Cluster Logs

List security logs

Returns WAF, bot detection, geo-blocking, rate limiting, and IP access control events for the cluster, sorted by created_at (newest first by default).

When neither start_time nor end_time is provided the query covers the last hour. The maximum date range is 90 days.

Required scope: clusters:logs:read

get/clusters/{cluster_id}/security-logs

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/security-logs
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required

Query parameters

limitinteger

Maximum number of results to return.

offsetinteger

Number of results to skip from the start.

start_timestring date-time

Inclusive start time (ISO 8601). Defaults to one hour ago when omitted.

end_timestring date-time

Inclusive end time (ISO 8601). Defaults to the current time when omitted.

type'waf' | 'bot' | 'geo_block' | 'rate_limit' | 'ip_block' | 'captcha'

Category of security event.

Filter by event type.

action'detect' | 'block'

Filter by action taken on the request.

source_ipstring

Filter by exact source IP address (IPv4 or IPv6).

countrystring

Filter by ISO 3166-1 alpha-2 country code (uppercase).

searchstring

Case-insensitive substring match on message and uri.

order'asc' | 'desc'

Sort direction.

Sort order by created_at. Defaults to desc (newest first).

Headers

API-Version'2026-06-01.beta' required

Response

The request has succeeded.

idstring required
timestampstring date-time required
type'waf' | 'bot' | 'geo_block' | 'rate_limit' | 'ip_block' | 'captcha' required

Category of security event.

action'detect' | 'block' required
source_ipstring required

Client IP address.

uristring required

Request path and query string.

methodstring required

HTTP method.

messagestring required
attack_typestring nullable required

Primary OWASP attack category. Present for waf events only.

severitystring nullable required

OWASP CRS severity level (e.g. CRITICAL, ERROR, WARNING, NOTICE). Present for waf events only.

anomaly_scoreinteger nullable required

Cumulative WAF anomaly score. Present for waf events only.

response_codeinteger nullable required

HTTP response code returned to the client.

countrystring nullable required

ISO 3166-1 alpha-2 country code resolved from the client IP.

Example response

[
  {
    "method": "POST",
    "country": "US",
    "matched_rules": [
      {
        "rule_id": "942100",
        "attack_type": "sqli"
      }
    ]
  }
]

Changes

No recorded changes to this operation across all 1 revision of this API.