API Access

The examples below list and retrieve DDoS event logs. Protected networks, protection profiles, BGP announces, and templates are in the DDoS Protection API reference.

An API token is required.

Generate a token in the Gcore Customer Portal and send it in the Authorization header of each request to https://api.gcore.com. Open a terminal and set the token as an environment variable before running the examples:

export GCORE_API_KEY="{YOUR_API_KEY}"

The Python and Go SDKs read GCORE_API_KEY automatically. curl sends the same value as APIKey in the Authorization header.

List event logs

Each item maps to a DDoS Attack (ddos_alert) or RTBH (rtbh_alert) row in the events log, so the same incidents can be pulled into an external monitoring system.

Parameter	Required	Description
`date_from`	No	Start of the time window, ISO 8601 (for example `2026-08-01T00:00:00Z`)
`date_to`	No	End of the time window, ISO 8601 (for example `2026-08-31T23:59:59Z`)
`alert_type`	No	`ddos_alert` or `rtbh_alert`
`targeted_ip_addresses`	No	Target IP to match
`ordering`	No	Sort field. Prefix `-` for descending. Default is `attack_start_time`
`limit`	No	Page size, 1–500. Default is 10

Python SDK
Go SDK
curl

from gcore import Gcore

client = Gcore()

page = client.security.events.list()
for event in page.results:
    print(event.id, event.alert_type, event.targeted_ip_addresses)

package main

import (
    "context"
    "fmt"
    "log"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/security"
)

func main() {
    client := gcore.NewClient()
    page, err := client.Security.Events.List(context.TODO(), security.EventListParams{})
    if err != nil {
        log.Fatalf("list event logs: %v", err)
    }
    for _, event := range page.Results {
        fmt.Println(event.ID, event.AlertType)
    }
}

curl "https://api.gcore.com/security/notifier/v1/event_logs?limit=10&ordering=-attack_start_time" \
  -H "Authorization: APIKey $GCORE_API_KEY"

The API returns:

{
  "count": 1,
  "limit": 10,
  "offset": 0,
  "results": [
    {
      "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
      "alert_type": "ddos_alert",
      "client_id": 12345,
      "notification_type": null,
      "attack_start_time": "2026-08-15T12:00:00Z",
      "attack_power_bps": 1500000,
      "attack_power_pps": 4200,
      "number_of_ip_involved_in_attack": 18,
      "targeted_ip_addresses": "203.0.113.10"
    }
  ]
}

Get event log details

Pass an event log ID from the list response to retrieve the same summary fields plus traffic breakdown arrays such as attack_traffic and attack_top_source_countries.

export EVENT_LOG_ID="{EVENT_LOG_ID}"

Python SDK
Go SDK
curl

import os
from gcore import Gcore

client = Gcore()
event_log_id = os.environ["EVENT_LOG_ID"]

event_log = client.security.events.get(event_log_id)
print(event_log.id, event_log.alert_type)

package main

import (
    "context"
    "fmt"
    "log"
    "os"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    eventLog, err := client.Security.Events.Get(context.TODO(), os.Getenv("EVENT_LOG_ID"))
    if err != nil {
        log.Fatalf("get event log: %v", err)
    }
    fmt.Println(eventLog.ID, eventLog.AlertType)
}

curl "https://api.gcore.com/security/notifier/v1/event_logs/$EVENT_LOG_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY"

Account settings

Developer Tools

CDN

FastEdge

Edge Cloud

AI

Gclaw

Managed DNS

Public DNS

Hosting

Colocation

Object Storage

Video Streaming

DDoS protection

Edge Proxy

WAAP

List event logs

Get event log details

​List event logs

​Get event log details

List event logs

Get event log details