---
title: "Read Firewall Actions by Project"
method: GET
path: "/v1/security/firewall/events"
tags: ["security"]
---

# Read Firewall Actions by Project

`GET /v1/security/firewall/events`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v1/security/firewall/events`
- Auth: HTTP bearer

Retrieve firewall actions for a project Rule names are resolved against the project's *current* active firewall configuration and the team's active rulesets, so a rule that has since been renamed reports its new name and one that has been deleted reports `null`. System rules such as `sys_dos_mitigation` and `ip_blocking` have no configured name and always report `null`. Filters (`ip`, `isActive`, `action`, `actionType`, `ruleKind`, `ruleId`, `hosts`) are ANDed across params and ORed within a repeated param. They are applied to the policies before `limit`/`cursor`, so pages only count matching policies. A policy with no matching requests yields no action row, so a page can hold fewer than `limit` actions; only `pagination.next` signals the end. A `cursor` is only valid with the filters it was issued for.

## Query parameters

- `sort` 'startTime:desc' | 'startTime:asc'
- `limit` number
- `cursor` string
- `projectId` string, required
- `startTimestamp` number
- `endTimestamp` number
- `hosts` string
- `ip` string[]
- `isActive` boolean
- `action` string[]
- `actionType` string[]
- `ruleKind` 'system' | 'custom'
- `ruleId` string[]
- `teamId` string
- `slug` string

## Response `200`

- object
  - `actions` object[], required
    - `action` string, required
    - `action_type` string, required
    - `count` number, required
    - `endTime` string, required
    - `host` string, required
    - `isActive` false | true, required
    - `public_ip` string, required
    - `ruleId` string, nullable, required
    - `ruleName` string, nullable, required
    - `startTime` string, required
  - `pagination` object, required
    - `hasMore` false | true, required
    - `next` string, nullable, required: Pass as `cursor` to fetch the next page; null when there are no more.

## Other responses

- `400`: One of the provided values in the request query is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `408`
- `410`
- `500`

## Changes

- **2026-10-02** `41e24ae097d4`: 1 warning, 10 info
  - for the `query` request parameter `hosts`, the maxLength was set to `10000`
  - added the new optional `query` request parameter `action`
  - added the new optional `query` request parameter `actionType`
  - added the new optional `query` request parameter `cursor`
  - …7 more
- **2026-08-31** `e31ea8d3c1e7`: 1 info
  - added the non-success response with the status `408`
- **2026-08-24** `895544ebf14c`: 6 info
  - the endpoint scheme security `bearerToken` was added to the API
  - added the new optional `query` request parameter `slug`
  - added the new optional `query` request parameter `teamId`
  - added the required property `actions/items/action` to the response with the `200` status
  - …2 more
- **2026-07-21** `2ae10ee9d21c`: 1 info
  - added the non-success response with the status `410`
- **2026-06-11** `14b4658f819e`: 1 info
  - api operation id `getSecurityFirewallEvents` was added

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v1/security/firewall/events/get.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)