Skip to Content
ReferenceAPI referenceCrowdSec

Get the CrowdSec alert behind a decision

GET
/api/v1/crowdsec/decisions/{decision_id}/alert

Returns the alert that made the decision, in the same shape as /alerts/{alert_id}. The LAPI finds alerts by IP only, so pass the decision's IP too. This endpoint does not search the community blocklist alerts, so a blocklist decision gets a 404. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.

Authorization

cookiesession<token>

Session cookie authentication.

Path Parameters

decision_id*integer

The decision's id, as /decisions lists it.

Query Parameters

ip*string

The IP the decision targets. A value that is not an IP gets a 400.

Response Body

Request fulfilled, document follows

application/json
  1. response

One CrowdSec alert with its context, stored events and decisions.

activeDecisionCount*integer

The decisions still in force.

asName*|

The source's network name, as the LAPI gives it.

asNumber*|

The source's AS number, as the LAPI gives it.

context*array<>
countryCode*string|null
countryName*|

From GeoMetrikks' own traffic or its GeoIP database. The LAPI sends only a code.

createdAt*string

When the LAPI stored the alert, as RFC 3339.

decisionCount*integer

The decisions the alert made, expired ones included.

decisionTypes*array<string>

Each decision type once, in the order the LAPI lists the decisions.

decisions*array<>
events*array<>

A sample of the events. The LAPI keeps fewer than eventsCount on busy alerts.

eventsCount*integer

How many events set off the scenario.

id*|

The LAPI's alert id.

kind*|

Where the alert came from, such as crowdsec for a log scenario, waf or bot-detection. Null from a LAPI that predates the field.

machineId*|

The CrowdSec machine that sent the alert.

message*string
range*|

The source's network as a CIDR, as the LAPI gives it.

scenario*string
scope*string

What value holds, such as Ip or Range.

simulated*boolean

True when CrowdSec ran the scenario in simulation mode.

startAt*|

When the first event happened.

stopAt*|

When the last event happened.

value*string

The source the alert is about, such as an IP.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/crowdsec/decisions/0/alert?ip=string'
Example Response
{  "activeDecisionCount": 0,  "asName": "string",  "asNumber": "string",  "context": [    {      "key": "string",      "values": [        "string"      ]    }  ],  "countryCode": "string",  "countryName": "string",  "createdAt": "string",  "decisionCount": 0,  "decisionTypes": [    "string"  ],  "decisions": [    {      "duration": "string",      "expired": true,      "id": 0,      "origin": "string",      "scenario": "string",      "scope": "string",      "simulated": true,      "type": "string",      "value": "string"    }  ],  "events": [    {      "meta": {        "property1": "string",        "property2": "string"      },      "timestamp": "string"    }  ],  "eventsCount": 0,  "id": 0,  "kind": "string",  "machineId": "string",  "message": "string",  "range": "string",  "scenario": "string",  "scope": "string",  "simulated": true,  "startAt": "string",  "stopAt": "string",  "value": "string"}

List the active decisions that cover one IP GET

Returns every active decision on the IP, from any origin, including Range decisions that hold it. This endpoint does not look up places, so the country and city fields are null and `requestCount24h` is 0 on `Ip` decisions.

List the traffic from DROP networks, with their bans GET

Returns each Spamhaus DROP network that sent requests in the window, busiest first, with the Range decision on it. The totals cover every network with traffic, not only the page. A client inside nested networks counts under the narrowest one. When the LAPI does not answer, you still get the traffic, with every `decision` null and `decisionsAvailable` false.