Audit log
Who changed what, when. audit-events is the detailed trail (each change with its modified properties, before and after) with filters and CSV export; audit-log is the older request log.
| Method | Path | Summary |
|---|---|---|
| GET | /v1/admin/tenant/audit-log | Search/list the tenant's audit log |
| GET | /v1/admin/tenant/audit-log/:id | Get a single audit log entry |
| GET | /v1/admin/tenant/audit-events | Search the tenant's activity audit trail |
| GET | /v1/admin/tenant/audit-events/facets | Filter options for the audit trail report |
| GET | /v1/admin/tenant/audit-events/export | Export the audit trail as CSV |
| GET | /v1/admin/tenant/audit-events/:id | Get a single audit event, with modified properties |
#Search/list the tenant's audit log
/v1/admin/tenant/audit-logSearch/list the tenant's audit log. Requires the audit.view permission. Supports free-text search, HTTP method, status-code class, and date-range filters, paginated.
- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Query parameters
| Name | Type | Description |
|---|---|---|
limit | integer | |
page | integer | |
q | any | |
method | string | |
status_class | any | |
from | any | |
to | any |
Response 200
| Field | Type | Description |
|---|---|---|
logs | array of object | |
logs[].id | integer | |
logs[].created_at | string (date-time) | |
logs[].user_email | string, or null | |
logs[].method | string | |
logs[].path | string | |
logs[].status_code | integer | |
logs[].duration_ms | integer | |
logs[].ip | string, or null | |
total | integer | |
page | integer | |
limit | integer | |
pages | integer |
Example response
{
"logs": [
{
"id": 42,
"created_at": "2026-11-12T09:30:00.000Z",
"user_email": "alex@example.com",
"method": "string",
"path": "string",
"status_code": 1,
"duration_ms": 1,
"ip": "192.0.2.10"
}
],
"total": 3,
"page": 1,
"limit": 1,
"pages": 1
}Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log' -Headers $headers#Get a single audit log entry
/v1/admin/tenant/audit-log/:idGet a single audit log entry. Requires the audit.view permission. Returns the full row (SELECT *), unlike the list endpoint's trimmed column set.
- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/:id- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Path parameters
| Name | Type | Description |
|---|---|---|
idrequired | integer |
Response 200
| Field | Type | Description |
|---|---|---|
log | any |
Example response
{
"log": null
}Errors
| Status | Message |
|---|---|
| 404 | Not found |
Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/42' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/42', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/42",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/42' -Headers $headers#Search the tenant's activity audit trail
/v1/admin/tenant/audit-eventsSearch the tenant's activity audit trail. >
- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Query parameters
| Name | Type | Description |
|---|---|---|
limit | integer | |
page | integer |
Response 200
| Field | Type | Description |
|---|---|---|
events | array of object | |
total | integer | |
page | integer | |
limit | integer | |
pages | integer |
Example response
{
"events": [
{}
],
"total": 3,
"page": 1,
"limit": 1,
"pages": 1
}Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events' -Headers $headers#Filter options for the audit trail report
/v1/admin/tenant/audit-events/facetsFilter options for the audit trail report. Requires audit.view. Every workload/category/activity/resource-type combination actually present in this tenant's retained audit trail, with counts — used to populate the report's filter dropdowns.
- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Response 200
| Field | Type | Description |
|---|---|---|
facets | array of object | |
facets[].workload | string | |
facets[].category | string | |
facets[].operation | string | |
facets[].target_type | string, or null | |
facets[].count | integer |
Example response
{
"facets": [
{
"workload": "string",
"category": "string",
"operation": "string",
"target_type": "string",
"count": 3
}
]
}Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets' -Headers $headers#Export the audit trail as CSV
/v1/admin/tenant/audit-events/exportExport the audit trail as CSV. Requires audit.view. Same filters as GET /admin/tenant/audit-events; capped at 50,000 rows (newest first).
- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export' -Headers $headers#Get a single audit event, with modified properties
/v1/admin/tenant/audit-events/:id- Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/:id- Requires
- Signed-in session,
X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of):audit.view.
Path parameters
| Name | Type | Description |
|---|---|---|
idrequired | integer |
Response 200
| Field | Type | Description |
|---|---|---|
event | object | |
event.id | integer | |
event.created_at | string (date-time) | |
event.tenant_id | integer, or null | |
event.workload | string | |
event.category | string | |
event.operation | string | |
event.result | string: "success" | "failure" | |
event.result_reason | string, or null | |
event.actor_type | string | |
event.actor_user_id | integer, or null | |
event.actor_email | string, or null | |
event.actor_name | string, or null | |
event.target_type | string, or null | |
event.target_id | string, or null | |
event.target_name | string, or null | |
event.modified_properties | object, or null | |
event.details | object, or null | |
event.ip | string, or null | |
event.user_agent | string, or null | |
event.session_ref | string, or null | |
event.request_method | string, or null | |
event.request_path | string, or null |
Example response
{
"event": {
"id": 42,
"created_at": "2026-11-12T09:30:00.000Z",
"tenant_id": 1,
"workload": "string",
"category": "string",
"operation": "string",
"result": "success",
"result_reason": "string",
"actor_type": "string",
"actor_user_id": 7,
"actor_email": "alex@example.com",
"actor_name": "Example actor name",
"target_type": "string",
"target_id": "string",
"target_name": "Example target name",
"modified_properties": {},
"details": {},
"ip": "192.0.2.10",
"user_agent": "string",
"session_ref": "string",
"request_method": "string",
"request_path": "string",
"…parseUserAgent(row.user_": "…"
}
}Errors
| Status | Message |
|---|---|
| 404 | Not found |
Example request
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/42' \
-H "X-API-Key: $BRAMBLE_KEY"const res = await fetch('https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/42', {
method: 'GET',
headers: { 'X-API-Key': process.env.BRAMBLE_KEY },
});
const data = await res.json();import os, requests
r = requests.get(
"https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/42",
headers={"X-API-Key": os.environ["BRAMBLE_KEY"]},
)
r.raise_for_status()
data = r.json()$headers = @{ 'X-API-Key' = $env:BRAMBLE_KEY }
Invoke-RestMethod -Method GET -Uri 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/42' -Headers $headersWas this page helpful?
Thanks for your feedback.