Every call of one of your agents that the hosted gateway refuses is recorded as a blocked request: the time, the agent, the target, the method, path and status, the caller's IP and the detection ids. The request body is never recorded. Blocked requests are kept for 30 days, and reading them needs AI egress to be enabled for the organization.
Block codes
| Code | Dashboard label | Why |
|---|---|---|
injection_detected | Prompt injection | The request carried instructions that try to override the model's instructions (Block prompt injection on) |
data_leak_blocked | Data leak | The request carried a secret or a card number (Block data leaks on) |
ssrf_blocked | SSRF | The target resolved to an internal or private address |
egress_blocked | Target not allowed | The agent called a target it is not allowed to use |
body_too_large | Body too large | The body was over the gateway's limits (8 MiB, or 1 MiB of text to inspect) |
Calls with an unknown or wrong token (401) are not recorded: they cannot be tied to an organization. The reference lists every answer of the gateway.
Read them
Open AI egress → Blocked requests. The table shows the requests of the last 7 days, newest first, with filters by Code and Target and a free-text search over path, agent, IP and detection. Live streams new blocks as the gateway reports them.
GET …/egress/events (where … is https://dash.openwaf.dev/v1/orgs/{org}) returns a page of blocks, newest first, with the same filters and shape as a zone's security events:
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/egress/events?rule_name=injection_detected&host=openrouter&limit=50" \
-H "Authorization: Bearer $OPENWAF_TOKEN"Each item is a security event with action block, attack_type egress, rule_name the code, host the target, user_agent the agent's name and msg the detection ids, separated by commas. The window is since/until (RFC 3339; by default the last 24 hours, at most 31 days); other filters are ip, path, status, q and their not_ variants, all repeatable; limit is 1 to 1000 (default 100) and next_cursor gives the next page through cursor.
GET …/egress/events/stream follows new blocks as Server-Sent Events, resuming from Last-Event-ID. It is not part of the SDKs.
egress_events lists the refused calls of a window (range 1h, 24h by default, or 7d), optionally only one code, target or agent, up to limit (50 by default, at most 500). It works with any role of the whole organization.
What to do about a block
egress_blocked: allow the target in the agent's targets, if the agent should call it.injection_detectedanddata_leak_blocked: read the detection ids. If the text came from a document or a web page the agent read, the gateway did its job. For an agent that must process such text, turn that protection off for that agent only.ssrf_blocked: a custom target whose name resolves to a private address cannot be used; point it at a public name.body_too_large: send large files by URL or through the provider's file API, or split the request.