Get guard logs | Check Point AI Security

Retrieve individual Guard request logs for your organization.

Returns up to limit logs (default 100, max 1000) ordered by timestamp ascending (oldest first). Only flagged results and message-level results are included in each log entry — unflagged detections are omitted.

Pagination. Use offset to page through results. When has_more is true in the response, increment offset by limit to fetch the next page. For example, to iterate over all logs in a time range with pages of 500: fetch with offset=0, then offset=500, then offset=1000, and so on until has_more is false.

Filtering. Narrow results using any combination of these filters:

flagged_only — only requests where the policy action flagged the request.
detected_only — only requests where at least one detector fired (includes monitor-mode hits where the policy does not flag).
detector_types — only requests that triggered one or more of the listed detector types. See the GetLogsRequest schema for the list of accepted values and their corresponding display names in the AI Guardrails Dashboard.

Authentication. Use a Platform API key from the AI Guardrails Dashboard — not the Guard API key used for inference requests at api.lakera.ai.

Access. This endpoint is available to select organizations. Contact your Check Point representative to request access. Community users may also reach out to support@lakera.ai.

Authentication

AuthorizationBearer

Bearer authentication using API key. Generate an API key from the AI Guardrails Dashboard. Example: Bearer sk_123…

Keys carry one of two access scopes, chosen when the key is created:

Read and write — may call every endpoint. This is the default, and the scope of every key created before scopes were introduced.
Read only — may call read endpoints such as /v1-beta/logs, /v1-beta/analytics and the GET endpoints. Write endpoints return 403.

Issue a read-only key to anything that only needs to retrieve data, such as a log-shipping job or a dashboard, so that it cannot modify your policies or projects.

Request

This endpoint expects an object.

start_timestringRequiredformat: "date-time"

Start of the time range (inclusive)

end_timestringRequiredformat: "date-time"

End of the time range (exclusive). Must be after start_time.

project_idstring or nullOptional

Filter to a single project by ID. Omit to return logs across all projects in your organization.

limitintegerOptional1-1000Defaults to 100

Maximum number of logs to return. Logs are ordered by timestamp ascending (oldest first).

offsetintegerOptional>=0Defaults to 0

Number of logs to skip before returning results. Use with has_more in the response to page through large result sets: increment offset by limit until has_more is false.

flagged_onlybooleanOptionalDefaults to false

When true, only return requests where the policy action flagged the request. Independent of detected_only.

detected_onlybooleanOptionalDefaults to false

When true, only return requests where at least one detector fired. This includes monitor-mode requests where a detector fired but the policy did not flag. Independent of flagged_only.

detector_typeslist of stringsOptionalDefaults to []

Filter to requests that triggered one or more of the listed detector types. An empty list (the default) returns all requests regardless of detector.

Accepted values and their corresponding display names in the AI Guardrails Dashboard:

API value	Dashboard display name
`prompt_attack`	Prompt attack
`data_leakage`	Data leakage (matches all sub-detectors)
`content_violation`	Content violation (matches all sub-detectors)
`unknown_links`	Unknown links
`deny_listed`	Deny-listed
`tool_access_control`	Tool access control (requires agentic policy feature — contact your Check Point representative to request access)
`dangerous_deviation`	Dangerous Deviation
`custom_guardrail`	Custom guardrail
`audio_prompt_attack`	Audio prompt attack
`no_detections`	No detections (requests where no detectors fired)

Response

Guard logs for the requested time range

logslist of objects

has_moreboolean

true when there are more logs beyond this page. Increment offset by limit and repeat the request to fetch the next page.

Errors

400

Bad Request Error

403

Forbidden Error

404

Not Found Error

421

Misdirected Request Error

422

Unprocessable Entity Error