---
title: "[Deprecated]: List WAF Events"
method: GET
path: "/v1/reporting/sites/{id}/waf/events"
tags: ["Reporting"]
---

# [Deprecated]: List WAF Events

`GET /v1/reporting/sites/{id}/waf/events`

Use /reporting/sites/{id}/waf/eventlist instead

## Path parameters

- `id` integer, required — ID of the Site you are interacting with

## Query parameters

- `duration` '30m' | '1h' | '6h' | '12h' | '24h' | '72h' | '7d' | '30d', required — Duration that the listed data is for (m = minutes, h = hours, d = days)
- `limit` integer — Number of events to provide back
- `search` string — Search for an event by action, client_ip, country, request_path, user_agent, or query_string
- `action` string[]
- `client_ip` string
- `request_path` string
- `country` string[]
- `asn` string
- `asn_description` string
- `http_method` string[]
- `http_protocol` string
- `query_string` string
- `user_agent` string

## Response `200`

OK

- WAFEventsResponse
  - `errors` string[]
  - `data` WAFEventsResponseViewer
    - `viewer` object
      - `__typename` 'viewer' — name of the property
      - `zones` WAFEventsResponseZone[]
        - `__typename` 'zone' — name of the property
        - `activity` WAFEventsResponseActivity[]
          - `__typename` 'ZoneFirewallEventsAdaptive' — name of the property
          - `action` 'allow' | 'block' | 'bypass' | 'challenge' | 'force_connection_close' | 'jschallenge' | 'log' | 'managed_challenge' | 'rewrite' | 'skip' — Action taken by the Firewall
          - `clientASNDescription` string — Description of the Autonomous System (AS) the IP belongs to
          - `clientAsn` string — Autonomous System Number (ASN)
          - `clientCountryName` string — 2 letter country code of the IP's location
          - `clientIP` string — IP address related to the request
          - `clientRequestHTTPHost` string — HTTP host requested by the client
          - `clientRequestHTTPMethodName` string — HTTP method of the request
          - `clientRequestHTTPProtocol` string — HTTP Protocol version the client requested
          - `clientRequestPath` string — URI being requested
          - `clientRequestQuery` string — Query parameters from the request
          - `datetime` string — Date and time of the request
          - `matchIndex` integer
          - `metadata` ZoneFirewallEventsAdaptiveMetadataElem[] — Metadata about the rules that triggered the event action
            - `__typename` 'ZoneFirewallEventsAdaptiveMetadataElem' — name of the property
            - `key` 'ruleset_version' | 'type' | 'version' — Name of the metadata key
            - `value` string — Value of the metadata variable
          - `rayName` string — Unique Request ID
          - `ruleId` string — ID of the rule that caused this action
          - `sampleInterval` number
          - `source` 'firewallCustom' | 'firewallManaged' | 'ratelimit' | 'waf' — what type of security system intercepted the event
          - `userAgent` string — User-Agent of the device making the request
        - `total` WAFEventsResponseTotal[]
          - `__typeName` 'ZoneFirewallEventsAdaptiveByTimeGroups' — name of the property
          - `avg` object
            - `__typename` 'ZoneFirewallEventsAdaptiveByTimeGroupsAvg' — name of the property
            - `sampleInterval` number
          - `count` integer — Overall number of WAF Events in this timedframe

## Other responses

- `400` — Bad Request
- `401` — Authentication failed
- `403` — Not authorized to access endpoint
- `404` — Given site not found for user
- `405` — Invalid input
- `500` — Internal error

---

[API](https://skmtc.net/rocket/apis/rocket-net-api.md) · [All operations](https://skmtc.net/rocket/apis/rocket-net-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rocket/rocket-net-api/versions/db0dcbbc5764/schema)