---
title: Events
summary: Events are actions that the Next-Gen WAF takes as the result of regular threshold-based blocking, templated rules, and site alerts.
url: https://www.fastly.com/documentation/reference/api/security/events
---

Events are actions that the Next-Gen WAF takes as the result of regular threshold-based blocking, templated rules, and site alerts.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `action` | string | Value can be 'flagged' (requests will be blocked), 'info' (requests will be logged), or 'template'. |
| `block_signals` | array | List of block signals. |
| `country` | string | Country code. |
| `created_at` | string | Created timestamp. |
| `detected_at` | string | Detected timestamp. |
| `expires_at` | string | Time at which the event expires. |
| `id` | string | Unique ID of the event. |
| `is_expired` | boolean | If it is true, the event should be set to <code>expired</code>. |
| `reasons` | array | List of signals and their counts. |
| `remote_hostname` | string | Remote hostname. |
| `request_count` | integer | Total number of requests. |
| `sample_request` | object |  |
| `source` | string | Source information. |
| `user_agents` | array | User agents. |
| `window` | integer | Time window in seconds where the items were detected. |

## API endpoints

### List events

**GET** `/security/workspaces/{workspace_id}/events`

List events in a workspace.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `from` | string | query | Yes | Represents the start of a date-time range and is the older of the two dates, expressed in RFC 3339 format. |
| `ip` | string | query | No | Filter based on IP. |
| `limit` | integer | query | No | Limit how many results are returned. |
| `page` | integer | query | No | Page number of the collection to request. |
| `signal` | string | query | No | Filter based on signal. |
| `status` | string | query | No | Filter based on status. |
| `to` | string | query | No | Represents the end of a date-time range and is the newer of the two dates, expressed in RFC 3339 format. |
| `workspace_id` | string | path | Yes | The ID of the workspace. |

### Retrieve event

**GET** `/security/workspaces/{workspace_id}/events/{event_id}`

Get an event in a workspace.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `event_id` | string | path | Yes | The ID of the event. |
| `workspace_id` | string | path | Yes | The ID of the workspace. |

### Expire event

**PATCH** `/security/workspaces/{workspace_id}/events/{event_id}`

Expire an event in a workspace.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `event_id` | string | path | Yes | The ID of the event. |
| `workspace_id` | string | path | Yes | The ID of the workspace. |