Read the audit log
GET /api/audit
Needs an Admin key.
Who changed what, newest first (the latest 200).
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of AuditEntry |
Reply fields
| Field | Type | Description |
|---|---|---|
timestamp |
date-time | When the change was made. Always present. |
actor |
string | Who made the change: the user or API key, with the signed-in person noted when the console made the call for them. Always present. |
action |
string | What was done, as a short code such as block.create or allowlist.add. Always present. |
target |
string | What the change was made to, such as an IP address, a site or a feed ID. Always present. |
details |
string | Extra detail about the change, such as the duration or the new setting. Null when there is none. |
List attack campaigns
GET /api/campaigns
Needs a Viewer or Admin key.
Attackers seen hitting many different sites on this installation, newest first (up to 200).
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of Campaign |
Reply fields
| Field | Type | Description |
|---|---|---|
id |
string | The campaign's ID, made from the key kind and value (for example Ip:203.0.113.5). Always present. |
keyKind |
CampaignKeyKind |
What identifies the attacker: an IP address, a TLS fingerprint (Ja4) or a network operator (Asn). Always present. One of Ip, Ja4, Asn. |
keyValue |
string | The attacker's identifier: the IP address, the JA4 fingerprint, or the network number such as AS64500. Always present. |
firstSeen |
date-time | When PortWall first saw this campaign. Always present. |
lastSeen |
date-time | When PortWall last saw it, which is also when its counts were last updated. Always present. |
distinctTenants |
integer | How many different customers (tenants) the attacker hit. A site with no tenant counts as its own. Always present. |
distinctSites |
integer | How many different sites the attacker hit. Always present. |
eventCount |
integer | How many flagged requests from this attacker were counted in the detection window. Always present. |
maxSeverity |
RuleSeverity |
The most serious rule severity among those requests. Always present. One of Notice, Warning, Error, Critical. |
status |
CampaignStatus |
Whether the campaign is still active. Always present. One of Active, Retired. |
enforced |
boolean | True when PortWall acted on it automatically: it blocked the address or throttled the fingerprint. Once true it stays true. Always present. |
Get one attack campaign
GET /api/campaigns/{id}
Needs a Viewer or Admin key.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | Campaign |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
id |
string | The campaign's ID, made from the key kind and value (for example Ip:203.0.113.5). Always present. |
keyKind |
CampaignKeyKind |
What identifies the attacker: an IP address, a TLS fingerprint (Ja4) or a network operator (Asn). Always present. One of Ip, Ja4, Asn. |
keyValue |
string | The attacker's identifier: the IP address, the JA4 fingerprint, or the network number such as AS64500. Always present. |
firstSeen |
date-time | When PortWall first saw this campaign. Always present. |
lastSeen |
date-time | When PortWall last saw it, which is also when its counts were last updated. Always present. |
distinctTenants |
integer | How many different customers (tenants) the attacker hit. A site with no tenant counts as its own. Always present. |
distinctSites |
integer | How many different sites the attacker hit. Always present. |
eventCount |
integer | How many flagged requests from this attacker were counted in the detection window. Always present. |
maxSeverity |
RuleSeverity |
The most serious rule severity among those requests. Always present. One of Notice, Warning, Error, Critical. |
status |
CampaignStatus |
Whether the campaign is still active. Always present. One of Active, Retired. |
enforced |
boolean | True when PortWall acted on it automatically: it blocked the address or throttled the fingerprint. Once true it stays true. Always present. |
List attacks, a page at a time
GET /api/events
Needs a Viewer or Admin key.
Newest first. take is up to 200 a page and skip moves through them. q matches the address, the site, the kind of attack or the rule ID. since (an ISO 8601 time, for example 2026-10-27T00:00:00Z) returns only attacks at or after it, so a script can fetch what is new since its last run.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
q |
query | string | |
skip |
query | integer | |
take |
query | integer | |
since |
query | date-time |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | PagedResultOfSecurityEventSummary |
Reply fields
| Field | Type | Description |
|---|---|---|
items |
list of SecurityEventSummary |
The records on this page. Always present. |
total |
integer | How many records match in all, across every page. Always present. |
offset |
integer | How many records were skipped before this page (the skip you asked for, never below 0). Always present. |
limit |
integer | The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present. |
hasMore |
boolean | True when more records follow this page. Ask for the next page by adding limit to the skip. Always present. |
hasPrevious |
boolean | True when records come before this page (offset above 0). Always present. |
Updated 2026-11-02Something unclear or missing? Tell us.