List security logs
const url = 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security-logs?limit=100&offset=0&type=waf&action=detect&order=desc';
const options = {
method: 'GET',
headers: {'API-Version': '2026-06-01.beta', 'API-Key': '<API-Key>'}
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}curl --request GET \
--url 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security-logs?limit=100&offset=0&type=waf&action=detect&order=desc' \
--header 'API-Key: <API-Key>' \
--header 'API-Version: 2026-06-01.beta'Returns WAF, bot detection, geo-blocking, rate limiting, and IP access control events for the cluster,
sorted by created_at (newest first by default).
When neither start_time nor end_time is provided the query covers the last hour.
The maximum date range is 90 days.
Required scope: clusters:logs:read
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”Maximum number of results to return.
Number of results to skip from the start.
Inclusive start time (ISO 8601). Defaults to one hour ago when omitted.
Inclusive end time (ISO 8601). Defaults to the current time when omitted.
Category of security event.
Filter by event type.
Filter by action taken on the request.
Filter by exact source IP address (IPv4 or IPv6).
Filter by ISO 3166-1 alpha-2 country code (uppercase).
Case-insensitive substring match on message and uri.
Sort order by created_at. Defaults to desc (newest first).
Header Parameters
Section titled “Header Parameters”Responses
Section titled “Responses”The request has succeeded.
A security event recorded for this cluster.
object
Category of security event.
Client IP address.
Request path and query string.
HTTP method.
Primary OWASP attack category. Present for waf events only.
OWASP CRS severity level (e.g. CRITICAL, ERROR, WARNING, NOTICE). Present for waf events only.
Cumulative WAF anomaly score. Present for waf events only.
HTTP response code returned to the client.
ISO 3166-1 alpha-2 country code resolved from the client IP.
All OWASP CRS rules matched for this request, aggregated from related WAF events.
An OWASP CRS rule that matched an incoming request.
object
OWASP CRS rule identifier.
OWASP attack category.
Example
[
{
"type": "waf",
"action": "detect",
"method": "POST",
"country": "US",
"matched_rules": [
{
"rule_id": "942100",
"attack_type": "sqli"
}
]
}
]Headers
Section titled “Headers”Total number of results across all pages, before pagination is applied.
RFC 8288 Link header containing next, prev, first, and last relations.
The server could not understand the request due to invalid syntax.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Access is unauthorized.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
Returned when a workspace plan quota would be exceeded. required_plan indicates the minimum plan needed to complete the request.
object
Machine-readable identifier of the quota that was hit, so a client can tell
quotas apart without parsing detail. Known values include cluster_limit
(the workspace’s total cluster allowance), cluster_size_quota (the
allowance for the requested cluster size) and cluster_size (the requested
size is not offered on the plan at all). New values may be added.
How many of the resource the workspace currently has.
Maximum allowed by the current plan. 0 means the plan does not include the resource at all.
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"current_plan": "example",
"required_plan": "example",
"code": "example",
"current_usage": 1,
"current_limit": 1
}The server cannot find the requested resource.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
object
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"errors": [
{
"field": "example",
"detail": "example",
"code": "example",
"value": "example"
}
]
}Client error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Headers
Section titled “Headers”Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}