Query Batches of Archived Field History Data

You can query Field Audit Trail entries stored on the FieldHistoryArchive object.
Available in: Salesforce Classic (not available in all orgs), Lightning Experience, and the Salesforce mobile app
Available in: Enterprise, Performance, and Unlimited Editions

To return a large number of results, use a URI query.
/services/data/vXX.X/jobs/query
Here’s an example Post request.
{
    "operation": "query",
    "query": "SELECT ParentId, FieldHistoryType, Field, Id, NewValue, OldValueFROM FieldHistoryArchive WHERE FieldHistoryType = ‘Account’ AND CreatedDate > LAST_MONTH"
}
For more information about Bulk API queries, read Get Results for a Query Job in the Bulk API 2.0 and Bulk API Developer Guide.
You can also make a CURL request.
curl --include --request GET \
--header "Authorization: Bearer token" \
--header "Accept: text/csv" \
https://instance.salesforce.com/services/data/vXX.X/jobs/query/750R0000000zxr8IAA/results ?maxRecords=50000
These examples result in a CSV file that you can examine for auditing purposes.