List audit logs (deprecated path)

Error

A valid request URL is required to generate request examples

{
  "audit_logs": [
    {
      "id": "<string>",
      "typeURI": "<string>",
      "eventType": "activity",
      "eventTime": "2023-11-07T05:31:56Z",
      "action": "create",
      "outcome": "success",
      "initiator": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "target": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "observer": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "signature": "<string>",
      "createdAt": "2023-11-07T05:31:56Z",
      "reason": {
        "reasonCode": "<string>",
        "reasonType": "<string>",
        "message": "<string>"
      },
      "attachments": [
        {
          "name": "<string>",
          "contentType": "<string>",
          "content": "<string>"
        }
      ],
      "tags": [
        "<string>"
      ],
      "requestMethod": "<string>",
      "requestPath": "<string>",
      "requestIP": "<string>",
      "userAgent": "<string>",
      "duration": 123
    }
  ],
  "total": 123,
  "page": 123,
  "limit": 123,
  "total_pages": 123,
  "has_more": true,
  "next_cursor": "<string>"
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

GET

api

audit-logs

Error

A valid request URL is required to generate request examples

{
  "audit_logs": [
    {
      "id": "<string>",
      "typeURI": "<string>",
      "eventType": "activity",
      "eventTime": "2023-11-07T05:31:56Z",
      "action": "create",
      "outcome": "success",
      "initiator": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "target": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "observer": {
        "id": "<string>",
        "typeURI": "<string>",
        "name": "<string>",
        "host": "<string>"
      },
      "signature": "<string>",
      "createdAt": "2023-11-07T05:31:56Z",
      "reason": {
        "reasonCode": "<string>",
        "reasonType": "<string>",
        "message": "<string>"
      },
      "attachments": [
        {
          "name": "<string>",
          "contentType": "<string>",
          "content": "<string>"
        }
      ],
      "tags": [
        "<string>"
      ],
      "requestMethod": "<string>",
      "requestPath": "<string>",
      "requestIP": "<string>",
      "userAgent": "<string>",
      "duration": 123
    }
  ],
  "total": 123,
  "page": 123,
  "limit": 123,
  "total_pages": 123,
  "has_more": true,
  "next_cursor": "<string>"
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

This path is deprecated and will be removed in the following major release. Use /api/governance/audit-logs instead.

This endpoint is available in Bifrost Enterprise only.

Required Permissions

Permission	Granted via
`AuditLogs:View`	RBAC role or API key scope

How permissions work

Authorizations

Authorization

string

header

required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

a Bifrost management API key,
a dashboard session token issued by POST /api/session/login,
base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Query Parameters

page

integer

default:1

Page number for offset-based pagination (default 1).

Required range: x >= 1

limit

integer

default:100

Number of events to return per page (default 100, max 1000).

Required range: x <= 1000

cursor

string

Opaque cursor for cursor-based pagination (from next_cursor).

string

Free-text search across audit event fields.

action

enum<string>

Filter by a single CADF action. The CADF action performed.

Available options:

create,

read,

update,

delete,

authenticate,

authorize,

access,

enable,

disable,

start,

stop,

backup,

restore,

export,

import

actions

string

JSON array of CADF actions to filter by (OR match).

outcome

enum<string>

Filter by a single outcome. The CADF outcome of the action.

Available options:

success,

failure,

pending

outcomes

string

JSON array of outcomes to filter by (OR match).

event_type

enum<string>

Filter by a single event type. Classifies the audit event.

Available options:

activity,

monitor,

control

event_types

string

JSON array of event types to filter by (OR match).

initiator_id

string

Filter by a single initiator ID.

initiator_ids

string

JSON array of initiator IDs to filter by (OR match).

initiator_type

enum<string>

Filter by a single initiator resource type. The type of resource involved in an audit event (initiator or target).

Available options:

user,

api_key,

system,

provider,

virtual_key,

team,

customer,

role,

permission,

guardrail,

mcp_client,

mcp_tool_group,

plugin,

config,

session,

inference

initiator_types

string

JSON array of initiator resource types to filter by (OR match).

target_id

string

Filter by a single target ID.

target_ids

string

JSON array of target IDs to filter by (OR match).

target_type

enum<string>

Filter by a single target resource type. The type of resource involved in an audit event (initiator or target).

Available options:

user,

api_key,

system,

provider,

virtual_key,

team,

customer,

role,

permission,

guardrail,

mcp_client,

mcp_tool_group,

plugin,

config,

session,

inference

target_types

string

JSON array of target resource types to filter by (OR match).

start_date

string

Filter events at or after this time (RFC3339 or YYYY-MM-DD).

end_date

string

Filter events at or before this time (RFC3339 or YYYY-MM-DD; a date is treated as end-of-day).

period

string

Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).

request_method

string

Filter by a single HTTP request method.

request_methods

string

JSON array of HTTP request methods to filter by (OR match).

request_path

string

Filter by a single request path prefix.

request_paths

string

JSON array of request path prefixes to filter by (OR match).

request_ip

string

Filter by a single client IP address.

request_ips

string

JSON array of client IP addresses to filter by (OR match).

Response

Successful response

A paginated result of audit logs.

audit_logs

object[]

required

The list of audit events.

Show child attributes

total

integer<int64>

required

Total count of events matching the filter.

page

integer

required

Current page number.

limit

integer

required

Page size.

total_pages

integer

required

Total number of pages.

has_more

boolean

required

Whether there are more results.

next_cursor

string

Opaque cursor for the next page (cursor-based pagination).

Authentication

Inference

Integrations

Platform

Governance

Routing

Deprecated

List audit logs (deprecated path)

Authorizations

Query Parameters

Response