A valid request URL is required to generate request examples{
"audit_logs": [
{
"id": "<string>",
"typeURI": "<string>",
"eventType": "activity",
"eventTime": "2023-11-07T05:31:56Z",
"action": "create",
"outcome": "success",
"initiator": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"target": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"observer": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"signature": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"eventName": "virtual_key.updated",
"severity": "info",
"reason": {
"reasonCode": "<string>",
"reasonType": "<string>",
"message": "<string>"
},
"attachments": [
{
"name": "<string>",
"contentType": "<string>",
"content": "<string>"
}
],
"changes": {
"fields": [
{
"path": "<string>",
"old": "<unknown>",
"new": "<unknown>",
"redacted": true
}
],
"truncated": true
},
"tags": [
"<string>"
],
"requestMethod": "<string>",
"requestPath": "<string>",
"requestIP": "<string>",
"userAgent": "<string>",
"requestID": "<string>",
"sessionID": "<string>",
"authMethod": "sso_login",
"onBehalfOfId": "<string>",
"duration": 123
}
],
"total": 123,
"page": 123,
"limit": 123,
"total_pages": 123,
"has_more": true,
"next_cursor": "<string>"
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"routing_info": {
"provider": "anthropic",
"model": "<string>",
"key": "<string>",
"resolved_key_alias": {
"model_id": "<string>",
"model_name": "<string>",
"model_family": "<string>"
},
"is_fallback": true,
"primary_provider": "anthropic",
"primary_model": "<string>",
"requested_provider": "anthropic",
"requested_model": "<string>",
"server_side_fallback_model": "<string>"
},
"provider": "anthropic",
"original_model_requested": "<string>",
"resolved_model_used": "<string>",
"request_type": "<string>",
"mcp_request_type": "<string>",
"a2a_request_type": "<string>",
"a2a_agent_name": "<string>",
"error_type": "<string>",
"retry_after_ms": 150500,
"raw_request": "<unknown>",
"raw_response": "<unknown>",
"converted_request_type": "<string>",
"dropped_compat_plugin_params": [
"<string>"
],
"latency": 123,
"key_statuses": [
{
"key_id": "<string>",
"status": "success",
"provider": "anthropic",
"error": "<unknown>"
}
],
"fallback_attempts": [
{
"provider": "anthropic",
"model": "<string>",
"status_code": 123,
"type": "<string>",
"message": "<string>",
"skipped": true
}
],
"mcp_auth_required": {
"kind": "<string>",
"mcp_client_id": "<string>",
"mcp_client_name": "<string>",
"message": "<string>",
"authorize_url": "<string>",
"session_id": "<string>",
"subject_token_missing": true,
"exchange_error": "<string>"
},
"billed_usage": {
"prompt_tokens": 123,
"prompt_tokens_details": {
"text_tokens": 123,
"audio_tokens": 123,
"image_tokens": 123,
"cached_read_tokens": 123,
"cached_write_tokens": 123
},
"completion_tokens": 123,
"completion_tokens_details": {
"text_tokens": 123,
"accepted_prediction_tokens": 123,
"audio_tokens": 123,
"citation_tokens": 123,
"num_search_queries": 123,
"reasoning_tokens": 123,
"image_tokens": 123,
"rejected_prediction_tokens": 123
},
"total_tokens": 123,
"tool_usage": {
"web_search": {
"num_requests": 123
}
},
"cost": {
"input_tokens_cost": 123,
"output_tokens_cost": 123,
"reasoning_tokens_cost": 123,
"citation_tokens_cost": 123,
"search_queries_cost": 123,
"request_cost": 123,
"total_cost": 123
}
}
}
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"routing_info": {
"provider": "anthropic",
"model": "<string>",
"key": "<string>",
"resolved_key_alias": {
"model_id": "<string>",
"model_name": "<string>",
"model_family": "<string>"
},
"is_fallback": true,
"primary_provider": "anthropic",
"primary_model": "<string>",
"requested_provider": "anthropic",
"requested_model": "<string>",
"server_side_fallback_model": "<string>"
},
"provider": "anthropic",
"original_model_requested": "<string>",
"resolved_model_used": "<string>",
"request_type": "<string>",
"mcp_request_type": "<string>",
"a2a_request_type": "<string>",
"a2a_agent_name": "<string>",
"error_type": "<string>",
"retry_after_ms": 150500,
"raw_request": "<unknown>",
"raw_response": "<unknown>",
"converted_request_type": "<string>",
"dropped_compat_plugin_params": [
"<string>"
],
"latency": 123,
"key_statuses": [
{
"key_id": "<string>",
"status": "success",
"provider": "anthropic",
"error": "<unknown>"
}
],
"fallback_attempts": [
{
"provider": "anthropic",
"model": "<string>",
"status_code": 123,
"type": "<string>",
"message": "<string>",
"skipped": true
}
],
"mcp_auth_required": {
"kind": "<string>",
"mcp_client_id": "<string>",
"mcp_client_name": "<string>",
"message": "<string>",
"authorize_url": "<string>",
"session_id": "<string>",
"subject_token_missing": true,
"exchange_error": "<string>"
},
"billed_usage": {
"prompt_tokens": 123,
"prompt_tokens_details": {
"text_tokens": 123,
"audio_tokens": 123,
"image_tokens": 123,
"cached_read_tokens": 123,
"cached_write_tokens": 123
},
"completion_tokens": 123,
"completion_tokens_details": {
"text_tokens": 123,
"accepted_prediction_tokens": 123,
"audio_tokens": 123,
"citation_tokens": 123,
"num_search_queries": 123,
"reasoning_tokens": 123,
"image_tokens": 123,
"rejected_prediction_tokens": 123
},
"total_tokens": 123,
"tool_usage": {
"web_search": {
"num_requests": 123
}
},
"cost": {
"input_tokens_cost": 123,
"output_tokens_cost": 123,
"reasoning_tokens_cost": 123,
"citation_tokens_cost": 123,
"search_queries_cost": 123,
"request_cost": 123,
"total_cost": 123
}
}
}
}List audit logs (deprecated path)
Retrieves CADF-compliant audit log events with filtering, search, and
pagination via query parameters. Most filter dimensions accept either a
single value (singular parameter, e.g. action) or a JSON-encoded array
of values (plural parameter, e.g. actions); when both are supplied the
plural array takes precedence. List responses omit each event’s
changes diff; fetch the event by ID or export it to get the diff.
A valid request URL is required to generate request examples{
"audit_logs": [
{
"id": "<string>",
"typeURI": "<string>",
"eventType": "activity",
"eventTime": "2023-11-07T05:31:56Z",
"action": "create",
"outcome": "success",
"initiator": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"target": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"observer": {
"id": "<string>",
"typeURI": "<string>",
"name": "<string>",
"host": "<string>"
},
"signature": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"eventName": "virtual_key.updated",
"severity": "info",
"reason": {
"reasonCode": "<string>",
"reasonType": "<string>",
"message": "<string>"
},
"attachments": [
{
"name": "<string>",
"contentType": "<string>",
"content": "<string>"
}
],
"changes": {
"fields": [
{
"path": "<string>",
"old": "<unknown>",
"new": "<unknown>",
"redacted": true
}
],
"truncated": true
},
"tags": [
"<string>"
],
"requestMethod": "<string>",
"requestPath": "<string>",
"requestIP": "<string>",
"userAgent": "<string>",
"requestID": "<string>",
"sessionID": "<string>",
"authMethod": "sso_login",
"onBehalfOfId": "<string>",
"duration": 123
}
],
"total": 123,
"page": 123,
"limit": 123,
"total_pages": 123,
"has_more": true,
"next_cursor": "<string>"
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"routing_info": {
"provider": "anthropic",
"model": "<string>",
"key": "<string>",
"resolved_key_alias": {
"model_id": "<string>",
"model_name": "<string>",
"model_family": "<string>"
},
"is_fallback": true,
"primary_provider": "anthropic",
"primary_model": "<string>",
"requested_provider": "anthropic",
"requested_model": "<string>",
"server_side_fallback_model": "<string>"
},
"provider": "anthropic",
"original_model_requested": "<string>",
"resolved_model_used": "<string>",
"request_type": "<string>",
"mcp_request_type": "<string>",
"a2a_request_type": "<string>",
"a2a_agent_name": "<string>",
"error_type": "<string>",
"retry_after_ms": 150500,
"raw_request": "<unknown>",
"raw_response": "<unknown>",
"converted_request_type": "<string>",
"dropped_compat_plugin_params": [
"<string>"
],
"latency": 123,
"key_statuses": [
{
"key_id": "<string>",
"status": "success",
"provider": "anthropic",
"error": "<unknown>"
}
],
"fallback_attempts": [
{
"provider": "anthropic",
"model": "<string>",
"status_code": 123,
"type": "<string>",
"message": "<string>",
"skipped": true
}
],
"mcp_auth_required": {
"kind": "<string>",
"mcp_client_id": "<string>",
"mcp_client_name": "<string>",
"message": "<string>",
"authorize_url": "<string>",
"session_id": "<string>",
"subject_token_missing": true,
"exchange_error": "<string>"
},
"billed_usage": {
"prompt_tokens": 123,
"prompt_tokens_details": {
"text_tokens": 123,
"audio_tokens": 123,
"image_tokens": 123,
"cached_read_tokens": 123,
"cached_write_tokens": 123
},
"completion_tokens": 123,
"completion_tokens_details": {
"text_tokens": 123,
"accepted_prediction_tokens": 123,
"audio_tokens": 123,
"citation_tokens": 123,
"num_search_queries": 123,
"reasoning_tokens": 123,
"image_tokens": 123,
"rejected_prediction_tokens": 123
},
"total_tokens": 123,
"tool_usage": {
"web_search": {
"num_requests": 123
}
},
"cost": {
"input_tokens_cost": 123,
"output_tokens_cost": 123,
"reasoning_tokens_cost": 123,
"citation_tokens_cost": 123,
"search_queries_cost": 123,
"request_cost": 123,
"total_cost": 123
}
}
}
}{
"event_id": "<string>",
"type": "<string>",
"is_bifrost_error": true,
"status_code": 123,
"error": {
"type": "<string>",
"code": "<string>",
"message": "<string>",
"param": "<string>",
"event_id": "<string>"
},
"extra_fields": {
"routing_info": {
"provider": "anthropic",
"model": "<string>",
"key": "<string>",
"resolved_key_alias": {
"model_id": "<string>",
"model_name": "<string>",
"model_family": "<string>"
},
"is_fallback": true,
"primary_provider": "anthropic",
"primary_model": "<string>",
"requested_provider": "anthropic",
"requested_model": "<string>",
"server_side_fallback_model": "<string>"
},
"provider": "anthropic",
"original_model_requested": "<string>",
"resolved_model_used": "<string>",
"request_type": "<string>",
"mcp_request_type": "<string>",
"a2a_request_type": "<string>",
"a2a_agent_name": "<string>",
"error_type": "<string>",
"retry_after_ms": 150500,
"raw_request": "<unknown>",
"raw_response": "<unknown>",
"converted_request_type": "<string>",
"dropped_compat_plugin_params": [
"<string>"
],
"latency": 123,
"key_statuses": [
{
"key_id": "<string>",
"status": "success",
"provider": "anthropic",
"error": "<unknown>"
}
],
"fallback_attempts": [
{
"provider": "anthropic",
"model": "<string>",
"status_code": 123,
"type": "<string>",
"message": "<string>",
"skipped": true
}
],
"mcp_auth_required": {
"kind": "<string>",
"mcp_client_id": "<string>",
"mcp_client_name": "<string>",
"message": "<string>",
"authorize_url": "<string>",
"session_id": "<string>",
"subject_token_missing": true,
"exchange_error": "<string>"
},
"billed_usage": {
"prompt_tokens": 123,
"prompt_tokens_details": {
"text_tokens": 123,
"audio_tokens": 123,
"image_tokens": 123,
"cached_read_tokens": 123,
"cached_write_tokens": 123
},
"completion_tokens": 123,
"completion_tokens_details": {
"text_tokens": 123,
"accepted_prediction_tokens": 123,
"audio_tokens": 123,
"citation_tokens": 123,
"num_search_queries": 123,
"reasoning_tokens": 123,
"image_tokens": 123,
"rejected_prediction_tokens": 123
},
"total_tokens": 123,
"tool_usage": {
"web_search": {
"num_requests": 123
}
},
"cost": {
"input_tokens_cost": 123,
"output_tokens_cost": 123,
"reasoning_tokens_cost": 123,
"citation_tokens_cost": 123,
"search_queries_cost": 123,
"request_cost": 123,
"total_cost": 123
}
}
}
}/api/governance/audit-logs instead.| Permission | Granted via |
|---|---|
AuditLogs:View | RBAC role or API key scope |
Authorizations
Management API authentication for /api/* endpoints. Use the Authorization header
with Bearer <token>, where <token> is one of:
- a Bifrost management API key,
- a dashboard session token issued by
POST /api/session/login, - base64 of
<admin-username>:<admin-password>(legacy equivalent ofBasicAuth).
Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs -
the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.
Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a
Required Permissions table (Resource:Operation, for example Dashboard:View) above
its Authorizations section, and the caller's RBAC role or management API key scopes must
include what it lists, otherwise the request is rejected with 403 Forbidden.
A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.
OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account,
or auth disabled), every management endpoint except the public ones (/health,
/api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the
operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization.
The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN
environment variable. A missing header returns 401, a wrong token 403. The header
stops working once dashboard auth is enabled. The dashboard instead trades the token once
for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup.
See Required permissions for how
permissions are derived and which endpoints are exempt.
Query Parameters
Page number for offset-based pagination (default 1).
x >= 1Number of events to return per page (default 100, max 1000).
x <= 1000Opaque cursor for cursor-based pagination (from next_cursor).
Free-text search across audit event fields.
Filter by a single CADF action. The CADF action performed.
create, read, update, delete, authenticate, authorize, access, enable, disable, start, stop, backup, restore, export, import JSON array of CADF actions to filter by (OR match).
Filter by a single outcome. The CADF outcome of the action.
success, failure, pending JSON array of outcomes to filter by (OR match).
Filter by a single event type. Classifies the audit event.
activity, monitor, control JSON array of event types to filter by (OR match).
Filter by a single severity.
How sensitive the action is. info for routine changes, high for admin
actions with a large blast radius, such as role assignment or API key
creation.
info, high JSON array of severities to filter by (OR match).
Filter by a single event name (e.g. virtual_key.updated).
JSON array of event names to filter by (OR match).
Filter by a single initiator ID.
JSON array of initiator IDs to filter by (OR match).
Filter by a single initiator resource type. The type of resource involved in an audit event (initiator or target).
user, api_key, system, provider, virtual_key, team, customer, role, permission, guardrail, mcp_client, mcp_tool_group, plugin, config, session, inference JSON array of initiator resource types to filter by (OR match).
Filter by a single target ID.
JSON array of target IDs to filter by (OR match).
Filter by a single target resource type. The type of resource involved in an audit event (initiator or target).
user, api_key, system, provider, virtual_key, team, customer, role, permission, guardrail, mcp_client, mcp_tool_group, plugin, config, session, inference JSON array of target resource types to filter by (OR match).
Filter events at or after this time (RFC3339 or YYYY-MM-DD).
Filter events at or before this time (RFC3339 or YYYY-MM-DD; a date is treated as end-of-day).
Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).
Filter by a single HTTP request method.
JSON array of HTTP request methods to filter by (OR match).
Filter by a single request path prefix.
JSON array of request path prefixes to filter by (OR match).
Filter by a single client IP address.
JSON array of client IP addresses to filter by (OR match).
JSON array of tags to filter by (any match).
Field to sort by (default event_time).
Sort direction.
asc, desc Response
Successful response
A paginated result of audit logs.
The list of audit events.
Show child attributes
Show child attributes
Total count of events matching the filter.
Current page number.
Page size.
Total number of pages.
Whether there are more results.
Opaque cursor for the next page (cursor-based pagination).
Was this page helpful?