--- title: "Get security events" method: GET path: "/waap/v2/analytics/events" tags: ["Analytics"] --- # Get security events `GET /waap/v2/analytics/events` ## Request - Base URL: `https://api.gcore.com` - URL: `https://api.gcore.com/waap/v2/analytics/events` - Auth: HTTP apikey Retrieve security events over account's domains. A security event is recorded for every request passing through WAAP towards the origin server. ## Query parameters - `domains` integer[]: List of domain IDs. Empty list means all domains belonging to the current account. - `has_policy_override` boolean, nullable: True selects events with applied overrides; false excludes them. Omit to include both. - `order_by` 'request_time.asc' | 'request_time.desc': Result sorting order. - `limit` integer: Number of items to return - `next` string, nullable: Cursor value to fetch next page of events log. - `start` string, required: Filter data items starting from a specified date in ISO 8601 format - `end` string, nullable: Filter data items up to a specified end date in ISO 8601 format. If not provided, defaults to the current date and time. - `ips` string[]: Filter traffic data by client IP. - `path` string[]: Filter by URL path. '*' is wildcard. - `countries` string[]: Filter data by a country code of the originating IP address in ISO 3166-1 alpha-2 format. - `asns` integer[]: Filter data by the ASN (Autonomous System Number) of the originating IP address. Not supported by `/v1/analytics/requests`. - `status_codes` integer[]: Filter data by HTTP response status code. - `http_methods` HttpMethodType[]: Filter by HTTP methods - `reference_ids` string[]: Filter data by reference IDs. - `request_ids` string[]: Filter data by request IDs. - `exclude_request_ids` string[]: Exclude data by request IDs. - `session_ids` string[]: Filter data by session IDs. - `security_rule_names` string[]: Filter data by name of a security rule matched the request. - `decision` EventDecision[]: Filter data by decision. - `optional_action` OptionalAction[]: Filter data by optional action. - `exclude_ips` string[]: Exclude traffic data by client IP. - `exclude_countries` string[]: Exclude data by a country code of the originating IP address in ISO 3166-1 alpha-2 format. - `exclude_asns` integer[]: Exclude data by the ASN (Autonomous System Number) of the originating IP address. Not supported by `/v1/analytics/requests`. - `exclude_session_ids` string[]: Exclude data by session IDs. - `exclude_reference_ids` string[]: Exclude data by reference IDs. - `exclude_security_rule_names` string[]: Exclude data by name of a security rule matched the request. - `exclude_domains` integer[]: Exclude data by domain ID. - `ja3` string[]: Filter by JA3 TLS client fingerprint. Each value must be exactly 32 hexadecimal characters, mixed case allowed, normalized to lowercase. Supply multiple values to match any of them. Omit the parameter to apply no JA3 filter. - `ja4` string[]: Filter by JA4 TLS client fingerprint. When present, the value must match the JA4 form `__` (a 10-character prefix and two 12-character hexadecimal hashes, mixed case allowed, normalized to lowercase). Supply multiple values to match any of them. Omit the parameter entirely to apply no JA4 filter. - `user_agent` string[]: Include entries whose user agent contains any of the supplied texts, case-insensitive partial match. Omit or provide an empty list to apply no user agent text filter. - `user_agent_clients` string[]: Include entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client filter. - `user_agent_devices` string[]: Include entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device filter. - `tags` string[]: Include entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag filter. - `organizations` string[]: Include entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization filter. - `exclude_user_agent` string[]: Exclude entries whose user agent contains any of the supplied texts, case-insensitive partial match. Omit or provide an empty list to apply no user agent text exclusion. - `exclude_user_agent_clients` string[]: Exclude entries whose parsed user agent client exactly equals any supplied value. Omit or provide an empty list to apply no user agent client exclusion. - `exclude_user_agent_devices` string[]: Exclude entries whose parsed user agent device exactly equals any supplied value. Omit or provide an empty list to apply no user agent device exclusion. - `exclude_ja3` string[]: Exclude entries whose JA3 TLS client fingerprint matches any of the supplied values. Each value must be exactly 32 hexadecimal characters, mixed case allowed, normalized to lowercase. Supply multiple values to exclude any of them. Omit the parameter to apply no JA3 exclusion. - `exclude_ja4` string[]: Exclude entries whose JA4 TLS client fingerprint equals any of the supplied values. An item must match the JA4 form `__` (a 10-character prefix and two 12-character hexadecimal hashes, mixed case allowed, normalized to lowercase). Omit the parameter to apply no JA4 exclusion. - `exclude_tags` string[]: Exclude entries whose tag exactly equals any supplied value. Omit or provide an empty list to apply no tag exclusion. - `exclude_organizations` string[]: Exclude entries whose organization exactly equals any supplied value. Omit or provide an empty list to apply no organization exclusion. - `exclude_status_codes` integer[]: Exclude entries with any of the given HTTP response status codes. - `exclude_http_methods` HttpMethodType[]: Exclude entries with any of the given HTTP methods. - `exclude_optional_action` OptionalAction[]: Exclude entries that match any of the given optional action values. - `exclude_decision` EventDecision[]: Exclude entries that match any of the given decisions. - `exclude_path` string[]: Exclude entries that match the given URL path pattern; '*' is wildcard. - `traffic_types` TrafficType[]: Include entries that have any of the given traffic types. ## Response `200` Successful Response - GetEventsResponse: Page of records from security event log. The data from the security event log are read in a streaming fashion, using cursor access pattern. - `results` EventSummary[], required: Records summary information. To fetch detailed information by an event, use [Get request details](/docs/api-reference/waap/analytics/get-request-details) - `policy_override` AppliedPolicyOverride[]: Applied overrides with id, t, and matched metadata keyed by target ID. Does not replace the final decision. - `id` integer, required: ID of the policy override applied to this request. - `t` 'waf_rule' | 'static_rule_template', required: Type of target affected by the override: 'waf_rule' for a detector or 'static_rule_template' for a rule. - `matched` object, required: Match evidence keyed by target reference: a detector ID such as 'ID861', or a rule ID such as '94'. A detector entry holds 'field' and 'pattern_found'. A rule entry holds the rule's metadata, such as 'action' and 'rule_name', and for a rule based on a detector result also that match's 'field' and 'pattern_found'. 'pattern_found' is empty when the matched content is hidden. For legacy records, evidence is retained only for the first matched target; subsequent matched targets have empty objects. - `id` string, required: Request's unique id - `path` string, required: Request path - `client_ip` string, required: Client's IP address. - `method` string, required: HTTP method - `rule_name` string, required: Name of the triggered rule - `country` string, required: Country code - `action` string, required: Action of the triggered rule - `rule_id` string, required: The ID of the triggered rule. - `domain` string, required: Domain name - `domain_id` integer, required: Domain ID - `request_time` integer, required: The UNIX timestamp in ms of the date a set of traffic counters was recorded - `status_code` integer, required: Status code for http request - `result` 'passed' | 'blocked' | 'suppressed' | '', required: The result of a request - `decision` 'blocked' | 'monitored' | 'allowed' | 'passed' | '', required: The decision made for processing the request through the WAAP. Empty when no decision was recorded. - `optional_action` 'captcha' | 'challenge' | '', required: An optional action that may be applied in addition to the primary decision. Empty when none applies. - `scheme` string: The URI scheme of the request that generated an event - `policy_override_allowed` boolean, required: Whether a Policy Override can be created for this request. - `next` string, nullable: Cursor value. When present, indicates _possible_ availability of more data satisfying the request criteria. To fetch the next page, repeat the request with the original parameter and the cursor value attached, for example: ``` GET /v2/analytics/events?start=2026-06-01T12:00:00Z&end=2026-06-02T00:00:00Z[...]&next=$next ``` The next page request _may_ return empty result set. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Unauthenticated - `404`: Not Found - `422`: Unprocessable Entity - `500`: Internal Server Error ## Changes - **2026-10-27** `c0c7a835b00f`: 1 info - added the new optional `query` request parameter `traffic_types` - **2026-10-08** `89a74fc11087`: 2 info - added the new optional `query` request parameter `asns` - added the new optional `query` request parameter `exclude_asns` - **2026-10-06** `3801e7cda13a`: 2 breaking, 8 warning, 2 info - the `results/items/decision` response's property type changed from no type to `string` for status `200` - the `results/items/optional_action` response's property type changed from no type to `string` for status `200` - added the new `` enum value to the `results/items/decision` response property for the response status `200` - added the new `` enum value to the `results/items/optional_action` response property for the response status `200` - …8 more - **2026-09-28** `60be8aaa53b5`: 2 info - added the new optional `query` request parameter `has_policy_override` - added the optional property `results/items/policy_override` to the response with the `200` status - **2026-09-14** `3a73a1e91e66`: 1 info - added the required property `results/items/policy_override_allowed` to the response with the `200` status [Operation history](https://skmtc.dev/g-core/apis/gcore-openapi/changes/waap/v2/analytics/events/get.md) --- [API](https://skmtc.dev/g-core/apis/gcore-openapi.md) - [All operations](https://skmtc.dev/g-core/apis/gcore-openapi/llms.txt) - [OpenAPI document](https://skmtc.dev/g-core/apis/gcore-openapi/revisions/a2b772345f3a?raw)