Audit API

GET /v1/audit

Auth: Bearer token. Permission: audit-log.view.

Returns the workspace's append-only activity log, newest first, with each event's actor shown by name rather than raw id, whether the actor was a person, an API key, or the system. Page with limit and cursor; nextCursor sits beside data. There are no filters: use the export for a time window. A caller limited to some locations sees only the events at those locations. Notes. - Newest first. There are no filters: page with cursor. - A caller limited to some locations sees only events at those locations, so a page can hold fewer than limit events while nextCursor is still set.

curl "https://api.brixsignage.com/v1/audit" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200: Success.

Response 401: Missing, expired or revoked bearer token.

Response 403: The token lacks the permission this operation needs (see x-brix-permission).

Response 5XX: Server error. The body carries a requestId to quote to support.

POST /v1/audit

Auth: Bearer token. Permission: audit-log.view.

Appends one client event to the workspace's activity log, for example that a help panel was opened. The action must be in the cms. namespace, so only events of that kind can be added this way. The actor is always the caller, never taken from the request body. The activity log is append-only: events can be added but never updated or deleted. Limited to 120 events a minute. Notes. - Needs only audit-log.view. The actor is always the caller; ipAddress and userAgent come from the request.

Request body: application/json

curl -X POST "https://api.brixsignage.com/v1/audit" \
  -H "Authorization: Bearer $BRIX_API_KEY" \
  -H "Content-Type: application/json"

Response 201: Success.

Response 401: Missing, expired or revoked bearer token.

Response 403: The token lacks the permission this operation needs (see x-brix-permission).

Response 422: action is missing or outside the cms. namespace, or nodeId is not a location you can see.

Response 429: More than 120 events a minute.

Response 5XX: Server error. The body carries a requestId to quote to support.

GET /v1/audit/export

Auth: Bearer token. Permission: audit-log.view.

Returns the activity log as a feed suitable for a log collector or SIEM tool. Unlike the regular activity log listing, results are returned oldest first, so a collector can page forward from a saved position without missing or re-reading events. Returns newline-delimited JSON by default; pass ?format=json for a human-readable array. Use the from and to parameters for a half-open time window, and the x-brix-next-cursor and x-brix-has-more response headers to page through results. Notes. - Oldest first. The default body is NDJSON: one AuditEvent object per line. The next-page cursor is in the X-Brix-Next-Cursor header (empty on the last page) and X-Brix-Has-More is 1 or 0. - With format=json the body is JSON: { data: AuditEvent[], nextCursor: string | null }.

curl "https://api.brixsignage.com/v1/audit/export" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 401: Missing, expired or revoked bearer token.

Response 403: The token lacks the permission this operation needs (see x-brix-permission).

Response 422: from or to is not an ISO-8601 timestamp.

Response 5XX: Server error. The body carries a requestId to quote to support.

GET /v1/audit/integrity

Auth: Bearer token. Permission: audit-log.view.

Returns the tamper-evidence chain for the workspace's activity log: a digest to record for later comparison, and the daily checkpoints behind it. Each complete UTC day of events is combined into one checkpoint linked to the day before. The current, still-open day is deliberately not yet included, since a checkpoint over data still being written would have to be recalculated.

curl "https://api.brixsignage.com/v1/audit/integrity" \
  -H "Authorization: Bearer $BRIX_API_KEY"

Response 200: Success.

Response 401: Missing, expired or revoked bearer token.

Response 403: The token lacks the permission this operation needs (see x-brix-permission).

Response 5XX: Server error. The body carries a requestId to quote to support.

POST /v1/audit/integrity/verify

Auth: Bearer token. Permission: audit-log.view.

Re-reads every event behind the integrity chain and recomputes it, to prove the activity log has not been altered since a digest was recorded. Returns HTTP 200 with ok: false when verification fails, rather than an error status, so a monitoring script can distinguish "the log was altered" from "the check itself failed". This is rate-limited because it re-reads the full log. Notes. - Answers 200 with ok: false when verification fails.

Request body: application/json

curl -X POST "https://api.brixsignage.com/v1/audit/integrity/verify" \
  -H "Authorization: Bearer $BRIX_API_KEY" \
  -H "Content-Type: application/json"

Response 200: Success.

Response 401: Missing, expired or revoked bearer token.

Response 403: The token lacks the permission this operation needs (see x-brix-permission).

Response 429: More than 10 checks in 5 minutes.

Response 5XX: Server error. The body carries a requestId to quote to support.