---
title: "List Live Firewall Logs"
method: GET
path: "/network/firewall/logs/live"
tags: ["Network"]
---

# List Live Firewall Logs

`GET /network/firewall/logs/live`

List live firewall rule hits after a cursor. Cursor 0 starts at the current stream position without replaying retained history.

## Query parameters

- `cursor` integer
- `limit` integer
- `ruleType` 'traffic' | 'nat'
- `ruleId` integer
- `action` 'pass' | 'block' | 'scrub' | 'nat' | 'binat' | 'rdr'
- `direction` 'in' | 'out'
- `interface` string
- `query` string

## Response `200`

Success

- GithubComAlchemillahqSylveInternalAPIResponseGithubComAlchemillahqSylveInternalInterfacesServicesNetworkFirewallLiveHitsResponse
  - `data` GithubComAlchemillahqSylveInternalInterfacesServicesNetworkFirewallLiveHitsResponse
    - `items` GithubComAlchemillahqSylveInternalInterfacesServicesNetworkFirewallLiveHitEvent[]
      - `action` string
      - `bytes` integer
      - `cursor` integer
      - `direction` string
      - `interface` string
      - `rawLine` string
      - `ruleId` integer
      - `ruleName` string
      - `ruleType` string — traffic|nat
      - `timestamp` string
    - `nextCursor` integer
    - `sourceError` string
    - `sourceStatus` string — ok|unavailable
    - `updatedAt` string
  - `error` string
  - `message` string
  - `status` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.net/alchemillahq/apis/sylve-api.md) · [All operations](https://skmtc.net/alchemillahq/apis/sylve-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/alchemillahq/sylve-api/revisions/7a7bea85004e/schema)