---
title: "Read Firewall Actions Summary by Project"
method: GET
path: "/v1/security/firewall/events/summary"
tags: ["security"]
---

# Read Firewall Actions Summary by Project

`GET /v1/security/firewall/events/summary`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/security/firewall/events/summary`
- Auth: HTTP bearer

Aggregate counts over the firewall actions matched by the same filters as `GET /v1/security/firewall/events`, without fetching any rows. Counts are of policies (mitigations), including ones that matched no requests.

## Query parameters

- `projectId` string, required
- `startTimestamp` number
- `endTimestamp` number
- `hosts` string
- `ip` string[]
- `isActive` boolean
- `action` string[]
- `actionType` string[]
- `ruleKind` 'system' | 'custom'
- `ruleId` string[]
- `teamId` string
- `slug` string

## Response `200`

- object
  - `blockingIps` number, required
  - `byAction` object, required
  - `byActionType` object, required
  - `challengingIps` number, required
  - `other` number, required
  - `total` number, required

## Other responses

- `400`: One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `408`
- `410`
- `500`

## Changes

- **2026-10-02** `41e24ae097d4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/api/changes/v1/security/firewall/events/summary/get.md)

---

[API](https://skmtc.dev/vercel/apis/api.md) - [All operations](https://skmtc.dev/vercel/apis/api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/api/revisions/4a06e85c2848?raw)