Audit log

Who changed what, when. audit-events is the detailed trail (each change with its modified properties, before and after) with filters and CSV export; audit-log is the older request log.

MethodPathSummary
GET/v1/admin/tenant/audit-logSearch/list the tenant's audit log
GET/v1/admin/tenant/audit-log/:idGet a single audit log entry
GET/v1/admin/tenant/audit-eventsSearch the tenant's activity audit trail
GET/v1/admin/tenant/audit-events/facetsFilter options for the audit trail report
GET/v1/admin/tenant/audit-events/exportExport the audit trail as CSV
GET/v1/admin/tenant/audit-events/:idGet a single audit event, with modified properties

#Search/list the tenant's audit log

GET/v1/admin/tenant/audit-log

Search/list the tenant's audit log. Requires the audit.view permission. Supports free-text search, HTTP method, status-code class, and date-range filters, paginated.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Query parameters

NameTypeDescription
limitinteger
pageinteger
qany
methodstring
status_classany
fromany
toany

Response 200

FieldTypeDescription
logsarray of object
logs[].idinteger
logs[].created_atstring (date-time)
logs[].user_emailstring, or null
logs[].methodstring
logs[].pathstring
logs[].status_codeinteger
logs[].duration_msinteger
logs[].ipstring, or null
totalinteger
pageinteger
limitinteger
pagesinteger
Example response
JSON
{
  "logs": [
    {
      "id": 42,
      "created_at": "2026-11-12T09:30:00.000Z",
      "user_email": "alex@example.com",
      "method": "string",
      "path": "string",
      "status_code": 1,
      "duration_ms": 1,
      "ip": "192.0.2.10"
    }
  ],
  "total": 3,
  "page": 1,
  "limit": 1,
  "pages": 1
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Get a single audit log entry

GET/v1/admin/tenant/audit-log/:id

Get a single audit log entry. Requires the audit.view permission. Returns the full row (SELECT *), unlike the list endpoint's trimmed column set.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/:id
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Path parameters

NameTypeDescription
idrequiredinteger

Response 200

FieldTypeDescription
logany
Example response
JSON
{
  "log": null
}

Errors

StatusMessage
404Not found

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-log/42' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Search the tenant's activity audit trail

GET/v1/admin/tenant/audit-events

Search the tenant's activity audit trail. >

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Query parameters

NameTypeDescription
limitinteger
pageinteger

Response 200

FieldTypeDescription
eventsarray of object
totalinteger
pageinteger
limitinteger
pagesinteger
Example response
JSON
{
  "events": [
    {}
  ],
  "total": 3,
  "page": 1,
  "limit": 1,
  "pages": 1
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Filter options for the audit trail report

GET/v1/admin/tenant/audit-events/facets

Filter options for the audit trail report. Requires audit.view. Every workload/category/activity/resource-type combination actually present in this tenant's retained audit trail, with counts — used to populate the report's filter dropdowns.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Response 200

FieldTypeDescription
facetsarray of object
facets[].workloadstring
facets[].categorystring
facets[].operationstring
facets[].target_typestring, or null
facets[].countinteger
Example response
JSON
{
  "facets": [
    {
      "workload": "string",
      "category": "string",
      "operation": "string",
      "target_type": "string",
      "count": 3
    }
  ]
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/facets' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Export the audit trail as CSV

GET/v1/admin/tenant/audit-events/export

Export the audit trail as CSV. Requires audit.view. Same filters as GET /admin/tenant/audit-events; capped at 50,000 rows (newest first).

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/export' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Get a single audit event, with modified properties

GET/v1/admin/tenant/audit-events/:id
Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/:id
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Path parameters

NameTypeDescription
idrequiredinteger

Response 200

FieldTypeDescription
eventobject
event.idinteger
event.created_atstring (date-time)
event.tenant_idinteger, or null
event.workloadstring
event.categorystring
event.operationstring
event.resultstring: "success" | "failure"
event.result_reasonstring, or null
event.actor_typestring
event.actor_user_idinteger, or null
event.actor_emailstring, or null
event.actor_namestring, or null
event.target_typestring, or null
event.target_idstring, or null
event.target_namestring, or null
event.modified_propertiesobject, or null
event.detailsobject, or null
event.ipstring, or null
event.user_agentstring, or null
event.session_refstring, or null
event.request_methodstring, or null
event.request_pathstring, or null
Example response
JSON
{
  "event": {
    "id": 42,
    "created_at": "2026-11-12T09:30:00.000Z",
    "tenant_id": 1,
    "workload": "string",
    "category": "string",
    "operation": "string",
    "result": "success",
    "result_reason": "string",
    "actor_type": "string",
    "actor_user_id": 7,
    "actor_email": "alex@example.com",
    "actor_name": "Example actor name",
    "target_type": "string",
    "target_id": "string",
    "target_name": "Example target name",
    "modified_properties": {},
    "details": {},
    "ip": "192.0.2.10",
    "user_agent": "string",
    "session_ref": "string",
    "request_method": "string",
    "request_path": "string",
    "…parseUserAgent(row.user_": "…"
  }
}

Errors

StatusMessage
404Not found

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/audit-events/42' \
  -H "X-API-Key: $BRAMBLE_KEY"