---
title: "Export ModSecurity rule error report"
method: GET
path: "/modsec_report_rule"
tags: ["ModSecurity", "Rule Settings"]
---

# Export ModSecurity rule error report

`GET /modsec_report_rule`

This function submits ModSecurity™ rule error reports to a remote receiver. The third
party rule vendors use these error reports to identify problems with their rule sets.

**Important:**

When you disable the
[Web Server role](https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-use-server-profiles/#roles),
the system **disables** this function.

## Query parameters

- `email` string, email, required
- `message` string, required
- `row_ids` integer, required
- `send` 1 | 0, required
- `type` string, required

## Response `200`

HTTP Request was successful.

- object
  - `data` object
    - `report` object[] — An array of objects containing information for the report.
      - `email` string, email — The contact email address to send with the error report. This allows the rule's vendor to reply to the report directly.
      - `hits` object[] — An array of objects containing information about the hit.
        - `action_desc` string — The web server's response to the client.
        - `handler` string, nullable — This parameter only returns a `null` value.
        - `host` string, domain — The virtual host's (vhost) domain name.
        - `http_method` string — The [HTTP method](http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html) that the client used to generate the hit.
        - `http_status` integer — The [HTTP status code](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html) that the web server returned.
        - `http_version` string — The HTTP version number.
        - `id` integer — The `modsec` database line number.
        - `ip` string, ipv4 — The client's IP address.
        - `justification` string — The specific criteria from the ModSecurity rule that generated the hit.
        - `meta_file` string — The ModSecurity configuration file that contains the rule that triggered the log entry.
        - `meta_id` integer — The ID of the ModSecurity rule that triggered the log entry.
        - `meta_line` integer — The line number of the ModSecurity rule that triggered the log entry.
        - `meta_logdata` string, nullable — The transaction data fragment from the ModSecurity rule's `logdata` action.
        - `meta_msg` string, nullable — The human-readable message from the ModSecurity rule's `msg` action.
        - `meta_offset` integer — The byte offset at which a match occurred within the target data. **Note:** This data is not always available.
        - `meta_rev` integer, nullable — The revision number from the ModSecurity rule's `rev` action.
        - `meta_severity` 'ALERT' | 'CRITICAL' | 'DEBUG' | 'EMERGENCY' | 'ERROR' | 'INFO' | 'NOTICE' | 'WARNING', nullable — The hit severity level from the ModSecurity rule's `severity` action. * `ALERT` * `CRITICAL` * `DEBUG` * `EMERGENCY` * `ERROR` * `INFO` * `NOTICE` * `WARNING`
        - `meta_uri` string, uri, nullable — The client-requested URI. **Note:** This data is not always available.
        - `path` string — The accessed file's path, relative to the document root.
        - `timestamp` string, ISO-8601 Date Time (Space Separated) — The date and time at which the log entry was made. **Note:** This parameter uses the server's configured time zone.
        - `timezone` string — The server's configured timezone, in minutes difference from UTC/GMT.
      - `message` string — A short message that explains the reason for the report.
      - `rule_text` string — The rule text from the configuration file.
      - `type` string — The report's type. **Note:** This value does **not** use a specified format. Treat the value as freeform text.
  - `metadata` object
    - `command` string — The method name called.
    - `reason` string — The reason the API function failed when the `metadata.result` field is `0`. This field may display a success message when a function succeeds.
    - `result` 1 | 0 — * `1` — Success. * `0` — Failed. Check the `reason` field for more details.
    - `version` integer — The version of the API function.

---

[API](https://skmtc.net/cpanel/apis/whm-api.md) · [All operations](https://skmtc.net/cpanel/apis/whm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cpanel/whm-api/revisions/3da41671c02c/schema)