---
title: "Get top attacked paths from a specific IP (account-scoped)"
method: GET
path: "/waap/v2/ip-info/top-paths"
tags: ["IP Spotlight"]
---

# Get top attacked paths from a specific IP (account-scoped)

`GET /waap/v2/ip-info/top-paths`

Retrieve top attacked paths for an IP address, scoped to the authenticated account's domains

## Query parameters

- `ip` union, required — The IP address to check
  - string, ipv4
  - string, ipv6

## Response `200`

Successful Response

- TopPathDetail[]
  - `date` string, date-time, required — First seen timestamp for the IP+path within retention period
  - `path` string, required — Path value as stored in logs
  - `attack_types` string[] — Distinct rule names seen for this IP+path
  - `attacks` integer — Total detected attacks (blocked + monitored/suppressed outcomes)
  - `blocked` integer — Blocked attacks
  - `requests` integer — Total requests
  - `sessions` integer — Distinct sessions
  - `user_agents` integer — Distinct user agents
  - `duration` integer — `last_seen` - `first_seen` in seconds within retention

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Unauthenticated
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.dev/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.dev/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)