# List a website's events

`GET /v1/service/@id/waf/zones/@zone/events` · scope `waf:read`

Newest events first. Query: `action`, `from`, `to` (RFC 3339), `cursor`, `limit`; `meta.next_cursor` gives the next page.

## HTTP request

| Item | Value |
| --- | --- |
| URL | `https://api.tino.vn/v1/service/@id/waf/zones/@zone/events` |
| Method | `GET` |
| Scope | `waf:read` |
| Header | `Authorization: Bearer <token>` |
| Content-Type | — (no body) |
| Tokens that can call it | app tokens (`tinoat_`), personal API tokens (`tinopat_`) |

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | int | yes | Service ID |
| `zone` | path | string | yes | Website ID (UUID) on TinoWAF |
| `action` | query | string | no | Only events with this action: `block`, `challenge`, `rate_limited` or `log`. |
| `from` | query | string | no | Start time, RFC 3339 (e.g. `2026-10-27T00:00:00+07:00`). |
| `to` | query | string | no | End time, RFC 3339. |
| `cursor` | query | string | no | `meta.next_cursor` of the previous page. |
| `limit` | query | integer | no | Events per page. |

## Example request

```bash
curl "https://api.tino.vn/v1/service/100001/waf/zones/3f2a1b0c-9d8e-4f7a-b6c5-d4e3f2a1b0c9/events" \
  -H "Authorization: Bearer $TINO_TOKEN"
```

`$TINO_TOKEN` is a token with the scope `waf:read`. Path parameters in the example are sample values.

SDK ([SDK & examples](/en/docs/sdk)): no dedicated function yet, use `client.request("GET", "/service/@id/waf/zones/@zone/events")`.

## Example response

No live sample: the route changes real data or the test account has no data for it. The answer is a JSON object; errors follow the common shape in [Calling the Tino API](/en/docs/api#errors).