Skip to main content
GET
Error
Required Permissions How permissions work

Authorizations

Authorization
string
header
required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

  • a Bifrost management API key,
  • a dashboard session token issued by POST /api/session/login,
  • base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

id
string
required

MCP tool log ID

Response

MCP tool log found

MCP tool execution log entry

id
string

Unique identifier for the log entry

llm_request_id
string

Links to the LLM request that triggered this tool call

project_id
string | null

The governance project the tool call was scoped to, or null when it named none. Recorded on the row, but the MCP log queries cannot filter on it.

project_name
string | null

The project's name as it stood when the tool call was served.

timestamp
string<date-time>

When the tool execution started

tool_name
string

Name of the MCP tool that was executed

server_label
string

Label of the MCP server that provided the tool

virtual_key_id
string

ID of the virtual key used for this tool execution

virtual_key_name
string

Name of the virtual key used for this tool execution

arguments
object

Tool execution arguments

result
object

Tool execution result

error_details
object

Error response from Bifrost

latency
number

Execution time in milliseconds

cost
number

Cost in dollars for this tool execution

status
enum<string>

Execution status

Available options:
processing,
success,
error
metadata
object

Custom metadata captured from request headers (configured via logging_headers or x-bf-lh-* prefix)

plugin_logs
string

JSON-serialized plugin log entries grouped by plugin name

redaction_mapping
object

Phase-scoped placeholder-to-original-value mappings for reversible MCP redactions. Present only on log detail responses when the caller has Logs:Reveal.

created_at
string<date-time>

When the log entry was created

virtual_key
object

Full virtual key object (populated when virtual_key_id is set)