---
title: inspect
summary: Inspect a request using the Fastly Next-Gen WAF.
url: https://www.fastly.com/documentation/reference/compute/sdks/javascript/js-compute/security/fn.inspect/
---

**Kind:** Function  
**Module:** [security](https://www.fastly.com/documentation/reference/compute/sdks/javascript/js-compute/security/)  
**Package:** @fastly/js-compute 4.0.1  
**Since:** 3.38.0  
**Source:** https://github.com/fastly/js-compute-runtime/blob/70cf30af4e657879b2d1e7eafab880e39e3a3f7d/types/security.d.ts#L40

```javascript
inspect(request: Request, config: InspectConfig): InspectResponse
```

Inspect a request using the [Fastly Next-Gen WAF](https://docs.fastly.com/en/ngwaf/).

**Note**: Can only be used when processing requests, not during build-time initialization.

**Parameters**

- `request`: `Request` — The request to inspect.
- `config`: `InspectConfig` — Configuration for the inspection.

**Returns**

`InspectResponse`

**Throws**

- {TypeError} If `request` is not a Request instance.
- {TypeError} If `overrideClientIp` is not a valid IPv4 or IPv6 address.

```js
/// <reference types="@fastly/js-compute" />

import { inspect } from "fastly:security";

async function app(event) {
  const res = inspect(event.request, {
    corp: "my-corp",
    workspace: "my-workspace"
  });
  switch (res.verdict) {
    case "allow":
      return await fetch(event.request);
    case "block":
      return new Response("Request Blocked", { status: 400 });
    case "unauthorized":
      return new Response("Unauthorized", { status: 401 });
    default:
      return new Response("Unexpected verdict", { status: 500 });
  }
}

addEventListener("fetch", (event) => event.respondWith(app(event)));
```