BrambleHelp
ReferenceAdmin Centre API

Sign-ins & sessions

Every sign-in attempt (success, failure, interrupted for two-step sign-in) with where it came from, and the sessions currently signed in. Revoke a session to sign that device out.

MethodPathSummary
GET/v1/admin/tenant/sign-insSearch the tenant's sign-in logs
GET/v1/admin/tenant/sign-ins/facetsFilter options for the sign-in log report
GET/v1/admin/tenant/sign-ins/exportExport sign-in logs as CSV
GET/v1/admin/tenant/sign-ins/:idGet a single sign-in, with the activities done in that session
GET/v1/admin/tenant/sessionsList active Bramble Cloud sessions in this tenant
DELETE/v1/admin/tenant/sessions/:idRevoke (sign out) one session

#Search the tenant's sign-in logs

GET/v1/admin/tenant/sign-ins

Search the tenant's sign-in logs. >

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Query parameters

NameTypeDescription
limitinteger
pageinteger

Response 200

FieldTypeDescription
signInsarray of object
signIns[].idinteger
signIns[].created_atstring (date-time)
signIns[].user_idinteger, or null
signIns[].user_emailstring, or null
signIns[].user_namestring, or null
signIns[].statusstring: "success" | "failure" | "interrupted"
signIns[].failure_codestring, or null
signIns[].failure_reasonstring, or null
signIns[].applicationstring
signIns[].interactiveboolean
signIns[].auth_methodstring, or null
signIns[].mfa_resultstring, or null
signIns[].ipstring, or null
signIns[].countrystring, or null
signIns[].citystring, or null
signIns[].browserstring, or null
signIns[].osstring, or null
totalinteger
pageinteger
limitinteger
pagesinteger
Example response
JSON
{
  "signIns": [
    {
      "id": 42,
      "created_at": "2026-11-12T09:30:00.000Z",
      "user_id": 7,
      "user_email": "alex@example.com",
      "user_name": "Example user name",
      "status": "success",
      "failure_code": "string",
      "failure_reason": "string",
      "application": "string",
      "interactive": true,
      "auth_method": "string",
      "mfa_result": "string",
      "ip": "192.0.2.10",
      "country": "string",
      "city": "string",
      "browser": "string",
      "os": "string"
    }
  ],
  "total": 3,
  "page": 1,
  "limit": 1,
  "pages": 1
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Filter options for the sign-in log report

GET/v1/admin/tenant/sign-ins/facets
Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/facets
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Response 200

FieldTypeDescription
applicationsarray of any
failureCodesarray of any
countriesarray of any
Example response
JSON
{
  "applications": [],
  "failureCodes": [],
  "countries": []
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/facets' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Export sign-in logs as CSV

GET/v1/admin/tenant/sign-ins/export

Export sign-in logs as CSV. Requires audit.view. Same filters as GET /admin/tenant/sign-ins; capped at 50,000 rows.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/export
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/export' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Get a single sign-in, with the activities done in that session

GET/v1/admin/tenant/sign-ins/:id
Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/:id
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Path parameters

NameTypeDescription
idrequiredinteger

Response 200

FieldTypeDescription
signInobject
signIn.idinteger
signIn.created_atstring (date-time)
signIn.tenant_idinteger, or null
signIn.user_idinteger, or null
signIn.user_emailstring, or null
signIn.user_namestring, or null
signIn.user_typestring, or null
signIn.statusstring: "success" | "failure" | "interrupted"
signIn.failure_codestring, or null
signIn.failure_reasonstring, or null
signIn.applicationstring
signIn.client_idstring, or null
signIn.interactiveboolean
signIn.auth_methodstring, or null
signIn.mfa_resultstring, or null
signIn.policy_namestring, or null
signIn.ipstring, or null
signIn.client_reported_ipstring, or null
signIn.countrystring, or null
signIn.regionstring, or null
signIn.citystring, or null
signIn.browserstring, or null
signIn.osstring, or null
signIn.user_agentstring, or null
signIn.session_refstring, or null
sessionActivityany
Example response
JSON
{
  "signIn": {
    "id": 42,
    "created_at": "2026-11-12T09:30:00.000Z",
    "tenant_id": 1,
    "user_id": 7,
    "user_email": "alex@example.com",
    "user_name": "Example user name",
    "user_type": "string",
    "status": "success",
    "failure_code": "string",
    "failure_reason": "string",
    "application": "string",
    "client_id": "string",
    "interactive": true,
    "auth_method": "string",
    "mfa_result": "string",
    "policy_name": "Example policy name",
    "ip": "192.0.2.10",
    "client_reported_ip": "192.0.2.10",
    "country": "string",
    "region": "string",
    "city": "string",
    "browser": "string",
    "os": "string",
    "user_agent": "string",
    "session_ref": "string"
  },
  "sessionActivity": null
}

Errors

StatusMessage
404Not found

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sign-ins/42' \
  -H "X-API-Key: $BRAMBLE_KEY"

#List active Bramble Cloud sessions in this tenant

GET/v1/admin/tenant/sessions

List active Bramble Cloud sessions in this tenant. Requires audit.view. One row per signed-in browser session. Session IDs themselves are never returned — only a short hashed reference that matches sign-in logs and audit events.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sessions
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Permission (any of): audit.view.

Query parameters

NameTypeDescription
user_idnumber
userany

Response 200

FieldTypeDescription
sessionsarray of any
session_ttl_daysarray of any
Example response
JSON
{
  "sessions": [],
  "session_ttl_days": []
}

Example request

Bash
curl -X GET 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sessions' \
  -H "X-API-Key: $BRAMBLE_KEY"

#Revoke (sign out) one session

DELETE/v1/admin/tenant/sessions/:id

Revoke (sign out) one session. GLOBAL_ADMIN only. The user's current page keeps working until its short-lived access token expires (≤15 min), then they're asked to sign in again.

Address
https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sessions/:id
Requires
Signed-in session, X-API-Key, or a Bramble app access token (Authorization: Bearer).
Role: GLOBAL_ADMIN.

Path parameters

NameTypeDescription
idrequiredinteger

Response 200

FieldTypeDescription
successboolean
Example response
JSON
{
  "success": true
}

Errors

StatusMessage
404Session not found

Example request

Bash
curl -X DELETE 'https://<your-org>.brambleit.cloud/api/v1/admin/tenant/sessions/42' \
  -H "X-API-Key: $BRAMBLE_KEY"