Settings and audit logs

GET /api/v1/settings/notifications

Your notification preferences.

PUT /api/v1/settings/notifications

Change preferences. Send only the fields to change.

GET /api/v1/settings/audit-logs

Audit entries.

Scope: member scope audit:read (audit:read:org with scope=org)

GET /api/v1/settings/audit-logs/export

Export audit entries.

Scope: member scope audit:export (audit:export:org with scope=org)

Notification preferences

Preferences are per user and per organization. Only these fields change what you receive today; they match the switches under Settings, Notifications in the console:

Field	Effect
email_enabled	Email delivery on or off.
slack_enabled	Slack delivery on or off. Needs a Slack connection.
email_scan_complete	Email me when an inbound message reaches my AI engineer (Messages to your engineer in the console). The field name is historical.
slack_scan_complete	The same notification, delivered to Slack.

Turn off engineer message emailsCopy

curl -X PUT https://api.breachline.io/api/v1/settings/notifications \
  -H "Authorization: Bearer $BREACHLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email_scan_complete": false}'

Caution

The response also contains older fields that are stored but change nothing: the per-severity flags (email_finding_critical, email_finding_high, email_finding_medium, email_finding_low, slack_findings_critical), email_weekly_digest (there is no digest), email_security_alerts (security alerts are always sent and cannot be switched off), email_product_updates and the browser_* fields. Do not build on them.

Audit logs

GET /settings/audit-logs returns your own trail by default. Pass scope=org for the whole organization, which needs audit:read:org.

Parameter	Notes
limit	1 to 500, default 100.
offset	Rows to skip.
severity	Filter by severity.
action_type	Filter by action.
scope	me (default) or org.

Each entry has id, timestamp, action, type, severity, status, actor, target, ip_address, user_agent, details and compliance_tags. The export endpoint takes the same filters. See Audit log for what is recorded.