Docs

Log Shipping Error Codes

Overview

When using the Logs API endpoint to export WAF log data, you may encounter error responses. This document lists the error codes, what they mean, and how to resolve them.

HTTP Error Responses

400 Bad Request

The request was malformed or contained invalid parameters.

Error Message Cause Fix
Invalid date format. Use YYYY-MM-DD. The start_date or end_date parameter is not in the expected format Use YYYY-MM-DD format (e.g., 2025-03-15)
start_date must be before or equal to end_date The date range is inverted Swap the dates so start_date comes first
Date range cannot exceed 365 days The query spans more than 365 days Narrow your date range to 365 days or fewer. Make multiple requests for longer periods.
Invalid scroll_id The scroll_id parameter is expired, corrupted, or from a different query session Start a new query with /api/logs/query to get a fresh scroll_id

403 Forbidden

Error Message Cause Fix
Missing or invalid api_key The API key is wrong, missing, or belongs to a deactivated account Verify your API key on the API Access page of the WAF dashboard

404 Not Found

Error Message Cause Fix
No WAF configured for this account The API key is valid but there is no WAF instance associated with the account Verify you are using the correct API key for the account that has a WAF

500 Internal Server Error

An unexpected error occurred on our side. If you receive a 500 error:

  1. Wait a few minutes and retry the request
  2. If the error persists, contact support with the full request URL and response body

Scroll IDs and Pausing

The _scroll_id returned by /api/logs/query does not expire. It is a self-contained cursor, not a server-side session, so you can pause an export and resume it hours or days later.

If you receive a 400 Invalid scroll_id, the cursor was corrupted in transit. The usual causes are truncation during copy-paste or URL encoding mangling the value. Pass the _scroll_id back exactly as you received it. A 403 means the scroll ID belongs to a different account.

One caveat for long pauses: the log retention window for your plan keeps advancing while you are paused. Scrolling proceeds from newest to oldest, so the entries you have not reached yet are the oldest ones, and entries that age past your retention window are removed. A scroll paused for several days may find the oldest part of its date range no longer available, and the total count (calculated when the query started) will not reflect that.

Empty Results

If your query returns zero hits (hits.total.value is 0), this means no blocked requests were recorded in the date range you specified. This is not an error: it means the WAF did not block any requests during that period.

Need Help?

If you are encountering errors not listed here or need help integrating with the Logs API: