A valid request URL is required to generate request examples{
"audit_logs": [
{
"id": 123,
"access_profile_id": 123,
"user_id": "<string>",
"actor": "<string>",
"action": "<string>",
"previous_values": "<string>",
"new_values": "<string>",
"metadata": "<string>",
"created_at": "2023-11-07T05:31:56Z"
}
],
"total_count": 123
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}List workspace-wide audit log entries (deprecated path)
A valid request URL is required to generate request examples{
"audit_logs": [
{
"id": 123,
"access_profile_id": 123,
"user_id": "<string>",
"actor": "<string>",
"action": "<string>",
"previous_values": "<string>",
"new_values": "<string>",
"metadata": "<string>",
"created_at": "2023-11-07T05:31:56Z"
}
],
"total_count": 123
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"provider": "anthropic",
"model_requested": "<string>",
"request_type": "<string>",
"error_type": "<string>"
}
}/api/governance/access-profiles/audit-logs instead.| Permission | Granted via |
|---|---|
AccessProfiles:View | RBAC role or API key scope |
Authorizations
Management API authentication for /api/* endpoints. Use the Authorization header
with Bearer <token>, where <token> is one of:
- a Bifrost management API key,
- a dashboard session token issued by
POST /api/session/login, - base64 of
<admin-username>:<admin-password>(legacy equivalent ofBasicAuth).
Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs -
the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.
Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a
Required Permissions table (Resource:Operation, for example Dashboard:View) above
its Authorizations section, and the caller's RBAC role or management API key scopes must
include what it lists, otherwise the request is rejected with 403 Forbidden.
A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint. See Required permissions for how permissions are derived and which endpoints are exempt.
Was this page helpful?