---
title: "Get blocked firewall session logs"
method: GET
path: "/network-monitoring/v1/site-firewall-sessions"
tags: ["Firewall Session"]
---

# Get blocked firewall session logs

`GET /network-monitoring/v1/site-firewall-sessions`

This API endpoint retrieves blocked/denied sessions logs from access points, CX switches, gateways in a site.

## Query parameters

- `site-id` string, const, required
- `start-at` string, date-time, required
- `end-at` string, date-time, required
- `filter` string, const
- `limit` integer
- `next` string
- `offset` integer

## Response `200`

Successful operation

- SessionLogResponse — List of firewall session logs.
  - `items` SessionItems[], required
    - `type` string, const, required — Resource type.
    - `id` string, string, required — Resource ID: session_timestamp-src_ip-client_mac-dest_ip.
    - `timestamp` string, const — The timestamp of the session in epoch milliseconds.
    - `serialNumber` string, const — The serial number of the device reporting the session.
    - `clientUsername` string, const — The logged in username of the client.
    - `clientMac` string, const — The MAC address of the client.
    - `sourceIp` string, ipv4 — The IP address of the client.
    - `destinationIp` string, ipv4 — The IP address of the destination.
    - `clientRole` string, const — The role assigned to the client.
    - `ssidName` string, const — The SSID that the client was connected to.
    - `tunneledTraffic` boolean — Boolean value indicating whether the client traffic was tunneled to the gateway or not.
    - `clientConnectionType` string, const — This represents whether the client is wireless or wired.
    - `vlanId` integer — The client VLAN.
    - `txBytes` integer — The transmitted bytes.
    - `rxBytes` integer — The received bytes.
    - `sessionType` string, const — String representing whether the session was permitted or denied.
    - `applicationName` string, const — The application that the client was accessing.
    - `applicationCategories` string[] — List of categories that applications belong to.
    - `webUrl` string, const — The URL of the application that was accessed by the client.
    - `webCategories` string, const — The category that the web URL belongs to.
    - `webReputation` string, const — Value representing the risk level of the web URL.
    - `blockedSessionReason` string, const — A string representing the reason of a blocked/denied session.
    - `deviceType` string, const — A string representing the device type that pertains to the current entry.
    - `sessionCount` integer — The number of blocked sessions.
    - `clientHostname` string, const — A string representing the source client hostname.
    - `tlsServerVersion` string, const — A string representing the TLS version.
    - `certificateExpiryDate` string, const — A string representing the timestamp of the certificate expiry date.
    - `destinationLocation` string, const — The country name of the destination.
  - `next` string, required — Specifies the pagination cursor for the next page of resources.
  - `offset` integer
  - `count` integer, required — Number of items in the response.
  - `total` integer, required — Specifies the total number of items available for a given filter query.

## Other responses

- `400` — Invalid input received.
- `401` — Unauthorized. Authentication credentials are required or invalid.
- `403` — Forbidden: Access is denied.
- `404` — Not Found error.
- `429` — Too Many Requests. The user has sent too many requests in a given amount of time.
- `500` — Internal Server Error. An unexpected error occurred on the server.
- `503` — Service unavailable.

---

[API](https://skmtc.net/arubanetworks/apis/authorization.md) · [All operations](https://skmtc.net/arubanetworks/apis/authorization/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/arubanetworks/authorization/revisions/74c95058b11f/schema)