---
title: "List security logs"
method: GET
path: "/clusters/{cluster_id}/security-logs"
tags: ["Cluster Logs"]
---

# List security logs

`GET /clusters/{cluster_id}/security-logs`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/security-logs`
- Auth: API key in header `API-Key`

Returns WAF, bot detection, geo-blocking, rate limiting, and IP access control events for the cluster,
sorted by `created_at` (newest first by default).

When neither `start_time` nor `end_time` is provided the query covers the last hour.
The maximum date range is 90 days.

Required scope: `clusters:logs:read`

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `limit` integer
- `offset` integer
- `start_time` string, date-time
- `end_time` string, date-time
- `type` 'waf' | 'bot' | 'geo_block' | 'rate_limit' | 'ip_block' | 'captcha': Category of security event.
- `action` 'detect' | 'block'
- `source_ip` string
- `country` string
- `search` string
- `order` 'asc' | 'desc': Sort direction.

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- SecurityLog[]
  - `id` string, required
  - `timestamp` string, date-time, required
  - `type` 'waf' | 'bot' | 'geo_block' | 'rate_limit' | 'ip_block' | 'captcha', required: Category of security event.
  - `action` 'detect' | 'block', required
  - `source_ip` string, required: Client IP address.
  - `uri` string, required: Request path and query string.
  - `method` string, required: HTTP method.
  - `message` string, required
  - `attack_type` string, nullable, required: Primary OWASP attack category. Present for `waf` events only.
  - `severity` string, nullable, required: OWASP CRS severity level (e.g. `CRITICAL`, `ERROR`, `WARNING`, `NOTICE`). Present for `waf` events only.
  - `anomaly_score` integer, nullable, required: Cumulative WAF anomaly score. Present for `waf` events only.
  - `response_code` integer, nullable, required: HTTP response code returned to the client.
  - `country` string, nullable, required: ISO 3166-1 alpha-2 country code resolved from the client IP.
  - `matched_rules` MatchedSecurityRule[], required: All OWASP CRS rules matched for this request, aggregated from related WAF events.
    - `rule_id` string, required: OWASP CRS rule identifier.
    - `attack_type` string, required: OWASP attack category.
    - `message` string, required

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `402`: Client error
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)