API

The Audit Records API lets your own services, such as a SIEM or log archive, pull IAM audit records for your Kyndryl Bridge tenant with a single GET request.

Organizations often must keep audit records for a set period, or store them on their own premises, because of industry or regulatory rules. With this API, your tools fetch the records on your schedule. Kyndryl Bridge does not need your storage credentials or a network connection into your environment.

With the Audit Records API, you can:

Retrieve audit records for the tenants you have access to

Filter records by observer (service), event type, outcome, and action

Page through large result sets

Responses don't include IP addresses, network or application details, or personal information.

This API is pull-only. Bridge does not push audit records to your SIEM or cloud storage.

Before you begin

Your organization must be a tenant in Kyndryl Bridge.

Your service or user must have access to that tenant. Requests for a tenant you can't access return 403 Forbidden.

Records

Operations for managing Audit Records

list-audit-records

GET /api/audit/v4/records

List Audit Records

Retrieves a list of audit records. This endpoint supports pagination and filtering.

Query parameters

Name	In	Type	Required	Description
limit	Query	integer	No	None
offset	Query	integer	No	None
order	Query	string	No	None

Example responses

200 Response

{
  "status_code": 200,
  "pagination": {
    "count": 1,
    "total": 240,
    "offset": 0,
    "limit": 50,
    "first": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=0",
    "last": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=200",
    "next": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=50",
    "prev": null
  },
  "items": [
    {
      "typeURI": "http://schemas.dmtf.org/cloud/audit/1.0/event",
      "id": "string",
      "eventType": "activity",
      "eventTime": "2026-11-10T14:15:22Z",
      "action": "backup",
      "outcome": "success",
      "name": "string",
      "severity": "critical",
      "reason": { "reasonType": "string", "reasonCode": "string" },
      "initiator": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "target": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "observer": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "attachments": [ { "typeURI": "string", "name": "string", "contentType": "string", "content": "string" } ],
      "tags": [ "string" ],
      "measurements": [ { "metric": "string", "unit": "string", "value": "string" } ]
    }
  ]
}

Responses

Status	Meaning	Description	Schema
200	OK	Successful audit records retrieval	string

To perform this operation, you must be authenticated by means of one of the following methods: BearerAuth