diff --git a/auditlog/src/main/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractors.scala b/auditlog/src/main/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractors.scala
index 46cf077..3cc9899 100644
--- a/auditlog/src/main/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractors.scala
+++ b/auditlog/src/main/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractors.scala
@@ -32,7 +32,7 @@
 
   // regular expressions to extract sub-commands
   // Rest API sub-command example: what = /config/server/version -> sub-command: config
-  private val REST_API_SUB_COMMAND = capture("""^\/(.*?)(?:\/|\s|$)""")
+  private val REST_API_SUB_COMMAND = capture("""^\/(?:a\/)?(.*?)(?:\/|\s|$)""")
   // SSH sub-command example: what = gerrit.plugin.reload.analytics -> sub-command: plugin
   private val SSH_SUB_COMMAND = capture("""^.*?\.(.*?)(?:\.|\s|$)""")
 
@@ -70,7 +70,7 @@
     case "GIT"                  => None
     case "JSON_RPC"             => None
     case unexpected             =>
-      logger.warn(s"Unexpected access path '$unexpected' encountered when extracting command from '$what'")
+      logger.warn(s"Unexpected access path '$unexpected' encountered when extracting sub-command from '$what'")
       None
   }
 
diff --git a/auditlog/src/test/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractorsSpec.scala b/auditlog/src/test/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractorsSpec.scala
index 4b5e298..950fc12 100644
--- a/auditlog/src/test/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractorsSpec.scala
+++ b/auditlog/src/test/scala/com/gerritforge/analytics/auditlog/spark/sql/udf/SparkExtractorsSpec.scala
@@ -224,6 +224,13 @@
     SparkExtractors.extractSubCommand(what, accessPath) shouldBe Some("changes")
   }
 
+  it should "extract authenticated REST API sub-command" in {
+    val what = "/a/changes/ffilz%2Fnfs-ganesha~372229/comments"
+    val accessPath = "REST_API"
+
+    SparkExtractors.extractSubCommand(what, accessPath) shouldBe Some("changes")
+  }
+
   it should "return no sub-commands failed AUTH" in {
     val what = s"AUTH"
     val accessPath = null