> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindsight.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Firewall Flow

> Platform-wide firewall flow: every inspected source (apps, DLP agents,
direct API) → firewall → verdicts, plus a separate Shadow-AI observed lane.



## OpenAPI

````yaml /api-reference/openapi.json get /api/runtime-security/firewall-flow
openapi: 3.1.0
info:
  title: Blindsight API
  version: 0.1.0
  description: >-
    The full Blindsight REST surface, generated from the running application.
    Replace the server host with your own deployment.


    For the Runtime Security integration surface (scan, proxy, tool calls) see
    the Runtime Security spec, which is hand written and carries worked
    examples.
servers:
  - url: https://api.your-blindsight.com
    description: Your Blindsight deployment
security: []
paths:
  /api/runtime-security/firewall-flow:
    get:
      tags:
        - runtime-security
      summary: Get Firewall Flow
      description: >-
        Platform-wide firewall flow: every inspected source (apps, DLP agents,

        direct API) → firewall → verdicts, plus a separate Shadow-AI observed
        lane.
      operationId: get_firewall_flow_api_runtime_security_firewall_flow_get
      parameters:
        - name: window_days
          in: query
          required: false
          schema:
            type: integer
            maximum: 90
            minimum: 1
            title: Window Days
            default: 7
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FirewallFlow'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    FirewallFlow:
      properties:
        window_days:
          type: integer
          title: Window Days
        generated_at:
          type: string
          format: date-time
          title: Generated At
        sources:
          items:
            $ref: '#/components/schemas/FirewallFlowSource'
          type: array
          title: Sources
        verdicts:
          $ref: '#/components/schemas/FirewallFlowVerdicts'
        observed:
          $ref: '#/components/schemas/FirewallFlowObserved'
      type: object
      required:
        - window_days
        - generated_at
        - verdicts
        - observed
      title: FirewallFlow
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    FirewallFlowSource:
      properties:
        kind:
          type: string
          enum:
            - app
            - dlp
            - direct
          title: Kind
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
        key:
          type: string
          title: Key
        name:
          type: string
          title: Name
        accent_color:
          anyOf:
            - type: string
            - type: 'null'
          title: Accent Color
        event_count:
          type: integer
          title: Event Count
          default: 0
        allows:
          type: integer
          title: Allows
          default: 0
        flags:
          type: integer
          title: Flags
          default: 0
        redacts:
          type: integer
          title: Redacts
          default: 0
        blocks:
          type: integer
          title: Blocks
          default: 0
      type: object
      required:
        - kind
        - key
        - name
      title: FirewallFlowSource
      description: >-
        One inspected traffic source feeding the firewall: an RS App, the pooled

        DLP desktop agents, or direct/untagged API calls. Carries the verdict
        split

        so the Sankey can draw source → firewall → verdict in one pass.
    FirewallFlowVerdicts:
      properties:
        allow:
          type: integer
          title: Allow
          default: 0
        flag:
          type: integer
          title: Flag
          default: 0
        redact:
          type: integer
          title: Redact
          default: 0
        block:
          type: integer
          title: Block
          default: 0
        total:
          type: integer
          title: Total
          default: 0
      type: object
      title: FirewallFlowVerdicts
    FirewallFlowObserved:
      properties:
        total_hits:
          type: integer
          title: Total Hits
          default: 0
        total_services:
          type: integer
          title: Total Services
          default: 0
        buckets:
          items:
            $ref: '#/components/schemas/FirewallFlowObservedBucket'
          type: array
          title: Buckets
        collecting:
          type: boolean
          title: Collecting
          default: false
      type: object
      title: FirewallFlowObserved
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    FirewallFlowObservedBucket:
      properties:
        status:
          type: string
          title: Status
        label:
          type: string
          title: Label
        hits:
          type: integer
          title: Hits
          default: 0
        services:
          type: integer
          title: Services
          default: 0
      type: object
      required:
        - status
        - label
      title: FirewallFlowObservedBucket
      description: >-
        Shadow-AI egress grouped by review status. This lane is *observed*,
        never

        content-inspected, so it is kept separate from the verdict split above.

````