Skip to content
Cloudflare API
Start here
API Reference
Magic Transit

PCAPs

List packet capture requests
GET/accounts/{account_id}/pcaps
Get PCAP request
GET/accounts/{account_id}/pcaps/{pcap_id}
Create PCAP request
POST/accounts/{account_id}/pcaps
Stop full PCAP
PUT/accounts/{account_id}/pcaps/{pcap_id}/stop
ModelsExpand Collapse
PCAP = object { id, filter_v1, offset_time, 5 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

offset_time: optional string

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum300
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
PCAPFilter = object { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

destination_address: optional string

The destination IP address of the packet.

destination_port: optional number

The destination port of the packet.

protocol: optional number

The protocol number of the packet.

source_address: optional string

The source IP address of the packet.

source_port: optional number

The source port of the packet.

PCAPListResponse = PCAP { id, filter_v1, offset_time, 5 more } or object { id, byte_limit, colo_name, 10 more }
One of the following:
PCAP = object { id, filter_v1, offset_time, 5 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

offset_time: optional string

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum300
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
MagicVisibilityPCAPsPCAPsResponseFull = object { id, byte_limit, colo_name, 10 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
byte_limit: optional number

The maximum number of bytes to capture. This field only applies to full packet captures.

maximum1000000000
minimum1
colo_name: optional string

The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures.

destination_conf: optional string

The full URI for the bucket. This field only applies to full packet captures.

error_message: optional string

An error message that describes why the packet capture failed. This field only applies to full packet captures.

filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

packets_captured: optional number

The number of packets captured.

status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
stop_requested: optional string

The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures.

formatdate-time
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum86400
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
PCAPGetResponse = PCAP { id, filter_v1, offset_time, 5 more } or object { id, byte_limit, colo_name, 10 more }
One of the following:
PCAP = object { id, filter_v1, offset_time, 5 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

offset_time: optional string

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum300
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
MagicVisibilityPCAPsPCAPsResponseFull = object { id, byte_limit, colo_name, 10 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
byte_limit: optional number

The maximum number of bytes to capture. This field only applies to full packet captures.

maximum1000000000
minimum1
colo_name: optional string

The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures.

destination_conf: optional string

The full URI for the bucket. This field only applies to full packet captures.

error_message: optional string

An error message that describes why the packet capture failed. This field only applies to full packet captures.

filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

packets_captured: optional number

The number of packets captured.

status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
stop_requested: optional string

The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures.

formatdate-time
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum86400
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
PCAPCreateResponse = PCAP { id, filter_v1, offset_time, 5 more } or object { id, byte_limit, colo_name, 10 more }
One of the following:
PCAP = object { id, filter_v1, offset_time, 5 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

offset_time: optional string

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time
status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum300
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"
MagicVisibilityPCAPsPCAPsResponseFull = object { id, byte_limit, colo_name, 10 more }
id: optional string

The ID for the packet capture.

maxLength32
minLength32
byte_limit: optional number

The maximum number of bytes to capture. This field only applies to full packet captures.

maximum1000000000
minimum1
colo_name: optional string

The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures.

destination_conf: optional string

The full URI for the bucket. This field only applies to full packet captures.

error_message: optional string

An error message that describes why the packet capture failed. This field only applies to full packet captures.

filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

packets_captured: optional number

The number of packets captured.

status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:
"unknown"
"success"
"pending"
"running"
"conversion_pending"
"conversion_running"
"complete"
"failed"
stop_requested: optional string

The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures.

formatdate-time
submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum86400
minimum1
type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:
"simple"
"full"

PCAPsOwnership

List PCAPs Bucket Ownership
GET/accounts/{account_id}/pcaps/ownership
Add buckets for full packet captures
POST/accounts/{account_id}/pcaps/ownership
Delete buckets for full packet captures
DELETE/accounts/{account_id}/pcaps/ownership/{ownership_id}
Validate buckets for full packet captures
POST/accounts/{account_id}/pcaps/ownership/validate
ModelsExpand Collapse
Ownership = object { id, destination_conf, filename, 3 more }
id: string

The bucket ID associated with the packet captures API.

maxLength32
minLength32
destination_conf: string

The full URI for the bucket. This field only applies to full packet captures.

filename: string

The ownership challenge filename stored in the bucket.

status: "pending" or "success" or "failed"

The status of the ownership challenge. Can be pending, success or failed.

One of the following:
"pending"
"success"
"failed"
submitted: string

The RFC 3339 timestamp when the bucket was added to packet captures API.

validated: optional string

The RFC 3339 timestamp when the bucket was validated.

PCAPsDownload

Download Simple PCAP
GET/accounts/{account_id}/pcaps/{pcap_id}/download