List packet capture requests

GET/accounts/{account_id}/pcaps

Lists all packet capture requests for an account.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Magic Firewall Packet Captures - Write PCAPs APIMagic Firewall Packet Captures - Read PCAPs API

Path ParametersExpand Collapse

account_id: string

Identifier.

maxLength32

ReturnsExpand Collapse

errors: array of ResponseInfo { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of ResponseInfo { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

result: array of PCAP { id, filter_v1, offset_time, 5 more } or object { id, byte_limit, colo_name, 10 more }

One of the following:

PCAP = object { id, filter_v1, offset_time, 5 more }

id: optional string

The ID for the packet capture.

maxLength32

minLength32

filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

destination_address: optional string

The destination IP address of the packet.

destination_port: optional number

The destination port of the packet.

protocol: optional number

The protocol number of the packet.

source_address: optional string

The source IP address of the packet.

source_port: optional number

The source port of the packet.

offset_time: optional string

The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request.

formatdate-time

status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:

"unknown"

"success"

"pending"

"running"

"conversion_pending"

"conversion_running"

"complete"

"failed"

submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum300

minimum1

type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:

"simple"

"full"

MagicVisibilityPCAPsPCAPsResponseFull = object { id, byte_limit, colo_name, 10 more }

id: optional string

The ID for the packet capture.

maxLength32

minLength32

byte_limit: optional number

The maximum number of bytes to capture. This field only applies to full packet captures.

maximum1000000000

minimum1

colo_name: optional string

The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures.

destination_conf: optional string

The full URI for the bucket. This field only applies to full packet captures.

error_message: optional string

An error message that describes why the packet capture failed. This field only applies to full packet captures.

filter_v1: optional PCAPFilter { destination_address, destination_port, protocol, 2 more }

The packet capture filter. When this field is empty, all packets are captured.

destination_address: optional string

The destination IP address of the packet.

destination_port: optional number

The destination port of the packet.

protocol: optional number

The protocol number of the packet.

source_address: optional string

The source IP address of the packet.

source_port: optional number

The source port of the packet.

packets_captured: optional number

The number of packets captured.

status: optional "unknown" or "success" or "pending" or 5 more

The status of the packet capture request.

One of the following:

"unknown"

"success"

"pending"

"running"

"conversion_pending"

"conversion_running"

"complete"

"failed"

stop_requested: optional string

The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures.

formatdate-time

submitted: optional string

The RFC 3339 timestamp when the packet capture was created.

system: optional "magic-transit"

The system used to collect packet captures.

time_limit: optional number

The packet capture duration in seconds.

maximum86400

minimum1

type: optional "simple" or "full"

The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following:

"simple"

"full"

success: true

Whether the API call was successful.

result_info: optional object { count, page, per_page, total_count }

count: optional number

Total number of results for the requested service.

page: optional number

Current page within paginated list of results.

per_page: optional number

Number of results per page of results.

total_count: optional number

Total results available without any search parameters.

List packet capture requests

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/pcaps \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": "66802ca5668e47a2b82c2e6746e45037",
      "filter_v1": {
        "destination_address": "1.2.3.4",
        "destination_port": 80,
        "protocol": 6,
        "source_address": "1.2.3.4",
        "source_port": 123
      },
      "offset_time": "2020-01-01T08:00:00Z",
      "status": "success",
      "submitted": "2020-01-01T08:00:00Z",
      "system": "magic-transit",
      "time_limit": 300,
      "type": "simple"
    }
  ],
  "success": true,
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": "66802ca5668e47a2b82c2e6746e45037",
      "filter_v1": {
        "destination_address": "1.2.3.4",
        "destination_port": 80,
        "protocol": 6,
        "source_address": "1.2.3.4",
        "source_port": 123
      },
      "offset_time": "2020-01-01T08:00:00Z",
      "status": "success",
      "submitted": "2020-01-01T08:00:00Z",
      "system": "magic-transit",
      "time_limit": 300,
      "type": "simple"
    }
  ],
  "success": true,
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}