Cisco APIC Security Configuration Guide, Release 6.2(x)

View ACL permit and deny logs by using the REST API

Updated: April 17, 2026

Want to summarize with AI?

Retrieves access control list (ACL) permit and deny log entries by querying the applicable managed object class.

Before you begin

Enable contract permit or deny logging and generate traffic that matches the logged rule.

Use the following managed object (MO) classes to retrieve flow-level or packet-level ACL logs:

Table 1. ACL log managed object classes
Log type	Flow MO class	Packet MO class
Layer 2 permit	`acllogPermitL2Flow`	`acllogPermitL2Pkt`
Layer 2 drop	`acllogDropL2Flow`	`acllogDropL2Pkt`
Layer 3 permit	`acllogPermitL3Flow`	`acllogPermitL3Pkt`
Layer 3 drop	`acllogDropL3Flow`	`acllogDropL3Pkt`

Procedure

Send a GET request for the required ACL log MO class.

Example:

The following request retrieves Layer 3 drop flow logs:

GET https://apic_ip_address/api/class/acllogDropL3Flow

The response contains the Layer 3 drop flow log entries available on the fabric.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.