Skip to main content
POST
Search, filter and group Event Logs for a Shield Zone

Path Parameters

shieldZoneId
integer<int32>
required

The ID of the Shield Zone.

Body

Request body for searching a Shield Zone's Event Logs within a time window.

from
integer<int64>

Window start as Unix time in milliseconds (UTC). Required.

to
integer<int64>

Window end as Unix time in milliseconds (UTC). Required; must be after BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchRequest.from and within the last 72 hours.

query
string | null

Optional free-text search across IP, ruleId, URL, User-Agent and rule name.

filters
object[] | null

Optional filters, combined with AND. Repeated values within one filter combine with OR.

groupBy
string[] | null

Optional ordered dimensions to group by, e.g. ["ip","ja4"]. Omit for flat rows. Allowed: feature, ruleId, ip, ja4, ua, url, asn, country, action.

page
integer<int32>

Zero-based page index.

pageSize
integer<int32>

Page size; clamped to 1–500 (defaults to 50 when unset).

Response

OK

Result of an Event Logs search. Exactly one of BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchResponse.rows or BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchResponse.groups is populated.

rows
object[] | null

Flat event rows (populated when the request had no groupBy).

groups
object[] | null

Aggregated groups (populated when the request had a groupBy).

total
integer<int64>

Total flat rows, or total distinct groups when grouped.

totalPages
integer<int32>

Total number of pages for the current page size.

page
integer<int32>

Zero-based index of the returned page.

errorResponse
object

Generic response object containing status information for API operations.

Last modified on July 24, 2026