# tinker_cookbook.scripts.save_audit_log

[Source on GitHub](https://github.com/thinking-machines-lab/tinker-cookbook/blob/main/tinker_cookbook/scripts/save_audit_log.py)

Persist Tinker audit log entries to disk on a recurring schedule.

The Tinker audit log endpoint returns events for a single UTC day at a time. To build a durable archive of your organization's audit events, you need to poll the endpoint regularly and store the results yourself.

This script does that. It writes one JSON Lines file per UTC day to a local output directory:

```text
audit_logs/
  audit_log_2026-05-11.jsonl  # complete day, written once and skipped after
  audit_log_2026-05-12.jsonl  # complete day, written once and skipped after
  audit_log_2026-05-13.jsonl  # in-progress day, re-fetched on every tick
```

Days other than "today (UTC)" are treated as immutable once written. Today's file is rewritten on every poll because new events are still arriving.

Requirements:

- The caller's API key must have the `VIEW_AUDIT_LOG` capability (tinker-admin RBAC role).

Usage:

```text
# One-shot: fetch today's audit log and exit.
python -m tinker_cookbook.scripts.save_audit_log --once

# Backfill the last 7 days, then poll every hour.
python -m tinker_cookbook.scripts.save_audit_log \
    --output-dir ./audit_logs \
    --backfill-days 7 \
    --interval-seconds 3600
```