The Watchtower

What it is

The Watchtower is your log book. You see who hit Zipper, what The Keep blocked, cache hits, and Portcullis results. Other workspaces cannot see yours.

Cloudflare analogue: Cloudflare Analytics / Logpush. SLA 99.9% · p99 90ms. Every role may read. Only admins change retention.

• ▸Live request log
• ▸Threat timeline
• ▸CSV export
• ▸Only your workspace

How it works

Watchtower stores request, WAF, DDoS, and Portcullis events scoped to your workspace.

Retention follows the plan (1 / 7 / 30 / 90 days). Sensitive fields are redacted by default.

Starter+ can push JSON to an HTTPS webhook. Business+ adds Splunk, Datadog, Elasticsearch.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Analytics, or Services → The Watchtower. Add a log-push destination from Analytics.

API

Control-plane: GET /api/v1/watchtower/events?format=csv. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/watchtower/events?limit=50 \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/watchtower/events?format=csv", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

You cannot raise retention above the plan max. Upgrade instead of patching the number.

• ▸SOC 2
• ▸GDPR
• ▸RLS isolation

Runbook

Redact sensitive fields first. Retention follows the plan. Export is CSV.