The CSV Export API exposes REST endpoints under /api/export/v1/ that return Validio data as text/csv for reporting, archival, and ingestion into BI tools or data warehouses. The same endpoints back the Export buttons in the Validio UI.

Base URL

https://YOUR-INSTALLATION.validio.io/api/export/v1/

Authentication

The CSV Export endpoints use the same Authorization header as the GraphQL API:

Authorization: <access-key>:<access-secret>

Refer to Managing API Keys for how to create credentials. The API key needs the same per-resource permission you would need in the UI — for example, SOURCES_READ to export sources, or INCIDENTS_READ to export incident groups.

Endpoints

Response format

Each response is a CSV download with a header row followed by data rows. The Content-Disposition filename includes the resource, an optional entity name, and the time range (or today's date if the request has no time bounds), for example incident-groups-2026-03-01_2026-04-01.csv.

Responses are capped at 100,000 rows. Narrow the time range or split a filter into multiple requests when you need more.

Filters and sort

The list endpoints (sources, validators, incident-groups, activities) accept two URL-encoded JSON query parameters:

• filter — narrows rows.
• sort — orders rows.

Both parameters use the same field shapes as the equivalent filter and sort inputs on the Validio UI; field names are documented per endpoint below.

Example, exporting incident groups in the production namespace for March 2026:

FILTER='{"namespace":["production"],"range":{"start":"2026-03-01T00:00:00Z","end":"2026-04-01T00:00:00Z"}}'

curl "https://YOUR-INSTALLATION.validio.io/api/export/v1/incident-groups?filter=$(printf '%s' "$FILTER" | jq -rR @uri)" \
  -H "Authorization: $VALIDIO_ACCESS_KEY:$VALIDIO_SECRET_ACCESS_KEY" \
  -o incident-groups-march.csv

Endpoint reference

Sources

GET /api/export/v1/sources

Validators

GET /api/export/v1/validators

Incident groups

GET /api/export/v1/incident-groups

Filter accepts range.start and range.end to time-bound the export.

Activities

GET /api/export/v1/activities

Visibility is scoped per activity type by the permissions on your API key — for example, SOURCES_READ lets the export include source-related activity entries. Filter fields: namespace, source, validator, timeRange.

Activity rows for deleted resources stay in the export with their original name preserved, so audit records like "user X deleted source Y" remain visible after Y is removed.

Incident debug records

GET /api/export/v1/incident-debug-records?incidentId={id}

Returns the rows produced by debugging the given incident. Columns are determined by the debug query at runtime — there is no fixed schema.

Sample data

GET /api/export/v1/sample-data?assetId={id}&credentialId={id}&query={sql}

Returns the rows produced by running query against the catalog asset. Columns are determined by the query at runtime — there is no fixed schema.

Scheduling

Export endpoints are stateless GET requests — schedule them with any tool that can call a URL with an Authorization header (cron, Airflow, GitHub Actions, your data orchestrator of choice). Pass time bounds in the filter querystring so each run downloads only the new rows.

Retention

Validio retains incident, activity, and metric history for a finite window. To preserve data beyond that window:

• Schedule exports more frequently than the retention boundary. If retention is 90 days, run the export at least weekly with a 30-day rolling window so a missed run does not lose data.
• Use overlapping ranges and dedupe on the ID column when stitching consecutive exports together.