API Reference

Spectrum

Analytics

Events

Bytimes

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Get analytics by time

spectrum.analytics.events.bytimes.get(BytimeGetParams**kwargs) -> BytimeGetResponse

GET/zones/{zone_id}/spectrum/analytics/events/bytime

Retrieves a list of aggregate metrics grouped by time interval.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Analytics Read

ParametersExpand Collapse

zone_id: str

Identifier.

maxLength32

time_delta: Literal["year", "quarter", "month", 5 more]

Used to select time series resolution.

One of the following:

"year"

"quarter"

"month"

"week"

"day"

"hour"

"dekaminute"

"minute"

dimensions: Optional[List[Dimension]]

Can be used to break down the data by given attributes. Options are:

Dimension	Name	Example
event	Connection Event	connect, progress, disconnect, originError, clientFiltered
appID	Application ID	40d67c87c6cd4b889a4fd57805225e85
coloName	Colo Name	SFO
ipVersion	IP version used by the client	4, 6.

One of the following:

"event"

"appID"

"coloName"

"ipVersion"

filters: Optional[str]

Used to filter rows by one or more dimensions. Filters can be combined using OR and AND boolean logic. AND takes precedence over OR in all the expressions. The OR operator is defined using a comma (,) or OR keyword surrounded by whitespace. The AND operator is defined using a semicolon (;) or AND keyword surrounded by whitespace. Note that the semicolon is a reserved character in URLs (rfc1738) and needs to be percent-encoded as %3B. Comparison options are:

Operator	Name	URL Encoded
==	Equals	%3D%3D
!=	Does not equals	!%3D
>	Greater Than	%3E
<	Less Than	%3C
>=	Greater than or equal to	%3E%3D
<=	Less than or equal to	%3C%3D

metrics: Optional[List[Literal["count", "bytesIngress", "bytesEgress", 4 more]]]

One or more metrics to compute. Options are:

Metric	Name	Example	Unit
count	Count of total events	1000	Count
bytesIngress	Sum of ingress bytes	1000	Sum
bytesEgress	Sum of egress bytes	1000	Sum
durationAvg	Average connection duration	1.0	Time in milliseconds
durationMedian	Median connection duration	1.0	Time in milliseconds
duration90th	90th percentile connection duration	1.0	Time in milliseconds
duration99th	99th percentile connection duration	1.0	Time in milliseconds.

One of the following:

"count"

"bytesIngress"

"bytesEgress"

"durationAvg"

"durationMedian"

"duration90th"

"duration99th"

since: Optional[Union[str, datetime]]

Start of time interval to query, defaults to until - 6 hours. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

sort: Optional[SequenceNotStr[str]]

The sort order for the result set; sort fields must be included in metrics or dimensions.

until: Optional[Union[str, datetime]]

End of time interval to query, defaults to current time. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

ReturnsExpand Collapse

class BytimeGetResponse: …

data: List[Data]

List of columns returned by the analytics query.

dimensions: Optional[List[str]]

metrics: Optional[Union[List[float], List[List[float]], null]]

One of the following:

List[float]

List[List[float]]

data_lag: float

Number of seconds between current time and last processed event, i.e. how many seconds of data could be missing.

minimum0

max: Dict[str, float]

Maximum result for each selected metrics across all data.

min: Dict[str, float]

Minimum result for each selected metrics across all data.

query: Query

dimensions: Optional[List[Dimension]]

Can be used to break down the data by given attributes. Options are:

Dimension	Name	Example
event	Connection Event	connect, progress, disconnect, originError, clientFiltered
appID	Application ID	40d67c87c6cd4b889a4fd57805225e85
coloName	Colo Name	SFO
ipVersion	IP version used by the client	4, 6.

One of the following:

"event"

"appID"

"coloName"

"ipVersion"

filters: Optional[str]

Used to filter rows by one or more dimensions. Filters can be combined using OR and AND boolean logic. AND takes precedence over OR in all the expressions. The OR operator is defined using a comma (,) or OR keyword surrounded by whitespace. The AND operator is defined using a semicolon (;) or AND keyword surrounded by whitespace. Note that the semicolon is a reserved character in URLs (rfc1738) and needs to be percent-encoded as %3B. Comparison options are:

Operator	Name	URL Encoded
==	Equals	%3D%3D
!=	Does not equals	!%3D
>	Greater Than	%3E
<	Less Than	%3C
>=	Greater than or equal to	%3E%3D
<=	Less than or equal to	%3C%3D

limit: Optional[float]

Limit number of returned metrics.

metrics: Optional[List[Literal["count", "bytesIngress", "bytesEgress", 4 more]]]

One or more metrics to compute. Options are:

Metric	Name	Example	Unit
count	Count of total events	1000	Count
bytesIngress	Sum of ingress bytes	1000	Sum
bytesEgress	Sum of egress bytes	1000	Sum
durationAvg	Average connection duration	1.0	Time in milliseconds
durationMedian	Median connection duration	1.0	Time in milliseconds
duration90th	90th percentile connection duration	1.0	Time in milliseconds
duration99th	99th percentile connection duration	1.0	Time in milliseconds.

One of the following:

"count"

"bytesIngress"

"bytesEgress"

"durationAvg"

"durationMedian"

"duration90th"

"duration99th"

since: Optional[datetime]

Start of time interval to query, defaults to until - 6 hours. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

sort: Optional[List[str]]

The sort order for the result set; sort fields must be included in metrics or dimensions.

until: Optional[datetime]

End of time interval to query, defaults to current time. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

rows: float

Total number of rows in the result.

minimum0

totals: Dict[str, float]

Total result for each selected metrics across all data.

time_intervals: Optional[List[List[datetime]]]

List of time interval buckets: [start, end]

Get analytics by time

Python

HTTP

TypeScript

Python

Go

Terraform

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
bytime = client.spectrum.analytics.events.bytimes.get(
    zone_id="023e105f4ecef8ad9ca31a8372d0c353",
    time_delta="minute",
)
print(bytime.data)

200 example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "data": [
      {
        "dimensions": [
          "string"
        ],
        "metrics": [
          0
        ]
      }
    ],
    "data_lag": 3,
    "max": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "min": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "query": {
      "dimensions": [
        "event",
        "appID"
      ],
      "filters": "event==disconnect%20AND%20coloName!=SFO",
      "limit": 0,
      "metrics": [
        "count",
        "bytesIngress"
      ],
      "since": "2014-01-01T05:20:00.12345Z",
      "sort": [
        "+count",
        "-bytesIngress"
      ],
      "until": "2014-01-01T05:20:00.12345Z"
    },
    "rows": 5,
    "totals": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "time_intervals": [
      [
        "2014-01-01T05:20:00.12345Z"
      ]
    ]
  }
}

Returns Examples

200 example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "data": [
      {
        "dimensions": [
          "string"
        ],
        "metrics": [
          0
        ]
      }
    ],
    "data_lag": 3,
    "max": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "min": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "query": {
      "dimensions": [
        "event",
        "appID"
      ],
      "filters": "event==disconnect%20AND%20coloName!=SFO",
      "limit": 0,
      "metrics": [
        "count",
        "bytesIngress"
      ],
      "since": "2014-01-01T05:20:00.12345Z",
      "sort": [
        "+count",
        "-bytesIngress"
      ],
      "until": "2014-01-01T05:20:00.12345Z"
    },
    "rows": 5,
    "totals": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "time_intervals": [
      [
        "2014-01-01T05:20:00.12345Z"
      ]
    ]
  }
}