diff --git a/src/api/index.js b/src/api/index.js
index 222e732..d72368a 100644
--- a/src/api/index.js
+++ b/src/api/index.js
@@ -23,6 +23,7 @@ const express = require('express');
 const { requireBearer } = require('./middleware/bearerAuth');
 const { createEntriesRouter } = require('./routes/entries');
 const { createAdminRouter } = require('./routes/admin');
+const { aggregateCIDRs } = require('../validators');
 
 function createApiRouter({ auth, q }) {
   const router = express.Router();
@@ -33,7 +34,7 @@ function createApiRouter({ auth, q }) {
   router.use(auth.middleware);
 
   router.use('/entries', createEntriesRouter({ q }));
-  router.use('/', createAdminRouter({ q }));
+  router.use('/', createAdminRouter({ q, aggregateCIDRs }));
 
   return router;
 }
diff --git a/src/api/routes/admin.js b/src/api/routes/admin.js
index c1c8848..007ff99 100644
--- a/src/api/routes/admin.js
+++ b/src/api/routes/admin.js
@@ -10,7 +10,7 @@ function apiRequireAdmin(req, res, next) {
   next();
 }
 
-function createAdminRouter({ q }) {
+function createAdminRouter({ q, aggregateCIDRs }) {
   const router = express.Router();
   const json = express.json({ limit: '8kb' });
 
@@ -38,6 +38,48 @@ function createAdminRouter({ q }) {
     }
   });
 
+  // GET /api/v1/export — агрегированный CIDR whitelist (text/plain)
+  // Обычный пользователь — только своя компания.
+  // Admin — все компании, или ?company=<id> для фильтра.
+  router.get('/export', async (req, res) => {
+    try {
+      let companyId = null;
+      if (!req.user.isAdmin) {
+        const company = await q.getOrCreateCompany(req.user.clientId, req.user.companyName);
+        companyId = company.id;
+      } else if (req.query.company) {
+        const parsed = parseInt(req.query.company, 10);
+        if (Number.isFinite(parsed) && parsed > 0) companyId = parsed;
+      }
+      const cidrs = await q.getExportCIDRs(companyId);
+      const aggregated = aggregateCIDRs(cidrs);
+      res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+      res.send(aggregated.join('\n') + (aggregated.length ? '\n' : ''));
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // GET /api/v1/audit — лог операций.
+  // Обычный пользователь — только своя компания.
+  // Admin — все компании, или ?company=<id> для фильтра.
+  router.get('/audit', async (req, res) => {
+    try {
+      let companyId = null;
+      if (!req.user.isAdmin) {
+        const company = await q.getOrCreateCompany(req.user.clientId, req.user.companyName);
+        companyId = company.id;
+      } else if (req.query.company) {
+        const parsed = parseInt(req.query.company, 10);
+        if (Number.isFinite(parsed) && parsed > 0) companyId = parsed;
+      }
+      const rows = await q.getAudit(companyId);
+      res.json({ audit: rows });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
   return router;
 }