---
title: "Read active attack data"
method: GET
path: "/v1/security/firewall/attack-status"
tags: ["security"]
---

# Read active attack data

`GET /v1/security/firewall/attack-status`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/security/firewall/attack-status`
- Auth: HTTP bearer

Retrieve active attack data within the last N days (default: 1 day)

## Query parameters

- `projectId` string, required
- `since` number
- `teamId` string
- `slug` string

## Response `200`

- union
  - object
  - object
    - `anomalies` object[], required
      - `affectedHostMap` object, required
      - `atMinute` number, required
      - `endTime` number, nullable, required
      - `ownerId` string, required
      - `projectId` string, required
      - `startTime` number, required
      - `state` string

## Other responses

- `400`: One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `410`

## Changes

- **2026-07-21** `2ae10ee9d21c`: 1 info
  - added the non-success response with the status `410`
- **2025-10-09** `50caddad4ae7`: 1 info
  - added the new optional `query` request parameter `since`
- **2025-03-19** `37b482c58c92`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v1/security/firewall/attack-status/get.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)