> For AI agents: the complete Sanity documentation index is available at [https://www.sanity.io/docs/llms.txt](https://www.sanity.io/docs/llms.txt).

# Activity Feed Export data reference

Reference for Activity Feed Export file paths, manifests, and OCSF event fields.

Activity Feed Export writes gzip-compressed newline-delimited JSON (NDJSON) event files and a JSON manifest for each completed export window. Event records use Open Cybersecurity Schema Framework (OCSF) version 1.9.0. The manifest has its own schema version, currently `1`.

## Object paths

Paths are relative to the bucket root or the optional folder configured for the destination:

**Object paths**

```text
event-logs/organization_id=YOUR_ORGANIZATION_ID/kind=activity-feed/dt=YYYY-MM-DD/
  WINDOW_START_MICROSECONDS-part-1.ndjson.gz
  WINDOW_START_MICROSECONDS-manifest.json
```

`YOUR_ORGANIZATION_ID` is your organization ID. `YYYY-MM-DD` is the UTC date of the window start. `WINDOW_START_MICROSECONDS` is the window start as Unix microseconds. Manifest schema version `1` lists at most one event file per window.

## Manifest fields

Every completed window has a manifest, including windows with no exported records. Its fields are:

#### Properties

**schemaVersion** (integer, required)

Manifest schema version. Currently 1; independent of the OCSF version.

**organizationId** (string, required)

Organization whose activity is exported.

**windowStart** (string, required)

Start of the ingest-time window, inclusive, as a UTC RFC 3339 timestamp.

**windowEnd** (string, required)

End of the ingest-time window, exclusive, as a UTC RFC 3339 timestamp.

**eventCount** (integer, required)

Total number of exported records across the listed files.

**files** (array<object>, required)

Event files for the window. Empty when no records were exported.

Each entry in `files` has these fields:

#### Properties

**name** (string, required)

Filename relative to the manifest's directory.

**fileFormat** (string, required)

ndjson: each decompressed line contains one JSON event.

**compression** (string, required)

gzip.

**eventCount** (integer, required)

Number of event records in this file.

**sizeBytes** (integer, required)

Size of the compressed file in bytes.

**sha256** (string, required)

SHA-256 digest of the compressed bytes, encoded as 64 lowercase hexadecimal characters.

This manifest lists one file containing one exported event:

**Non-empty-window manifest**

```json
{
  "schemaVersion": 1,
  "organizationId": "org-0001",
  "windowStart": "2026-09-22T10:00:00Z",
  "windowEnd": "2026-09-22T11:00:00Z",
  "eventCount": 1,
  "files": [
    {
      "name": "1790071200000000-part-1.ndjson.gz",
      "fileFormat": "ndjson",
      "compression": "gzip",
      "eventCount": 1,
      "sizeBytes": 349,
      "sha256": "89af1e46e1966288a0bf1637ff3ca785ccfc3b861f334a81d8f8055a12a18261"
    }
  ]
}
```

With no exported records, `eventCount` is `0` and `files` is empty:

**Empty-window manifest**

```json
{
  "schemaVersion": 1,
  "organizationId": "org-0001",
  "windowStart": "2026-09-22T11:00:00Z",
  "windowEnd": "2026-09-22T12:00:00Z",
  "eventCount": 0,
  "files": []
}
```

## Completion and integrity

The manifest arrives after the event files it lists. Treat an event file without its manifest as an incomplete window. For a completed window, the file event counts add up to the manifest's `eventCount`.

You can compare the compressed file sizes and SHA-256 digests with the manifest and count the decompressed NDJSON records. The digest detects corruption; it is not a cryptographic signature or a guarantee of tamper evidence.

The manifest counts exported records, not all source activity. Records that cannot be converted can be omitted while the rest of the window completes. The manifest has no omitted-record count.

## Example event

This synthetic Entity Management record illustrates the exported JSON shape. Each decompressed NDJSON line contains one record; indentation is shown here for readability.

**Example OCSF record**

```json
{
  "activity_id": 1,
  "activity_name": "Create",
  "actor": {
    "user": {
      "display_name": "Firstname Lastname",
      "email_addr": "actor@example.com",
      "uid": "usr-0001"
    }
  },
  "category_uid": 3,
  "class_name": "Entity Management",
  "class_uid": 3004,
  "entity": {
    "name": "example-import",
    "type": "import",
    "type_id": 99
  },
  "message": "A description of import.create.",
  "metadata": {
    "product": {
      "name": "Sanity",
      "url_string": "https://www.sanity.io",
      "vendor_name": "Sanity"
    },
    "tenant_uid": "org-0001",
    "uid": "ale-0001",
    "version": "1.9.0"
  },
  "severity": "Informational",
  "severity_id": 1,
  "status": "Success",
  "status_id": 1,
  "time": 1790074133883,
  "type_uid": 300401
}
```

## OCSF event mapping

For standard field definitions, required attributes, and allowed values, see the [OCSF 1.9.0 schema browser](https://schema.ocsf.io/1.9.0/). Sanity maps recorded actions to these event classes:

- [Entity Management (3004)](https://schema.ocsf.io/1.9.0/classes/entity_management): project and dataset administration, tokens, configuration, and other managed entities.
- [User Management (3007)](https://schema.ocsf.io/1.9.0/classes/user_management): invitations, membership changes, and membership requests.
- [Role Management (3008)](https://schema.ocsf.io/1.9.0/classes/role_management): role lifecycle and permission grant changes.

Sanity sets `category_uid` to `3` (Identity and Access Management) and severity to `Informational` (`severity_id: 1`).

The export derives `status` from the source action: the `failed` verb maps to `Failure` (`status_id: 2`); other supported verbs map to `Success` (`status_id: 1`). The status is not an independently measured execution outcome. `message` contains the source description when available.

The export maps selected source fields into OCSF. It does not copy the original Activity Log record in full, preserve arbitrary source metadata, or include an `unmapped` object. The original action string is not a separate exported field. Before-and-after values are not provided.

## Event metadata

The `metadata` object has these fields:

#### Properties

**version** (string, required)

OCSF schema version, 1.9.0.

**uid** (string, required)

Stable Activity Log event ID. Use this value to deduplicate records.

**tenant_uid** (string, required)

Organization ID.

**correlation_uid** (string)

Source correlation ID, when present. No correlation across other log products is guaranteed.

**product** (object, required)

Source product: name and vendor_name are Sanity; url_string is https://www.sanity.io.

## Actor and target identities

`actor.user` identifies the person or service performing the action. The managed `user` identifies the person affected by a User Management event. Sanity includes available identifiers, names, and email addresses; unavailable identity fields are omitted. A Sanity service actor uses `uid: "sanity-system"` and `type: "Service"`.

An `entity` has `type_id: 99` (Other), a descriptive `type`, and a `name`, `uid`, or both. Some actions identify only a resource type, not a unique resource. An `iam_role` has a `uid` (role slug), a `name` (display name), or both.

## Time windows and duplicates

Hourly windows group records by when Sanity received them. The OCSF `time` field preserves the original event timestamp in Unix milliseconds, so an older event can appear in a later delivery window. A missing original timestamp is represented as `0`.

Consumers must tolerate duplicate and out-of-order records, including during recovery. Use `metadata.uid` to identify the same event across deliveries. Connecting a destination does not provide a self-service historical export.

To configure automated delivery, see [Export activity to Google Cloud Storage](https://www.sanity.io/docs/platform-management/export-activity-to-google-cloud-storage).



## Related changelog entries

Entries are listed newest first; each link points to the full entry as markdown. Follow one when you need to know what changed, when, or why — for example, to summarize recent updates, explain behavior that differs from older documentation, or check whether a fix has shipped.

- [Manage v2026-10-16: Export organization activity to Google Cloud Storage](https://www.sanity.io/docs/changelog/206e66c8-0bfe-4e31-bd18-287229e29ec8.md) — October 16, 2026