What a service's web application firewall found: requests it blocked,
and ones it only logged in log-only mode. It shows them over time
(series), per rule, domain, source, country and path, and the latest
50 with the rules that matched. custom shows how often each custom
rule matched, by its number. Query strings are kept with sensitive
values redacted.
API key access: read.
apiKeyAuthorizationBearer <pyo_…>An API key from the dashboard's API keys page: Authorization: Bearer pyo_…. Keys can expire, and an expired one gets a 401.
service*stringThe service's id.
range?string"1h", "24h" (the default), "7d" or "30d".
blocked, logged, clients, series, rules, hosts, sources, countries, paths, recent, custom and ipMode.
application/jsoncurl -X GET 'https://your-pyo.example.com/api/v1/waf/hits?service=string'{}