WAF event logs
const url = 'https://api.nsin.ir/analytics/waf-logs?domain=example.com&period=1h&limit=100&offset=0';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.nsin.ir/analytics/waf-logs?domain=example.com&period=1h&limit=100&offset=0' \ --header 'Authorization: Bearer <token>'Requests the WAF evaluated, with the rules that fired and the score they
produced. Entries where dryRun is true were logged only — the request
was not actually blocked.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”The domain name (for example example.com). These endpoints take the
domain as a query parameter rather than a path segment.
Example
example.comTime window, ending now. Time series are bucketed by minute for 1h,
by hour up to 48h, and by day for 7d and 30d. Buckets are cut on
Asia/Tehran (UTC+03:30) boundaries and emitted as UTC instants, so an
hourly bucket starts at :30 UTC. An unrecognised value falls back to
24h.
Substring match on hostname.
The action taken.
A CRS rule id that fired.
Restrict to blocked or non-blocked requests.
Responses
Section titled “ Responses ”A page of WAF events.
object
object
True when the rule only logged; the request was not blocked.
Anomaly score reached.
Example generated
{ "data": [ { "ts": "2026-04-15T12:00:00Z", "domainId": 1, "recordId": 1, "hostname": "example", "node": "example", "rayId": "example", "clientIp": "example", "country": "example", "clientPort": 1, "method": "example", "uri": "example", "httpVersion": "example", "action": "example", "blocked": true, "dryRun": true, "score": 1, "paranoia": 1, "threshold": 1, "status": 1, "ja4": "example", "ja4h": "example", "userAgent": "example", "headers": "example", "body": "example", "ruleIds": [ 1 ], "messages": [ "example" ], "ruleData": [ "example" ], "variables": [ "example" ], "severities": [ 1 ], "tags": [ "example" ] } ], "total": 1, "limit": 1, "offset": 1}The domain query parameter is missing.
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "domain is required"}Missing, malformed, revoked or expired API key. (A valid key whose
account has been deactivated gets 403 account is inactive instead.)
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "invalid API key"}The domain has no active plan at all, so no plan feature is available
on it. Buy or renew a plan for the domain. (A plan that is active but
does not include the feature answers 403 instead.)
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "This domain does not have an active plan."}The domain’s plan does not include the feature this endpoint needs
(monitoring for most sections, logs for raw and top-N request data).
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Example
{ "error": "read-only API key"}No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Example
{ "error": "read-only API key"}The key exceeded its request budget (300 requests per minute by default).
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "rate limit exceeded"}Either the analytics backend is temporarily unreachable (retry; no data
is lost), or the answer is still being computed. The per-domain
sections and the cached account-wide views (domains-overview,
global-summary, global-summary/peak, requests-compare,
bandwidth-overview, nodes-overview) wait at most about 25 seconds
for their query; past that they answer 503 with pending: true and
a Retry-After header, while the query keeps running and caches its
result, so the retry is served from that cache instead of starting the
same scan again. Identical concurrent requests share one computation.
object
Human-readable description of what went wrong.
true when the query is still running rather than
failing. Retry after Retry-After seconds.
Examples
{ "error": "analytics unavailable"}{ "error": "still computing — try again in a few seconds", "pending": true}Headers
Section titled “Headers ”Example
5Seconds to wait before retrying. Sent only with pending.