in the machine-export shape.
ApiProblemDetails:
type: object
properties:
type:
type:
- 'null'
- string
title:
type:
- 'null'
- string
status:
pattern: ^-?(?:0|[1-9]\d*)$
type:
- 'null'
- integer
- string
format: int32
detail:
type:
- 'null'
- string
instance:
type:
- 'null'
- string
code:
type:
- 'null'
- string
requestId:
type:
- 'null'
- string
timestamp:
type:
- 'null'
- string
target:
type:
- 'null'
- string
errors:
type:
- 'null'
- object
additionalProperties:
type: array
items:
type: string
description: 'API extension of ProblemDetails that surfaces the stable error code,
trace identifier, timestamp, optional target, and optional field-keyed validation
error map alongside the RFC 7807 members.'