[api-gaps] G19. Audit export: the console's minimum shape (tracked by #33) #56

Priority 4 (when demand shows up) · Size M · Console milestone M4 · Tracked by #33

Problem

There's no audit export. This is already planned as #33 (Phase 3, triggered by a real compliance need). This issue records the minimum shape the console needs, so #33 can satisfy both at once.

Recommendation

Build it as part of #33 with this shape, and close this issue when #33 closes.

Plan (minimum the console needs)

1. POST /v1/audit-exports: the same filters as GET /v1/audit-events, plus format: ndjson|csv. Hot window only. Permission audit.view (app-confined keys forced to their Application, as for the list). Idempotency-Key required. Returns 202 with an export id.
2. GET /v1/audit-exports/{id}: status: pending|running|ready|failed, row_count, and, when ready, a signed S3 URL valid for 15 minutes, re-signed on each GET. Exports kept 7 days.
3. Worker: the jobs Lambda streams the query to a private S3 bucket (SSE-KMS, lifecycle delete at 7 days), in pages, so large exports never hold everything in memory.
4. Writes audit.exported (who, filters, row count), which is itself audited.

Acceptance

Delivered by #33. The console can request an export and download it when it's ready.

How to build it (per plan-remaining.md → Rules for every change): spec page and openapi.yaml first, then make gen; permission checks from the first commit; contract tests for every new or changed response; expand-only migrations, numbered in the order they reach production (0005 is reserved for #30); a Changelog entry.

Source: the management-console gap analysis (2026-10-21), openapi.yaml 1.0.0-draft.3, 118 operations.