> ## Documentation Index > Fetch the complete documentation index at: https://kernel.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update an audit log export destination > Apply a partial update to a destination. Requires an active Enterprise plan. Returns 409 when the destination was changed concurrently, because the merged configuration this request validated is no longer the one that would be stored; retry against fresh state. Pausing prevents new delivery attempts, but an S3 upload already in progress may complete after the response. ## OpenAPI ````yaml https://api.onkernel.com/spec.json patch /audit-logs/export/destinations/{id} openapi: 3.1.0 info: description: Developer tools and cloud infrastructure for AI agents to use web browsers title: Kernel API version: 0.1.0 servers: - description: API Server url: https://api.onkernel.com security: - bearerAuth: [] tags: - description: Create and manage browser sessions. name: Browsers - description: Control mouse, keyboard, and screen on the browser instance. name: Browser Computer Controls - description: Execute Playwright code against the browser instance. name: Browser Playwright - description: Read, write, and manage files on the browser instance. name: Browser Filesystem - description: Execute and manage processes on the browser instance. name: Browser Processes - description: Record and manage browser session video replays. name: Browser Replays - description: Stream logs from the browser instance. name: Browser Logs - description: Stream live telemetry events from a browser session. name: Browser Telemetry - description: Create, list, retrieve, and delete browser profiles. name: Profiles - description: Create and manage proxy configurations for routing browser traffic. name: Proxies - description: Create, list, retrieve, and delete browser extensions. name: Extensions - description: Create and manage browser pools for acquiring and releasing browsers. name: Browser Pools - description: Inspect the identity and authorization context for the current request. name: Authentication - description: >- Create and manage auth connections for automated credential capture and login. name: Managed Auth - description: Create and manage credentials for authentication. name: Credentials - description: Configure external credential providers like 1Password. name: Credential Providers - description: List applications and versions. name: Apps - description: Create and manage app deployments and stream deployment events. name: Deployments - description: Invoke actions and stream or query invocation status and events. name: Invocations - description: Read and manage organization-level limits. name: Organization - description: | Create and manage projects for resource isolation within an organization. When projects are disabled for the organization, project operations return `404` with code `projects_disabled`. name: Projects - description: Create and manage API keys for organization and project-scoped access. name: API Keys - description: Read audit log records for the authenticated organization. name: Audit Logs paths: /audit-logs/export/destinations/{id}: parameters: - in: path name: id required: true schema: maxLength: 128 type: string patch: tags: - Audit Logs summary: Update an audit log export destination description: >- Apply a partial update to a destination. Requires an active Enterprise plan. Returns 409 when the destination was changed concurrently, because the merged configuration this request validated is no longer the one that would be stored; retry against fresh state. Pausing prevents new delivery attempts, but an S3 upload already in progress may complete after the response. operationId: patchAuditLogExportDestinationsById requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateAuditLogExportDestinationRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AuditLogExportDestination' description: Audit log export destination updated '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/InternalError' security: - bearerAuth: [] components: schemas: UpdateAuditLogExportDestinationRequest: additionalProperties: false properties: bucket: maxLength: 63 minLength: 3 type: string kms_key_id: description: >- KMS key ID, alias, or ARN. Set to an empty string to remove the configured KMS key; omit or send null to leave unchanged. maxLength: 2048 type: string prefix: maxLength: 512 type: string region: maxLength: 128 minLength: 1 type: string role_arn: maxLength: 2048 minLength: 1 type: string status: enum: - active - paused type: string type: object AuditLogExportDestination: additionalProperties: false description: >- An organization-scoped audit log export destination. Delivery is at-least-once for rows visible when their window is committed: a delivery that is retried rewrites the same object, and the same `event_id` can appear in more than one object, so consumers must deduplicate on `event_id`. Each event-time window is held for ten minutes before it commits; a row that becomes visible after its window is committed may not be delivered. Objects are written as `/destination_id=/org_id=/date=/hour=/-.jsonl.gz`, where `date` and `hour` are the UTC calendar hour that fully contains every row in the object, so the layout is safe to register as a Hive-partitioned table. The object name is derived from the rows it holds, so a retried delivery rewrites its own object. properties: bucket: maxLength: 63 minLength: 3 type: string consecutive_failures: minimum: 0 readOnly: true type: integer x-go-type-skip-optional-pointer: true x-omitempty: false created_at: format: date-time readOnly: true type: string x-go-type-skip-optional-pointer: true external_id: maxLength: 128 readOnly: true type: string x-go-type-skip-optional-pointer: true format: enum: - jsonl.gz type: string id: maxLength: 128 readOnly: true type: string x-go-type-skip-optional-pointer: true kernel_role_arn: description: >- The Kernel role that assumes `role_arn` in your account to deliver logs. Allow this role as the principal in your role's trust policy, and require `external_id` as the `sts:ExternalId` condition. Recreating a destination issues a new `external_id`, which the trust policy has to be updated to match. maxLength: 2048 readOnly: true type: string x-go-type-skip-optional-pointer: true kms_key_id: maxLength: 2048 type: string last_error: description: Sanitized description of the most recent delivery failure. readOnly: true type: string last_error_at: format: date-time readOnly: true type: string last_exported_cursor: description: >- Opaque, versioned checkpoint for forward-only continuous export. This value is not compatible with audit-log list page tokens. Delivery starts at the moment the destination is activated, so events recorded before that are not delivered. Pausing stops delivery and resuming starts again from the time of the resume: events recorded while a destination was paused are never exported, and pausing is not a way to defer delivery. readOnly: true type: string last_success_at: format: date-time readOnly: true type: string next_attempt_at: format: date-time readOnly: true type: string prefix: maxLength: 512 type: string region: maxLength: 128 minLength: 1 type: string role_arn: maxLength: 2048 minLength: 1 type: string status: description: >- Pausing prevents new delivery attempts. An S3 upload already in progress may complete after the pause response; its rows can appear again after the destination is resumed. enum: - active - paused type: string type: enum: - s3 type: string updated_at: format: date-time readOnly: true type: string x-go-type-skip-optional-pointer: true required: - id - type - region - bucket - prefix - role_arn - external_id - kernel_role_arn - format - status - consecutive_failures - created_at - updated_at type: object Error: properties: code: description: Application-specific error code (machine-readable) example: bad_request type: string details: description: Additional error details (for multiple errors) items: $ref: '#/components/schemas/ErrorDetail' type: array inner_error: $ref: '#/components/schemas/ErrorDetail' message: description: Human-readable error description for debugging example: 'Missing required field: app_name' type: string required: - code - message type: object ErrorDetail: properties: code: description: Lower-level error code providing more specific detail example: invalid_input type: string message: description: Further detail about the error example: Provided version string is not semver compliant type: string type: object responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad Request – invalid input Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Unauthorized – missing or invalid authorization token Forbidden: content: application/json: schema: $ref: '#/components/schemas/Error' description: Forbidden – insufficient permissions or plan NotFound: content: application/json: schema: $ref: '#/components/schemas/Error' description: Resource not found Conflict: content: application/json: schema: $ref: '#/components/schemas/Error' description: Conflict – resource already exists InternalError: content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal Server Error securitySchemes: bearerAuth: scheme: bearer type: http ````