audit.sh

#!/bin/bash -euo pipefail

query='type+IN+audit.service_instance.create,audit.service_instance.delete'
total_pages=$(cf curl "/v2/events?results-per-page=100&q=${query}" | jq -c -r '.total_pages')

page=1

while [ $page -le $total_pages ]; do
  cf curl "/v2/events?&results-per-page=100&page=${page}&q=${query}" |
     jq -c -r '.resources[].entity | [ .timestamp, .actor_username, .type, .actee_name, .metadata.request.service_plan_guid ] | @csv '
  page=$((page + 1 ))
done