Security events

Security events are the requests the edge blocked, challenged or logged (WAF, rules, rate limits, shields). All endpoints share the same filters; every filter can be repeated and different filters combine with AND.

#List events

GET /v1/orgs/{org}/zones/{zone}/events

Lists the security events of the zone, newest first. Every filter can be repeated (action=block&action=log matches any of the values) with at most 20 values; different filters combine with AND, and the not_… filters exclude events with any of their values. q searches text (case-insensitive) in host, path, IP, method, rule, attack type, message, user agent, country, rule id and status. Page with cursor set to next_cursor.

Required role: readonly or higher.

#Parameters

#Response

• 200: Returns an object with the fields below.

#Errors

#Example

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/events?action=block&limit=50" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

import { OpenWAF } from "./openwaf";

const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.listEvents({
  zone: "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
  action: "block",
  limit: 50
});

from openwaf import OpenWAF

owf = OpenWAF(base_url="https://dash.openwaf.dev")  # token from OPENWAF_TOKEN
result = owf.list_events(zone="6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d", action="block", limit=50)

{
  "items": [
    {
      "event_id": "8b3e5f7a-1c2d-4e6f-9a0b-3c5d7e9f1a2b",
      "zone_id": "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
      "node_id": "edge-node",
      "ts": "2026-10-27T09:29:58Z",
      "host": "www.example.com",
      "ip": "203.0.113.10",
      "method": "POST",
      "path": "/login",
      "status": 429,
      "action": "block",
      "rule_id": 0,
      "rule_name": "rate_rule:login",
      "attack_type": "rate_limit",
      "msg": "",
      "country_code": "ES",
      "asn": 64500,
      "user_agent": "Mozilla/5.0",
      "tls_fingerprint": "",
      "received_at": "2026-10-27T09:29:59Z",
      "rate_rule": "login"
    }
  ],
  "next_cursor": ""
}

#Summarize events

GET /v1/orgs/{org}/zones/{zone}/events/summary

Counts the events that match the filters (the same as List events) by action, with the 10 rules, the 10 countries and the 10 rate limiting rules with most events.

Required role: readonly or higher.

#Parameters

#Response

• 200: Returns an object with the fields below.

#Errors

#Example

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/events/summary" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

import { OpenWAF } from "./openwaf";

const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.getEventsSummary({
  zone: "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d"
});

from openwaf import OpenWAF

owf = OpenWAF(base_url="https://dash.openwaf.dev")  # token from OPENWAF_TOKEN
result = owf.get_events_summary(zone="6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d")

{
  "since": "2026-10-27T09:30:00Z",
  "until": "2026-10-27T09:30:00Z",
  "total": 128,
  "by_action": [
    {
      "key": "/pricing",
      "count": 128
    }
  ],
  "top_rules": [
    {
      "rule_id": 0,
      "rule_name": "example",
      "count": 128
    }
  ],
  "top_countries": [
    {
      "key": "/pricing",
      "count": 128
    }
  ],
  "top_rate_rules": [
    {
      "key": "/pricing",
      "count": 128
    }
  ]
}

#Events histogram

GET /v1/orgs/{org}/zones/{zone}/events/histogram

Counts the events that match the filters per time interval and action. Bars of step seconds are aligned to multiples of step since the Unix epoch, with no gaps (empty bars count 0); the first one contains since and the last one starts before until.

Required role: readonly or higher.

#Parameters

#Response

• 200: Returns EventsHistogram.

#Errors

#Example

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/events/histogram" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

import { OpenWAF } from "./openwaf";

const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.getEventsHistogram({
  zone: "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d"
});

from openwaf import OpenWAF

owf = OpenWAF(base_url="https://dash.openwaf.dev")  # token from OPENWAF_TOKEN
result = owf.get_events_histogram(zone="6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d")

{
  "since": "2026-10-27T09:30:00Z",
  "until": "2026-10-27T09:30:00Z",
  "step": 0,
  "total": 128,
  "buckets": [
    {
      "ts": "2026-10-27T09:30:00Z",
      "count": 128,
      "block": 0,
      "log": 0,
      "challenge": 0,
      "allow": 0
    }
  ]
}

#Stream events

GET /v1/orgs/{org}/zones/{zone}/events/stream

Streams the zone's events that match the filters (the same as List events; since, until and limit are not used) as Server-Sent Events, in the order OpenWAF receives them. Authentication, zone and filters are checked before the stream starts, so errors are JSON answers.

The stream starts after Last-Event-ID (sent by EventSource when it reconnects) or cursor; without them, 10 seconds before the request. Load GET …/events first and drop repeated event_id values. Frames:

• event: ready first, with {"poll_ms": 2000, "heartbeat_ms": 15000, "max_age_s": 600}.
• event: event for each event, with its cursor in id and the event in data (as in List events).
• event: ping after heartbeat_ms without traffic, to detect hung connections.
• event: bye after max_age_s, then the stream closes; EventSource reconnects with Last-Event-ID without losing events.
• event: error with {"code": "unavailable"} if the event store fails, then the stream closes.

An event received more than an hour after it happened is not streamed (it is listed by List events). At most 10 streams per organization.

Required role: readonly or higher.

#Parameters

#Response

• 200: Server-Sent Events stream (frames described above). Body of type text/event-stream.

#Errors

#Example

Not in the SDKs: open the stream with EventSource or any Server-Sent Events client.

curl -N "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/events/stream?action=block" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

retry: 3000
event: ready
data: {"poll_ms":2000,"heartbeat_ms":15000,"max_age_s":600}

id: c2V0MTcz…
event: event
data: {"event_id":"…","action":"block","host":"www.example.com","path":"/wp-login.php","client_ip":"203.0.113.10"}