The Watchtower

What it is

The Watchtower records edge telemetry: cache hit ratio, WAF actions, DDoS events, and Portcullis results — scoped strictly to your workspace.

Cloudflare analogue: Cloudflare Analytics / Logpush. SLA 99.9% · p99 90ms. Every role may read. Only admins change retention.

• ▸Live request log
• ▸Threat timeline
• ▸CSV export
• ▸Workspace-scoped access

How it works

Watchtower stores request, WAF, DDoS, and Portcullis events scoped to your workspace.

Retention follows the plan (1 / 7 / 30 / 90 days). Sensitive fields are redacted by default.

Starter+ can push JSON to an HTTPS webhook. Business+ adds Splunk, Datadog, Elasticsearch.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Analytics, or Services → The Watchtower. Add a log-push destination from Analytics.

API

Control-plane: GET /api/v1/watchtower/events?format=csv. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/watchtower/events?limit=50 \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/watchtower/events?format=csv", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

You cannot raise retention above the plan max. Upgrade instead of patching the number.

• ▸SOC 2
• ▸GDPR
• ▸RLS isolation

Runbook

Redact sensitive fields first. Retention follows the plan. Export is CSV.