---
title: Fastly DDoS Protection Events
summary: The Fastly DDoS Protection Events API allows you to configure Fastly DDoS Protection and view attack insights including events, rules, and traffic statistics.
url: https://www.fastly.com/documentation/reference/api/ddos-protection
---

The Fastly DDoS Protection Events API allows you to configure Fastly DDoS Protection and view attack insights including events, rules, and traffic statistics.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `name` | string | Name of an attribute type used in traffic stats. Currently, supported values are source_ip, country_code, host, asn, source_ip_prefix, user_agent, method_path. |
| `values` | array | Values for traffic attribute. |
| `percentage` | integer | Percentage of traffic containing a value. |
| `errors` | array |  |
| `created_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `customer_id` | string | Alphanumeric string identifying the customer. |
| `ended_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `id` | string | Unique ID of the event. |
| `requests_allowed` | integer | Number of requests classified as non-attack traffic for an event. |
| `requests_detected` | integer | Number of requests classified as DDoS attack traffic for an event. |
| `service_id` | string | Alphanumeric string identifying the service. |
| `started_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `updated_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `action` | string | Action types for a rule. Supported action values are default, block, log, off. The default action value follows the current protection mode of the associated service. |
| `additional_attributes` | array | Attribute category for additional, unlisted attributes used in a rule. |
| `asn` | string | ASN attribute. |
| `country_code` | string | Country code attribute. |
| `host` | string | Host attribute. |
| `source_ip` | string | Source IP address attribute. |
| `source_ip_prefix` | string | Source IP prefix attribute. |
| `traffic_stats` | object |  |
| `traffic_percentage` | number | Rule traffic percentage for the event. |

## API endpoints

### Get a rule by ID

**GET** `/ddos-protection/v1/rules/{rule_id}`

Get a rule by ID.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `rule_id` | string | path | Yes | Unique ID of the rule. |

### Update rule

**PATCH** `/ddos-protection/v1/rules/{rule_id}`

Update rule.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `rule_id` | string | path | Yes | Unique ID of the rule. |

### Get events

**GET** `/ddos-protection/v1/events`

Get events.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Cursor value from the <code>next_cursor</code> field of a previous response, used to retrieve the next page. To request the first page, this should be empty. |
| `from` | string | query | No | Represents the start of a date-time range expressed in RFC 3339 format. |
| `limit` | integer | query | No | Limit how many results are returned. |
| `name` | string | query | No | Restrict results to items with names that match this prefix. |
| `service_id` | string | query | No | Filter results based on a service_id. |
| `to` | string | query | No | Represents the end of a date-time range expressed in RFC 3339 format. |

### Get event by ID

**GET** `/ddos-protection/v1/events/{event_id}`

Get event by ID.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `event_id` | string | path | Yes | Unique ID of the event. |

### Get all rules for an event

**GET** `/ddos-protection/v1/events/{event_id}/rules`

Get all rules for an event.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Cursor value from the <code>next_cursor</code> field of a previous response, used to retrieve the next page. To request the first page, this should be empty. |
| `event_id` | string | path | Yes | Unique ID of the event. |
| `include` | string | query | No | Include relationships. Optional. Comma-separated values. |
| `limit` | integer | query | No | Limit how many results are returned. |

### Get traffic stats for a rule

**GET** `/ddos-protection/v1/events/{event_id}/rules/{rule_id}/traffic-stats`

Get traffic stats for a rule.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `event_id` | string | path | Yes | Unique ID of the event. |
| `rule_id` | string | path | Yes | Unique ID of the rule. |