Skip to Content
ReferenceAPI referenceCrowdSec

List CrowdSec alerts, newest first

GET
/api/v1/crowdsec/alerts

Returns one page of the LAPI's alert history, newest first, without the community blocklist pulls. Pass the nextCursor of one page as before to get the next, older one. An IP source without a country from the LAPI gets its place from GeoMetrikks' own traffic, then from the GeoIP database. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

limit?integer

Alerts per page, from 1 to 500. Defaults to 50.

Range1 <= value <= 500
Default50
ip?|

Keep only alerts that hold a decision covering this IP. The filter excludes alerts on this IP that have no decision. A value that is not an IP gets a 400.

scenario?array<string>|

Keep only these scenarios, such as crowdsecurity/http-probing. Repeat the parameter for more than one, at most 5. With kind=bot it gets a 400.

since?|

Keep only alerts that started within this long before now, as a Go duration of hours, minutes and seconds such as 24h or 1h30m.

kind?|

Keep only alerts of one kind, crowdsec, waf, bot-detection, capi, papi or cscli. bot keeps everything the AppSec bot challenge produces. Needs CrowdSec 1.7 or newer, and an older LAPI gets a 400.

hasActiveDecision?|

true keeps alerts with a decision still in force, and false keeps alerts that hold no decision, active or expired.

before?|

The nextCursor of the previous page, to get the alerts older than it. A malformed cursor gets a 400.

Response Body

Request fulfilled, document follows

application/json
  1. response

One page of CrowdSec alerts, newest first.

alerts*array<>
nextCursor*|

Pass it as before to get the next, older page. Null on the last page.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/crowdsec/alerts'
Example Response
{  "alerts": [    {      "activeDecisionCount": 0,      "asName": "string",      "countryCode": "string",      "countryName": "string",      "createdAt": "string",      "decisionCount": 0,      "decisionTypes": [        "string"      ],      "eventsCount": 0,      "id": 0,      "kind": "string",      "machineId": "string",      "message": "string",      "scenario": "string",      "scope": "string",      "value": "string"    }  ],  "nextCursor": "string"}

List the login methods this server offers GET

Says whether password login is on and, when OIDC single sign-on is set up, gives the provider's name. It needs no credentials, so the login page can call it first. With APP_AUTH_DISABLED=true both are off.

Count the scenarios among recent CrowdSec alerts GET

Returns the scenarios among the newest 500 alerts that match `since` and `kind`, with how many of those alerts each one has, the most first. Scenarios with the same count sort by name. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.