Not in one call. The export caps at 31 days per request so the CSV stays under the 50 MB attachment limit, and a 90 day range returns a 422 rather than truncating silently.

for month in 07 08 09; do  halcyon audit export --workspace ws_halcyon \    --from 2025-$month-01 --to 2025-$month-28 \    --out audit-$month.csvdone

Three files concatenate cleanly, the header only appears on the first. Row order is stable within a range, so a re-run of the same window produces the same file.

The cap is downstream of the 50 MB attachment limit, so raising one without the other just moves the failure from a clean 422 to a truncated file. A busy workspace generates about 1.6 MB of audit CSV a day, which is where 31 came from.

Then the constraint goes away entirely. A signed download link with a short expiry has no size limit worth caring about, and it also stops us mailing a customer's audit trail as an attachment, which is the part compliance asks about.