# Blocked requests

> See the calls of your own AI agents that the hosted egress gateway refused, filter them, follow them live, and read them from the API or MCP.

Every call of one of your agents that the hosted gateway refuses is recorded as a blocked request: the time, the agent, the target, the method, path and status, the caller's IP and the detection ids. The request body is never recorded. Blocked requests are kept for 30 days, and reading them needs AI egress to be enabled for the organization.

## Block codes

| Code | Dashboard label | Why |
|---|---|---|
| `injection_detected` | Prompt injection | The request carried instructions that try to override the model's instructions (**Block prompt injection** on) |
| `data_leak_blocked` | Data leak | The request carried a secret or a card number (**Block data leaks** on) |
| `ssrf_blocked` | SSRF | The target resolved to an internal or private address |
| `egress_blocked` | Target not allowed | The agent called a target it is not allowed to use |
| `body_too_large` | Body too large | The body was over the gateway's limits (8 MiB, or 1 MiB of text to inspect) |

Calls with an unknown or wrong token (`401`) are not recorded: they cannot be tied to an organization. The [reference](https://developers.openwaf.dev/egress/cloud/reference/#gateway-errors) lists every answer of the gateway.

## Read them

**Dashboard**

Open **AI egress → Blocked requests**. The table shows the requests of the last 7 days, newest first, with filters by **Code** and **Target** and a free-text search over path, agent, IP and detection. **Live** streams new blocks as the gateway reports them.
**API**

`GET …/egress/events` (where `…` is `https://dash.openwaf.dev/v1/orgs/{org}`) returns a page of blocks, newest first, with the same filters and shape as a zone's security events:

```sh
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/egress/events?rule_name=injection_detected&host=openrouter&limit=50" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```

Each item is a security event with `action` `block`, `attack_type` `egress`, `rule_name` the code, `host` the target, `user_agent` the agent's name and `msg` the detection ids, separated by commas. The window is `since`/`until` (RFC 3339; by default the last 24 hours, at most 31 days); other filters are `ip`, `path`, `status`, `q` and their `not_` variants, all repeatable; `limit` is 1 to 1000 (default 100) and `next_cursor` gives the next page through `cursor`.

`GET …/egress/events/stream` follows new blocks as Server-Sent Events, resuming from `Last-Event-ID`. It is not part of the SDKs.
**MCP**

`egress_events` lists the refused calls of a window (`range` `1h`, `24h` by default, or `7d`), optionally only one `code`, `target` or `agent`, up to `limit` (50 by default, at most 500). It works with any role of the whole organization.


## What to do about a block

- `egress_blocked`: allow the target in the [agent's targets](https://developers.openwaf.dev/egress/cloud/agents/#change-targets-and-protection), if the agent should call it.
- `injection_detected` and `data_leak_blocked`: read the detection ids. If the text came from a document or a web page the agent read, the gateway did its job. For an agent that must process such text, turn that protection off for that agent only.
- `ssrf_blocked`: a custom target whose name resolves to a private address cannot be used; point it at a public name.
- `body_too_large`: send large files by URL or through the provider's file API, or split the request.