G-g-core
Analytics

Get security events

Changed on

Retrieve security events over account's domains. A security event is recorded for every request passing through WAAP towards the origin server.

get/waap/v2/analytics/events

Request

  • Base URL
    https://api.gcore.com
  • URL
    https://api.gcore.com/waap/v2/analytics/events
  • Auth
    HTTP apikey

Query parameters

domainsinteger[]

List of domain IDs. Empty list means all domains belonging to the current account.

[
  1,
  2,
  3
]
has_policy_overrideboolean nullable

True selects events with applied overrides; false excludes them. Omit to include both.

order_by'request_time.asc' | 'request_time.desc'

Result sorting order.

Example:request_time.asc
limitinteger

Number of items to return

nextstring nullable

Cursor value to fetch next page of events log.

startstring required

Filter data items starting from a specified date in ISO 8601 format

Example:2024-04-13T00:00:00+01:00
endstring nullable

Filter data items up to a specified end date in ISO 8601 format. If not provided, defaults to the current date and time.

Example:2024-04-14T12:00:00Z
ipsstring[]

Filter traffic data by client IP.

[
  "1.2.3.4",
  "2001:678:194::3c25:ddad"
]
pathstring[]

Filter by URL path. '*' is wildcard.

[
  "/home",
  "/users/*/profile"
]
countriesstring[]

Filter data by a country code of the originating IP address in ISO 3166-1 alpha-2 format.

[
  "DE",
  "MY"
]
asnsinteger[]

Filter data by the ASN (Autonomous System Number) of the originating IP address. Not supported by /v1/analytics/requests.

[
  15169,
  13335
]
status_codesinteger[]

Filter data by HTTP response status code.

http_methodsHttpMethodType[]

Filter by HTTP methods

[
  "GET",
  "HEAD"
]
reference_idsstring[]

Filter data by reference IDs.

[
  "1140fcddf208cbdf01694e8e2f818a68"
]
request_idsstring[]

Filter data by request IDs.

[
  "96763b8fb655e9f18a2e04097b704e39-458959"
]
exclude_request_idsstring[]

Exclude data by request IDs.

[
  "96763b8fb655e9f18a2e04097b704e39-458959"
]
session_idsstring[]

Filter data by session IDs.

[
  "edab69d73b47cfecc3d3c038ada6c7de"
]
security_rule_namesstring[]

Filter data by name of a security rule matched the request.

[
  "SQL injection"
]
decisionEventDecision[]

Filter data by decision.

[
  "allowed",
  "blocked"
]
optional_actionOptionalAction[]

Filter data by optional action.

[
  "captcha",
  "challenge"
]
exclude_ipsstring[]

Exclude traffic data by client IP.

[
  "1.2.3.4",
  "2001:678:194::3c25:ddad"
]
exclude_countriesstring[]

Exclude data by a country code of the originating IP address in ISO 3166-1 alpha-2 format.

[
  "DE",
  "MY"
]
exclude_asnsinteger[]

Exclude data by the ASN (Autonomous System Number) of the originating IP address. Not supported by /v1/analytics/requests.

[
  15169,
  13335
]
exclude_session_idsstring[]

Exclude data by session IDs.

exclude_reference_idsstring[]

Exclude data by reference IDs.

exclude_security_rule_namesstring[]

Exclude data by name of a security rule matched the request.

[
  "SQL injection"
]
exclude_domainsinteger[]

Exclude data by domain ID.

ja3string[]

Filter by JA3 TLS client fingerprint. Each value must be exactly 32 hexadecimal characters, mixed case allowed, normalized to lowercase. Supply multiple values to match any of them. Omit the parameter to apply no JA3 filter.

[
  "e7d705a3286e19ea42f587b344ee6865"
]
ja4string[]

Filter by JA4 TLS client fingerprint. When present, the value must match the JA4 form <ja4_a>_<ja4_b>_<ja4_c> (a 10-character prefix and two 12-character hexadecimal hashes, mixed case allowed, normalized to lowercase). Supply multiple values to match any of them. Omit the parameter entirely to apply no JA4 filter.

[
  "t13d3113h2_e8f1e7e78f70_ce5650b735ce"
]
user_agentstring[]

Include entries whose user agent contains any of the supplied texts, case-insensitive partial match. Omit or provide an empty list to apply no user agent text filter.

[
  "Mozilla/5.0",
  "python-requests"
]
user_agent_clientsstring[]

Include entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client filter.

[
  "Chrome",
  "Firefox"
]
user_agent_devicesstring[]

Include entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device filter.

[
  "mac",
  "Nokia",
  "PlayStation"
]
tagsstring[]

Include entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag filter.

[
  "evasiveclient",
  "injectionattack"
]
organizationsstring[]

Include entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization filter.

[
  "Example Org",
  "Acme Corp"
]
exclude_user_agentstring[]

Exclude entries whose user agent contains any of the supplied texts, case-insensitive partial match. Omit or provide an empty list to apply no user agent text exclusion.

[
  "python-requests",
  "bot"
]
exclude_user_agent_clientsstring[]

Exclude entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client exclusion.

[
  "OpenAI GPTBot",
  "Uptimerobot"
]
exclude_user_agent_devicesstring[]

Exclude entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device exclusion.

[
  "SMART TV"
]
exclude_ja3string[]

Exclude entries whose JA3 TLS client fingerprint matches any of the supplied values. Each value must be exactly 32 hexadecimal characters, mixed case allowed, normalized to lowercase. Supply multiple values to exclude any of them. Omit the parameter to apply no JA3 exclusion.

[
  "e7d705a3286e19ea42f587b344ee6865"
]
exclude_ja4string[]

Exclude entries whose JA4 TLS client fingerprint equals any of the supplied values. An item must match the JA4 form <ja4_a>_<ja4_b>_<ja4_c> (a 10-character prefix and two 12-character hexadecimal hashes, mixed case allowed, normalized to lowercase). Omit the parameter to apply no JA4 exclusion.

[
  "t13d3113h2_e8f1e7e78f70_ce5650b735ce"
]
exclude_tagsstring[]

Exclude entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag exclusion.

[
  "mousedevice"
]
exclude_organizationsstring[]

Exclude entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization exclusion.

[
  "Acme corp"
]
exclude_status_codesinteger[]

Exclude entries with any of the given HTTP response status codes.

exclude_http_methodsHttpMethodType[]

Exclude entries with any of the given HTTP methods.

[
  "POST",
  "PUT"
]
exclude_optional_actionOptionalAction[]

Exclude entries that match any of the given optional action values.

[
  "captcha",
  "challenge"
]
exclude_decisionEventDecision[]

Exclude entries that match any of the given decisions.

[
  "allowed",
  "blocked"
]
exclude_pathstring[]

Exclude entries that match the given URL path pattern; '*' is wildcard.

[
  "/home",
  "/users/*/profile"
]
traffic_typesTrafficType[]

Include entries that have any of the given traffic types.

[
  "api",
  "ajax"
]

Response

Successful Response

nextstring nullable

Cursor value. When present, indicates possible availability of more data satisfying the request criteria. To fetch the next page, repeat the request with the original parameter and the cursor value attached, for example:

            GET /v2/analytics/events?start=2026-06-01T12:00:00Z&end=2026-06-02T00:00:00Z[...]&next=$next
            ```

The next page request _may_ return empty result set.

Example response

{
  "results": [
    {
      "policy_override": [
        {
          "matched": {
            "ID861": {
              "field": "query_params",
              "pattern_found": "SELECT * FROM MASTER"
            },
            "ID862": {}
          }
        }
      ],
      "decision": "blocked",
      "optional_action": "captcha",
      "scheme": "https"
    }
  ]
}

Changes