---
title: API
slug: api
createdAt: 2026-11-12T14:17:43.091Z
---

The Audit Records API lets your own services, such as a SIEM or log archive, pull IAM audit records for your Kyndryl Bridge tenant with a single **GET** request.

Organizations often must keep audit records for a set period, or store them on their own premises, because of industry or regulatory rules. With this API, your tools fetch the records on your schedule. Kyndryl Bridge does not need your storage credentials or a network connection into your environment.

With the Audit Records API, you can:

- Retrieve audit records for the tenants you have access to
- Filter records by observer (service), event type, outcome, and action
- Page through large result sets

Responses don't include IP addresses, network or application details, or personal information.

:::hint{type="info"}
This API is pull-only. Bridge does not push audit records to your SIEM or cloud storage.
:::

# Before you begin

- Your organization must be a tenant in Kyndryl Bridge.
- Your service or user must have access to that tenant. Requests for a tenant you can't access return 403 Forbidden.

# Records

Operations for managing Audit Records

## list-audit-records

:::BlockQuote
GET /api/audit/v4/records
:::

## List Audit Records

Retrieves a list of audit records. This endpoint supports pagination and filtering.

## Query parameters

| <font color="#f3f4f5">**Name**</font>**** | <font color="#e3e8ee">**In**</font>**** | <font color="#dee4ea">**Type**</font>**** | <font color="#e2e7ec">**Required**</font>**** | <font color="#e6ecf3">**Description**</font>**** |
| ----------------------------------------- | --------------------------------------- | ----------------------------------------- | --------------------------------------------- | ------------------------------------------------ |
| limit                                     | Query                                   | integer                                   | No                                            | None                                             |
| offset                                    | Query                                   | integer                                   | No                                            | None                                             |
| order                                     | Query                                   | string                                    | No                                            | None                                             |

:::BlockQuote
Example responses
:::

:::BlockQuote
200 Response
:::

```javascript
{
  "status_code": 200,
  "pagination": {
    "count": 1,
    "total": 240,
    "offset": 0,
    "limit": 50,
    "first": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=0",
    "last": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=200",
    "next": "https://<bridge-host>/api/audit/v4/records?limit=50&offset=50",
    "prev": null
  },
  "items": [
    {
      "typeURI": "http://schemas.dmtf.org/cloud/audit/1.0/event",
      "id": "string",
      "eventType": "activity",
      "eventTime": "2026-11-10T14:15:22Z",
      "action": "backup",
      "outcome": "success",
      "name": "string",
      "severity": "critical",
      "reason": { "reasonType": "string", "reasonCode": "string" },
      "initiator": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "target": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "observer": { "id": "string", "typeURI": "string", "name": "string", "domain": "string", "metadata": {} },
      "attachments": [ { "typeURI": "string", "name": "string", "contentType": "string", "content": "string" } ],
      "tags": [ "string" ],
      "measurements": [ { "metric": "string", "unit": "string", "value": "string" } ]
    }
  ]
}
```

## Responses

| <font color="#e6ecf3">**Status**</font>**** | <font color="#e2e9f1">**Meaning**</font>**** | <font color="#eeeff1">**Description**</font>**** | <font color="#eeeeef">**Schema**</font>**** |
| ------------------------------------------- | -------------------------------------------- | ------------------------------------------------ | ------------------------------------------- |
| 200                                         | OK                                           | Successful audit records retrieval               | string                                      |

To perform this operation, you must be authenticated by means of one of the following methods: BearerAuth