---

title: Alerts & Export description: Get notified when a request is blocked (email + webhook digest), and export your block logs as CSV for your SIEM or Datadog. group: Concepts order: 5

Alerts & Export

Block logs are passive — you have to check them. Two features turn them into a signal: block-alert digests (push) and CSV export (pull).

Block-alert digests

When a request is blocked, GuardProxy batches it into a digest and delivers it roughly every 10 minutes — by email and/or webhook. It is deliberately not one-alert-per-block: a misbehaving agent can fire thousands of writes a minute, and per-block email would mute itself.

Enable it in Settings → "Block alerts":

• Alert email — the address digests go to (defaults to your account email).
• Webhook URL — receives a JSON POST per digest (Slack, Discord, your SIEM).

Alerts are a Pro feature. Use Send test alert to verify your channels are wired up — it fires a digest immediately (real recent blocks if any, otherwise a sample).

Webhook payload

{
  "event": "block_digest",
  "customer": "cust_abc",
  "count": 14,
  "window": "10 minutes",
  "window_start": "2026-06-27T14:00:00.000Z",
  "window_end": "2026-06-27T14:10:00.000Z",
  "samples": [
    {
      "method": "DELETE",
      "upstream_slug": "itglue",
      "path": "/v2/passwords/123",
      "blocked_by": "method_blocker",
      "timestamp": "2026-06-27T14:09:51.000Z"
    }
  ],
  "dashboard_url": "https://guardproxy.dev/block-logs"
}

samples is capped at the 5 most recent blocks; count is the full total for the window. The webhook is sent with a 6-second timeout and one retry on failure; 4xx responses are not retried (the destination rejected the payload).

How the window works

Each customer has a watermark (the timestamp of their last delivered digest). Each run counts only blocks after the watermark, then advances it. If delivery fails, the watermark does not advance — so the blocks retry on the next run rather than getting dropped. The first-ever run looks back 24 hours so you aren't flooded with the full backlog.

Export block logs as CSV

For piping into a SIEM, Datadog, or a spreadsheet. Free feature.

GET /api/block-logs/export?start=2026-06-20&end=2026-06-27

Param	Default	Notes
start	7 days before end	YYYY-MM-DD
end	today (UTC)	YYYY-MM-DD

Returns a text/csv download (Content-Disposition: attachment) with one row per blocked request:

timestamp,method,upstream_slug,path,blocked_by,client_ip
2026-06-27T14:09:51.000Z,DELETE,itglue,/v2/passwords/123,method_blocker,203.0.113.5

Or click Export CSV on the Block Logs page — it carries the current date range. Exports are capped at 10,000 rows; the CSV notes truncation if you hit the cap (narrow the range to get everything).

The endpoint is session-authenticated and scoped to your customer, the same as the rest of the API.