API ReferenceAttack History

List attacks against your IP space

Enabled per organisation

This endpoint answers 403 until our staff enable the Attack History API flag on your organisation, and its ability cannot be granted to a key before then. Open a ticket saying what you intend to build — see Activation.
GET
/attacks

Returns a paginated list of attacks, newest first. With no from or to the window is the last 24 hours.

Results are limited to addresses you hold — those inside a prefix announced under one of your ASNs, and those assigned to your active services. Each address is additionally bounded by when it became yours: an attack against a previous holder is never returned.

A window reaching further back than your entitlement is silently raised to the earliest date you are entitled to. When that happens meta.from reports the date actually used and meta.from_clamped is true — read those rather than assuming you received everything you asked for.

A prefix or asn you do not hold returns an empty page, not an error: the API will not confirm or deny what exists outside your own space. A prefix that is not valid CIDR is a 422, so a typo stays distinguishable from a genuinely empty result.

Authorization

orgApiKey attacks.read
AuthorizationBearer <token>

An organisation API key, prefixed tbk_. Create one under Organisation to API keys; the plaintext is shown once.

The scopes listed on each operation are the abilities the key must carry. They are not OAuth scopes and are not negotiated per request.

In: header

Scope: attacks.read

Query Parameters

ip?string

Only attacks against this exact address.

Formatip
prefix?string

Only attacks against addresses inside this CIDR.

Lengthlength <= 43
asn?integer

Only attacks against prefixes announced under this ASN.

Range1 <= value <= 4294967295
from?string

Window start. Defaults to 24 hours before to.

Formatdate-time
to?string

Window end. Defaults to now, and must not be earlier than from.

Formatdate-time
ongoing?boolean

Restrict to attacks that have not ended yet.

per_page?integer

Results per page.

Range1 <= value <= 100
Default25
page?integer
Range1 <= value
Default1

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/attacks?ip=192.0.2.10&prefix=192.0.2.0%2F24&asn=64496"
{  "data": [    {      "id": 0,      "destination_ip": "string",      "prefix": "string",      "attack_type": "UDP Flood",      "peak_bps": 0,      "peak_bps_formatted": "10 Gbps",      "peak_pps": 0,      "peak_pps_formatted": "1,000,000 pps",      "started_at": "2019-08-24T14:15:22Z",      "mitigated_at": "2019-08-24T14:15:22Z",      "ended_at": "2019-08-24T14:15:22Z",      "duration_seconds": 0,      "status": "ongoing"    }  ],  "links": {    "first": "string",    "last": "string",    "prev": "string",    "next": "string"  },  "meta": {    "current_page": 0,    "per_page": 0,    "total": 0,    "from": "2019-08-24T14:15:22Z",    "to": "2019-08-24T14:15:22Z",    "from_clamped": true  }}