---
title: "List WAF Events"
method: GET
path: "/v1/reporting/sites/{id}/waf/eventlist"
tags: ["Reporting"]
---

# List WAF Events

`GET /v1/reporting/sites/{id}/waf/eventlist`

Lists all requests which triggered actions in the Web Application Firewall (WAF)

## Path parameters

- `id` integer, required — ID of the Site you are interacting with

## Query parameters

- `duration` '30m' | '1h' | '6h' | '12h' | '24h' | '72h' | '7d' | '30d', required — Duration that the listed data is for (m = minutes, h = hours, d = days)
- `search` string — Search for an event by action, client_ip, country, request_path, user_agent, or query_string
- `action` string[]
- `client_ip` string
- `request_path` string
- `country` string[]
- `asn` string
- `asn_description` string
- `http_method` string[]
- `http_protocol` string
- `query_string` string
- `ray_id` string
- `user_agent` string
- `per_page` integer — How many results to include in each page (default = 10)
- `page` integer — Page of results to include (default = 1)

## Response `200`

OK

- ListWAFEventsResponse
  - `success` boolean — whether the request succeeded
  - `errors` string[]
  - `messages` string[], nullable
  - `metadata` object
    - `page` integer — Page number of the results
    - `page_size` integer — Number of results per page
    - `total` integer — Total number of results
    - `sort` string — Sorting criteria
    - `direction` 'asc' | 'desc' — Sorting direction
  - `result` WAFEvent[]
    - `action` 'allow' | 'block' | 'bypass' | 'challenge' | 'force_connection_close' | 'jschallenge' | 'log' | 'managed_challenge' | 'rewrite' | 'skip' — Action taken by the Firewall
    - `clientASNDescription` string — Description of the Autonomous System (AS) the IP belongs to
    - `clientAsn` string — Autonomous System Number (ASN)
    - `clientCountryName` string — 2 letter country code of the IP's location
    - `clientIP` string — IP address related to the request
    - `clientRequestHTTPHost` string — HTTP host requested by the client
    - `clientRequestHTTPMethodName` string — HTTP method of the request
    - `clientRequestHTTPProtocol` string — HTTP Protocol version the client requested
    - `clientRequestPath` string — URI being requested
    - `clientRequestQuery` string — Query parameters from the request
    - `datetime` string — Date and time of the request
    - `matchIndex` integer
    - `metadata` WAFEventMetadata[] — Metadata about the rules that triggered the event action
      - `key` 'ruleset_version' | 'type' | 'version' — Name of the metadata key
      - `value` string — Value of the metadata variable
    - `rayName` string — Unique Request ID
    - `ruleId` string — ID of the rule that caused this action
    - `sampleInterval` number
    - `source` 'firewallCustom' | 'firewallManaged' | 'ratelimit' | 'waf' — what type of security system intercepted the event
    - `userAgent` string — User-Agent of the device making the request

## Other responses

- `400` — Bad Request
- `401` — Authentication failed
- `403` — Not authorized to access endpoint
- `404` — Given site not found for user
- `405` — Invalid input
- `500` — Internal error

---

[API](https://skmtc.net/rocket/apis/rocket-net-api.md) · [All operations](https://skmtc.net/rocket/apis/rocket-net-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rocket/rocket-net-api/versions/db0dcbbc5764/schema)