# Braze in a lifecycle audit Where each audit area lives in Braze, how to read it without write access, and the behaviour that changes a finding. Deep Braze implementation QA, or one named person who did or did not get a message, belongs to braze-implementation-qa. Facts marked "sibling skill" come from braze-implementation-qa (checked 2026-10-17); the rest were read on 2026-11-01, and the available functions and frequency capping pages again on 2026-11-02. ## Read-only access - Remote MCP server: `https://mcp.braze.com/mcp` (US) or `https://mcp.braze.eu/mcp` (EU). OAuth with the user's own dashboard login; no REST key is pasted anywhere. - A company admin enables MCP OAuth access, and the user needs the "Use MCP Server" permission per workspace (sibling skill). Companies using IP allowlisting cannot use the remote server; do not ask anyone to remove an allowlist. - No read-only switch is documented. Connect as a dashboard user without edit rights on campaigns, Canvases, templates, segments and catalogs, keep client-side approval on for every tool call, and keep Operator Connect (beta) out of the audit: it edits campaigns and Canvases with no step approval. - Read tools for the audit: `get_workspaces` first, then `get_canvas_list`, `get_canvas_details`, `get_canvas_data_summary`, `get_canvas_data_series`, `get_campaign_list`, `get_campaign_details`, `get_campaign_dataseries`, `get_send_data_series`, `get_segment_list`, `get_segment_details`, `get_custom_attributes`, `get_events_list`. List the tools the connection exposes before relying on any. - Use only the read tools listed. Any tool whose Access column on the available functions page reads create, update, delete or write is off limits. On 2026-11-02 that included `duplicate_campaign` and the beta campaign tools, the catalog creates, edits and deletes, `create_media_library_asset`, the beta `create_segment` and `edit_segment`, the email template and content block creates and updates, `trigger_integration_sync`, and the Operator tools `send_operator_prompt` and `cancel_operator_job`. Operator Connect stays out of the audit. - REST fallback: a key created with read permissions only (for example `canvas.list`, `canvas.details`, `canvas.data_series`, `canvas.data_summary`; verify the names live). Key permissions cannot be edited after creation. The key stays in the user's environment; the agent drafts the call and the user runs it. ## Not returned by MCP or REST Entry audience, re-eligibility, entrance limits, exit criteria, delay durations, delivery validations and send settings (subscription setting, quiet hours, rate limit, frequency capping). Read these in the dashboard, quote them in the report and mark them configuration-only. ## Where each area lives - Journey coverage: Canvas and campaign lists and step structure through MCP; entries and sends per step through `get_canvas_data_series`; entry audience, re-eligibility and exits in the dashboard. - Triggers: action-based or API-triggered per Canvas; `get_events_list` for event names; Cloud Data Ingestion sync status through its read tools (never trigger a sync). - Segments: `get_segment_list` and `get_segment_details`. - Caps and quiet hours: Settings > Frequency Capping Rules per workspace; quiet hours in each campaign's or Canvas's send settings; workspace quiet hours were early access on 2026-10-17 (sibling skill; verify live). - Preferences: subscription groups; the "Send to these users" option on campaigns and the subscription setting in Canvas send settings. - Holdout: Global Control Group settings tab (percentage, exclusion tags, export). - Send logs: Currents or Snowflake Data Sharing message engagement events. ## Behaviour that changes findings - Caps count calendar days in the user's timezone (sibling skill). In-app messages and Content Cards neither count nor get capped. The most restrictive rule wins. Campaigns and Canvases that do not obey caps do not count toward them by default; each campaign and Canvas can be set to count toward caps, so read that setting for every exempt stream before rating FC04. API campaigns can set `override_frequency_capping`. - A capped Canvas step advances the user, who does not exit (FC06). Rate limiting runs first and capped users are not replaced. With quiet hours, the cap is checked first and a capped user is skipped. - Email "subscribed" is the default, not consent; only "opted_in" records an explicit confirmation (PC05). SMS, WhatsApp and LINE need a subscription group. - A hard bounce marks the address invalid without changing the subscription state (FC08). - Global Control Group: see measurement-and-holdouts.md for size, exclusions, shuffling and shared-address behaviour. Random bucket segments can overlap it (SG06). - Opens: Braze reports Machine Opens and Estimated Real Opens; use them, not total opens, when judging SG02. - The spam metric is indicative, because feedback loops report only part of complaints (DL10 uses Postmaster instead). ## Exports for the scripts - Send log: message engagement send events from Currents or Snowflake Data Sharing, with `external_id` salted and hashed in the warehouse. Event names: read the Currents event glossary live. - Holdout: Global Control Group membership export (Settings tab or `/users/export/global_control_group`), hashed the same way. - Inventory: Canvas and campaign lists with status, tags and last entry, plus the dashboard reads above. ## Prompts worth keeping - "In workspace Production, list every active Canvas and campaign with name, status, schedule type and last entry date. Make no changes." - "For Canvas ``, return daily entries and sends per step for 15 September to 14 October 2026 in UTC. Show raw numbers. Make no changes." - "List custom events. Confirm whether `report_volume_dropped` and `weekly_reports_dropped` exist and when each was last received. Make no changes." "Make no changes" states intent; it does not remove write access. Check one returned result against the dashboard before trusting the rest. ## Verify live REST key permission names, the MCP tool list, workspace quiet hours status, Currents event names, and the current Global Control Group page.