Contents
On this page

Export Events - Plugixa Activity Log

GET /plugixa-activity-log/v1/export

Download the events that match a set of filters as one CSV file.

Needs the export access level (see who can call what): administrators, and the roles allowed to export. Needs Plugixa Activity Log Pro, with the CSV export module on under Plugixa Activity Log -> Monitors.

Note. The file holds at most 50,000 events, taken oldest first. When more events match, the rest are left out without any sign in the file or the headers. Narrow the period with date_from and date_to and download in slices to be sure you have everything.

Note. Every download is itself recorded in the log, as event 9003, with the number of rows it held.

Request

GET https://your-site.example/wp-json/plugixa-activity-log/v1/export?min_severity=high&date_from=2026-11-01&date_to=2026-11-12

Query parameters

The same filters as List Events: severity, min_severity, event_code, group, module, user_id, user_login, user_role, ip, object_type, object_id, action, search, date_from, date_to and site_id. They combine with AND, and a value the server does not understand is dropped rather than refused.

The paging parameters of List Events (per_page, before_id, after_id, with_total) have no effect here. On multisite, a site administrator only ever gets their own site’s events, whatever site_id says.

Responses

200 OK. The body is the CSV file, not JSON.

Content-Type: text/csv; charset=utf-8
Content-Disposition: attachment; filename="activity-log-2026-11-12-093000.csv"
X-Content-Type-Options: nosniff

id,time_utc,time_site,severity,event_code,group,message,user_id,user,role,ip,object_type,object_id,object,site_id
48211,"2026-11-12 09:14:02","2026-11-12 10:14:02",medium,1003,Sign-ins,"Failed sign-in attempt for “sam”: the password was wrong.",5,sam,editor,203.0.113.9,user,5,sam,1
Column Meaning
id The event’s id
time_utc When it happened, UTC, YYYY-MM-DD HH:MM:SS
time_site The same moment on the site’s clock
severity informational, low, medium, high or critical
event_code The event code
group The name of the event’s area, as shown in the admin
message The sentence recorded at the time
user_id The WordPress user id, 0 when nobody was signed in
user The login recorded at the time
role The role the person had at the time
ip The client address
object_type, object_id, object What the event was about: its kind, its id (empty when there is none) and its label
site_id The network site

The file starts with a UTF-8 byte-order mark so that spreadsheet programs read it as UTF-8. A cell that starts with =, +, -, @, a tab or a carriage return gets a leading ', so a spreadsheet does not run it as a formula.

Errors

Plus the errors every endpoint can return.

Examples

curl -s "https://your-site.example/wp-json/plugixa-activity-log/v1/export?min_severity=high&date_from=2026-11-01&date_to=2026-11-12" \
  -u "admin:$WP_APP_PASSWORD" \
  -o activity-log.csv

<?php
$query = http_build_query(['min_severity' => 'high', 'date_from' => '2026-11-01', 'date_to' => '2026-11-12']);
$ch = curl_init('https://your-site.example/wp-json/plugixa-activity-log/v1/export?' . $query);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_USERPWD        => 'admin:' . getenv('WP_APP_PASSWORD'),
]);
file_put_contents('activity-log.csv', curl_exec($ch));
curl_close($ch);

const auth = Buffer.from(`admin:${process.env.WP_APP_PASSWORD}`).toString('base64');
const query = new URLSearchParams({ min_severity: 'high', date_from: '2026-11-01', date_to: '2026-11-12' });
const response = await fetch(`https://your-site.example/wp-json/plugixa-activity-log/v1/export?${query}`, {
  headers: {
    'Authorization': `Basic ${auth}`,
  },
});
const csv = await response.text();

Quick Links

Share