---
title: "Get request log data"
method: GET
path: "/waap/v1/analytics/requests"
tags: ["Analytics"]
---

# Get request log data

`GET /waap/v1/analytics/requests`

Retrieve request log data over account's domains.
The log records every request passing through WAAP towards the origin server.

## Query parameters

- `domains` integer[] — List of domain IDs. Empty list means all domains belonging to the current account.
- `ordering` string — Sort data by given field.
- `start` string, required — Filter data items starting from a specified date in ISO 8601 format
- `end` string, nullable — Filter data items up to a specified end date in ISO 8601 format. If not provided, defaults to the current date and time.
- `limit` integer — Number of items to return
- `offset` integer — Number of items to skip
- `ips` string[] — Filter traffic data by client IP.
- `path` string, nullable — Filter by URL path with a glob-like pattern.
- `countries` string[] — Filter data by a country code of the originating IP address in ISO 3166-1 alpha-2 format.
- `status_codes` integer[] — Filter data by HTTP response status code.
- `http_methods` HttpMethodType[] — Filter by HTTP methods
- `reference_ids` string[] — Filter data by reference IDs.
- `request_ids` string[] — Filter data by request IDs.
- `session_ids` string[] — Filter data by session IDs.
- `security_rule_names` string[] — Filter data by name of a security rule matched the request.
- `decision` EventDecision[] — Filter data by decision.
- `optional_action` OptionalAction[] — Filter data by optional action.
- `exclude_ips` string[] — Exclude traffic data by client IP.
- `exclude_countries` string[] — Exclude data by a country code of the originating IP address in ISO 3166-1 alpha-2 format.
- `exclude_session_ids` string[] — Exclude data by session IDs.
- `exclude_reference_ids` string[] — Exclude data by reference IDs.
- `exclude_security_rule_names` string[] — Exclude data by name of a security rule matched the request.
- `exclude_domains` integer[] — Exclude data by domain ID.
- `ja3` string, nullable — Filter by JA3 TLS client fingerprint. When present, the value must be exactly 32 hexadecimal characters (mixed case allowed) and is case-folded to lowercase when the backend filter is built. Omit the parameter entirely to apply no JA3 filter.
- `user_agent` string, nullable — Include entries whose user agent contains the supplied text, case-insensitive partial match. Omit the parameter to apply no user agent text filter.
- `user_agent_clients` string[] — Include entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client filter.
- `user_agent_devices` string[] — Include entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device filter.
- `tags` string[] — Include entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag filter.
- `organizations` string[] — Include entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization filter.
- `exclude_user_agent` string, nullable — Exclude entries whose user agent contains the supplied text, case-insensitive partial match. Omit the parameter to apply no user agent text exclusion.
- `exclude_user_agent_clients` string[] — Exclude entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client exclusion.
- `exclude_user_agent_devices` string[] — Exclude entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device exclusion.
- `exclude_ja3` string, nullable — Exclude entries whose JA3 TLS client fingerprint equals the supplied value. Must be exactly 32 hexadecimal characters (mixed case allowed) and is case-folded to lowercase when the backend filter is built. Omit the parameter to apply no JA3 exclusion.
- `exclude_tags` string[] — Exclude entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag exclusion.
- `exclude_organizations` string[] — Exclude entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization exclusion.

## Response `200`

Successful Response

- PaginatedResponseRequestSummary
  - `limit` integer, required — Number of items requested in the response
  - `offset` integer, required — Items response offset used
  - `count` integer, required — Number of items contain in the response
  - `results` RequestSummary[], required — List of items returned in the response following given criteria
    - `id` string, required — Request's unique id
    - `path` string, required — Request path
    - `client_ip` string, required — Client's IP address.
    - `method` string, required — HTTP method
    - `rule_name` string, required — Name of the triggered rule
    - `country` string, required — Country code
    - `action` string, required — Action of the triggered rule
    - `rule_id` string, required — The ID of the triggered rule.
    - `domain` string, required — Domain name
    - `domain_id` integer, required — Domain ID
    - `user_agent` string, required — User agent
    - `user_agent_client` string, required — Client from parsed User agent header
    - `organization` string, required — Organization
    - `request_time` integer, required — The UNIX timestamp in ms of the date a set of traffic counters was recorded
    - `reference_id` string, required — The reference ID to a sanction that was given to a user.
    - `session_id` string — The session ID associated with the request.
    - `status_code` integer, required — Status code for http request
    - `result` 'passed' | 'blocked' | 'suppressed' | '', required
    - `traffic_types` string, required — Comma separated list of traffic types.
    - `decision` 'passed' | 'allowed' | 'monitored' | 'blocked' | '', required — The decision made for processing the request through the WAAP.
    - `optional_action` 'captcha' | 'challenge' | '', required — An optional action that may be applied in addition to the primary decision.
    - `scheme` string — The URI scheme of the request that generated an event
    - `http_version` string — HTTP version of request
    - `ja3` string — JA3 TLS client fingerprint as a 32-character lowercase hexadecimal MD5 hash, or an empty string when the record has no JA3 value.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Unauthenticated
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.dev/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.dev/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)