Audit streaming and export cursors
Deliver audit events to an external archive and recover delivery gaps.
Audit streaming sends organization audit records to an approved external sink. The sink has its own delivery state and retention; it does not replace the local audit record at request time.
Configure a sink
Open Governance → Audit sinks, select an authenticated HTTPS or supported object-storage destination, and test its credential and write permissions. Choose a starting cursor or a retained start time and review the export scope.
The sink identity needs permission to write its destination only. Audit export can contain actor IDs, resource names, network addresses, and configuration changes. Apply the organization's residency and archive-access policy before enabling delivery.
Event identity and cursors
Every record has an immutable event ID. The stream exposes an opaque cursor for the next unread position. A cursor is not a timestamp and must be stored unchanged. Multiple records can share a timestamp without sharing a cursor.
Receivers must tolerate repeated delivery. A worker can lose acknowledgement after the destination stores a batch, then resend that batch. Deduplicate by event ID before producing downstream change tickets or alerts.
Acknowledgement and lag
The sink reports last successful delivery, current cursor, oldest pending event, and rejected batches. A successful endpoint health check does not prove that its consumer durably stored every event.
Acknowledge after durable ingestion. Keep processing separate from the network request so a downstream analytics outage does not discard the original audit batch. Monitor lag against local retention, not only against a preferred delivery interval.
Replay a gap
Pause the sink, identify its last durable cursor, and choose Replay from cursor. The replay preserves event IDs and can duplicate already delivered records. Do not assign new event IDs to replayed actions.
If the requested cursor is older than retained local history, Infra returns
cursor_expired. Recover the missing interval from an independently retained
archive or report the evidence gap. Restarting at the latest cursor cannot
reconstruct events that are no longer retained.
Rotation and removal
Rotate destination credentials with overlapping validity, verify delivery, and revoke the old credential after its active attempts finish. Disabling a sink stops new attempts but retains its cursor and history for a later resume.
Deleting a sink does not delete events already stored externally. Its archive retention and legal holds continue under the destination's own policy. Use Audit API for bounded queries and backup retention for a separate recovery-data lifecycle.