# Radar # AI # To Markdown ## Convert Files into Markdown **post** `/accounts/{account_id}/ai/tomarkdown` Converts uploaded files into Markdown format using Workers AI. ### Path Parameters - `account_id: string` ### Returns - `result: array of object { data, format, mimeType, 2 more }` - `data: string` - `format: string` - `mimeType: string` - `name: string` - `tokens: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/ai/tomarkdown \ -H 'Content-Type: multipart/form-data' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -F files='["Example data"]' ``` #### Response ```json { "result": [ { "data": "data", "format": "format", "mimeType": "mimeType", "name": "name", "tokens": "tokens" } ], "success": true } ``` ## Domain Types ### To Markdown Create Response - `ToMarkdownCreateResponse = object { data, format, mimeType, 2 more }` - `data: string` - `format: string` - `mimeType: string` - `name: string` - `tokens: string` # Inference ## Get Workers AI inference distribution by dimension **get** `/radar/ai/inference/summary/{dimension}` Retrieves an aggregated summary of unique accounts using Workers AI inference grouped by the specified dimension. ### Path Parameters - `dimension: "MODEL" or "TASK"` Specifies the attribute by which to group the results. - `"MODEL"` - `"TASK"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "@cf/meta/llama-3-8b-instruct": "8.381743", "@cf/meta/m2m100-1.2b": "22.904", "@cf/stabilityai/stable-diffusion-xl-base-1.0": "10.274394" } }, "success": true } ``` ## Get time series distribution of Workers AI inference by dimension. **get** `/radar/ai/inference/timeseries_groups/{dimension}` Retrieves the distribution of unique accounts using Workers AI inference, grouped by the specified dimension over time. ### Path Parameters - `dimension: "MODEL" or "TASK"` Specifies the attribute by which to group the results. - `"MODEL"` - `"TASK"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Inference Summary V2 Response - `InferenceSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Inference Timeseries Groups V2 Response - `InferenceTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get Workers AI models summary **get** `/radar/ai/inference/summary/model` Retrieves the distribution of unique accounts by model. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/summary/model \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "@cf/meta/llama-3-8b-instruct": "8.381743", "@cf/meta/m2m100-1.2b": "22.904", "@cf/stabilityai/stable-diffusion-xl-base-1.0": "10.274394" } }, "success": true } ``` ## Get Workers AI tasks summary **get** `/radar/ai/inference/summary/task` Retrieves the distribution of unique accounts by task. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/summary/task \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "text generation": "10.274394", "text-to-image": "22.904" } }, "success": true } ``` ## Domain Types ### Summary Model Response - `SummaryModelResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Task Response - `SummaryTaskResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups # Summary ## Get Workers AI models time series **get** `/radar/ai/inference/timeseries_groups/model` Retrieves the distribution of unique accounts by model over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/timeseries_groups/model \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get Workers AI tasks time series **get** `/radar/ai/inference/timeseries_groups/task` Retrieves the distribution of unique accounts by task over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/inference/timeseries_groups/task \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Summary Model Response - `SummaryModelResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Summary Task Response - `SummaryTaskResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Bots ## Get AI bots HTTP requests distribution by dimension **get** `/radar/ai/bots/summary/{dimension}` Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. ### Path Parameters - `dimension: "USER_AGENT" or "CRAWL_PURPOSE" or "INDUSTRY" or 2 more` Specifies the attribute by which to group the results. - `"USER_AGENT"` - `"CRAWL_PURPOSE"` - `"INDUSTRY"` - `"VERTICAL"` - `"CONTENT_TYPE"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Amazonbot": "10.274394", "Bytespider": "8.381743", "facebookexternalhit": "63.40249" } }, "success": true } ``` ## Get AI bots HTTP requests time series **get** `/radar/ai/bots/timeseries` Retrieves AI bots HTTP request volume over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get time series distribution of AI bots HTTP requests by dimension. **get** `/radar/ai/bots/timeseries_groups/{dimension}` Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. ### Path Parameters - `dimension: "USER_AGENT" or "CRAWL_PURPOSE" or "INDUSTRY" or 2 more` Specifies the attribute by which to group the results. - `"USER_AGENT"` - `"CRAWL_PURPOSE"` - `"INDUSTRY"` - `"VERTICAL"` - `"CONTENT_TYPE"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Bot Summary V2 Response - `BotSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Bot Timeseries Response - `BotTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### Bot Timeseries Groups Response - `BotTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get AI user agents summary **get** `/radar/ai/bots/summary/user_agent` Retrieves the distribution of traffic by AI user agent. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/summary/user_agent \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Amazonbot": "10.274394", "Bytespider": "8.381743", "facebookexternalhit": "63.40249" } }, "success": true } ``` ## Domain Types ### Summary User Agent Response - `SummaryUserAgentResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups ## Get AI user agents time series **get** `/radar/ai/bots/timeseries_groups/user_agent` Retrieves the distribution of traffic by AI user agent over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/timeseries_groups/user_agent \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get AI bots HTTP requests distribution by dimension **get** `/radar/ai/bots/summary/{dimension}` Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. ### Path Parameters - `dimension: "USER_AGENT" or "CRAWL_PURPOSE" or "INDUSTRY" or 2 more` Specifies the attribute by which to group the results. - `"USER_AGENT"` - `"CRAWL_PURPOSE"` - `"INDUSTRY"` - `"VERTICAL"` - `"CONTENT_TYPE"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Amazonbot": "10.274394", "Bytespider": "8.381743", "facebookexternalhit": "63.40249" } }, "success": true } ``` ## Get AI bots HTTP requests time series **get** `/radar/ai/bots/timeseries` Retrieves AI bots HTTP request volume over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get time series distribution of AI bots HTTP requests by dimension. **get** `/radar/ai/bots/timeseries_groups/{dimension}` Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. ### Path Parameters - `dimension: "USER_AGENT" or "CRAWL_PURPOSE" or "INDUSTRY" or 2 more` Specifies the attribute by which to group the results. - `"USER_AGENT"` - `"CRAWL_PURPOSE"` - `"INDUSTRY"` - `"VERTICAL"` - `"CONTENT_TYPE"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `contentType: optional array of "HTML" or "IMAGES" or "JSON" or 13 more` Filters results by content type category. - `"HTML"` - `"IMAGES"` - `"JSON"` - `"JAVASCRIPT"` - `"CSS"` - `"PLAIN_TEXT"` - `"FONTS"` - `"XML"` - `"YAML"` - `"VIDEO"` - `"AUDIO"` - `"MARKDOWN"` - `"DOCUMENTS"` - `"BINARY"` - `"SERIALIZATION"` - `"OTHER"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `crawlPurpose: optional array of string` Filters results by bot crawl purpose. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `userAgent: optional array of string` Filters results by user agent. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ai/bots/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group User Agent Response - `TimeseriesGroupUserAgentResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Summary Response - `TimeseriesGroupSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Timeseries Group Timeseries Response - `TimeseriesGroupTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### Timeseries Group Timeseries Groups Response - `TimeseriesGroupTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # CT ## Get certificate distribution by dimension **get** `/radar/ct/summary/{dimension}` Retrieves an aggregated summary of certificates grouped by the specified dimension. ### Path Parameters - `dimension: "CA" or "CA_OWNER" or "DURATION" or 11 more` Specifies the certificate attribute by which to group the results. - `"CA"` - `"CA_OWNER"` - `"DURATION"` - `"ENTRY_TYPE"` - `"EXPIRATION_STATUS"` - `"HAS_IPS"` - `"HAS_WILDCARDS"` - `"LOG"` - `"LOG_API"` - `"LOG_OPERATOR"` - `"PUBLIC_KEY_ALGORITHM"` - `"SIGNATURE_ALGORITHM"` - `"TLD"` - `"VALIDATION_LEVEL"` ### Query Parameters - `ca: optional array of string` Filters results by certificate authority. - `caOwner: optional array of string` Filters results by certificate authority owner. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `duration: optional array of "LTE_3D" or "GT_3D_LTE_7D" or "GT_7D_LTE_10D" or 4 more` Filters results by certificate duration. - `"LTE_3D"` - `"GT_3D_LTE_7D"` - `"GT_7D_LTE_10D"` - `"GT_10D_LTE_47D"` - `"GT_47D_LTE_100D"` - `"GT_100D_LTE_200D"` - `"GT_200D"` - `entryType: optional array of "PRECERTIFICATE" or "CERTIFICATE"` Filters results by entry type (certificate vs. pre-certificate). - `"PRECERTIFICATE"` - `"CERTIFICATE"` - `expirationStatus: optional array of "EXPIRED" or "VALID"` Filters results by expiration status (expired vs. valid). - `"EXPIRED"` - `"VALID"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `hasIps: optional array of boolean` Filters results based on whether the certificates are bound to specific IP addresses. - `hasWildcards: optional array of boolean` Filters results based on whether the certificates contain wildcard domains. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `log: optional array of string` Filters results by certificate log. - `logApi: optional array of "RFC6962" or "STATIC"` Filters results by certificate log API (RFC6962 vs. static). - `"RFC6962"` - `"STATIC"` - `logOperator: optional array of string` Filters results by certificate log operator. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "RAW_VALUES" or "PERCENTAGE"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"RAW_VALUES"` - `"PERCENTAGE"` - `publicKeyAlgorithm: optional array of "DSA" or "ECDSA" or "RSA"` Filters results by public key algorithm. - `"DSA"` - `"ECDSA"` - `"RSA"` - `signatureAlgorithm: optional array of "DSA_SHA_1" or "DSA_SHA_256" or "ECDSA_SHA_1" or 12 more` Filters results by signature algorithm. - `"DSA_SHA_1"` - `"DSA_SHA_256"` - `"ECDSA_SHA_1"` - `"ECDSA_SHA_256"` - `"ECDSA_SHA_384"` - `"ECDSA_SHA_512"` - `"PSS_SHA_256"` - `"PSS_SHA_384"` - `"PSS_SHA_512"` - `"RSA_MD2"` - `"RSA_MD5"` - `"RSA_SHA_1"` - `"RSA_SHA_256"` - `"RSA_SHA_384"` - `"RSA_SHA_512"` - `tld: optional array of string` Filters results by top-level domain. - `uniqueEntries: optional array of "true" or "false"` Specifies whether to filter out duplicate certificates and pre-certificates. Set to true for unique entries only. - `"true"` - `"false"` - `validationLevel: optional array of "DOMAIN" or "ORGANIZATION" or "EXTENDED"` Filters results by validation level. - `"DOMAIN"` - `"ORGANIZATION"` - `"EXTENDED"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string] or object { rfc6962, static } or object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more } or 5 more` - `map[string]` - `object { rfc6962, static }` - `rfc6962: string` - `static: string` - `object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more }` - `gt_121d: string` - `gt_16d_lte_31d: string` - `gt_31d_lte_91d: string` - `gt_3d_lte_16d: string` - `gt_91d_lte_121d: string` - `lte_3d: string` - `object { CERTIFICATE, PRECERTIFICATE }` - `CERTIFICATE: string` - `PRECERTIFICATE: string` - `object { EXPIRED, VALID }` - `EXPIRED: string` - `VALID: string` - `object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` - `POSITIVE: string` - `object { DSA, ECDSA, RSA }` - `DSA: string` - `ECDSA: string` - `RSA: string` - `object { domain, extended, organization, unknown }` - `domain: string` - `extended: string` - `organization: string` - `unknown: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "DigiCert": "10.274394", "GoDaddy": "8.381743", "Internet Security Research Group": "63.40249" } }, "success": true } ``` ## Get certificates time series **get** `/radar/ct/timeseries` Retrieves certificate volume over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `ca: optional array of string` Filters results by certificate authority. - `caOwner: optional array of string` Filters results by certificate authority owner. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `duration: optional array of "LTE_3D" or "GT_3D_LTE_7D" or "GT_7D_LTE_10D" or 4 more` Filters results by certificate duration. - `"LTE_3D"` - `"GT_3D_LTE_7D"` - `"GT_7D_LTE_10D"` - `"GT_10D_LTE_47D"` - `"GT_47D_LTE_100D"` - `"GT_100D_LTE_200D"` - `"GT_200D"` - `entryType: optional array of "PRECERTIFICATE" or "CERTIFICATE"` Filters results by entry type (certificate vs. pre-certificate). - `"PRECERTIFICATE"` - `"CERTIFICATE"` - `expirationStatus: optional array of "EXPIRED" or "VALID"` Filters results by expiration status (expired vs. valid). - `"EXPIRED"` - `"VALID"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `hasIps: optional array of boolean` Filters results based on whether the certificates are bound to specific IP addresses. - `hasWildcards: optional array of boolean` Filters results based on whether the certificates contain wildcard domains. - `log: optional array of string` Filters results by certificate log. - `logApi: optional array of "RFC6962" or "STATIC"` Filters results by certificate log API (RFC6962 vs. static). - `"RFC6962"` - `"STATIC"` - `logOperator: optional array of string` Filters results by certificate log operator. - `name: optional array of string` Array of names used to label the series in the response. - `publicKeyAlgorithm: optional array of "DSA" or "ECDSA" or "RSA"` Filters results by public key algorithm. - `"DSA"` - `"ECDSA"` - `"RSA"` - `signatureAlgorithm: optional array of "DSA_SHA_1" or "DSA_SHA_256" or "ECDSA_SHA_1" or 12 more` Filters results by signature algorithm. - `"DSA_SHA_1"` - `"DSA_SHA_256"` - `"ECDSA_SHA_1"` - `"ECDSA_SHA_256"` - `"ECDSA_SHA_384"` - `"ECDSA_SHA_512"` - `"PSS_SHA_256"` - `"PSS_SHA_384"` - `"PSS_SHA_512"` - `"RSA_MD2"` - `"RSA_MD5"` - `"RSA_SHA_1"` - `"RSA_SHA_256"` - `"RSA_SHA_384"` - `"RSA_SHA_512"` - `tld: optional array of string` Filters results by top-level domain. - `uniqueEntries: optional array of "true" or "false"` Specifies whether to filter out duplicate certificates and pre-certificates. Set to true for unique entries only. - `"true"` - `"false"` - `validationLevel: optional array of "DOMAIN" or "ORGANIZATION" or "EXTENDED"` Filters results by validation level. - `"DOMAIN"` - `"ORGANIZATION"` - `"EXTENDED"` ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get time series of certificate distribution by dimension **get** `/radar/ct/timeseries_groups/{dimension}` Retrieves the distribution of certificates grouped by the specified dimension over time. ### Path Parameters - `dimension: "CA" or "CA_OWNER" or "DURATION" or 11 more` Specifies the certificate attribute by which to group the results. - `"CA"` - `"CA_OWNER"` - `"DURATION"` - `"ENTRY_TYPE"` - `"EXPIRATION_STATUS"` - `"HAS_IPS"` - `"HAS_WILDCARDS"` - `"LOG"` - `"LOG_API"` - `"LOG_OPERATOR"` - `"PUBLIC_KEY_ALGORITHM"` - `"SIGNATURE_ALGORITHM"` - `"TLD"` - `"VALIDATION_LEVEL"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `ca: optional array of string` Filters results by certificate authority. - `caOwner: optional array of string` Filters results by certificate authority owner. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `duration: optional array of "LTE_3D" or "GT_3D_LTE_7D" or "GT_7D_LTE_10D" or 4 more` Filters results by certificate duration. - `"LTE_3D"` - `"GT_3D_LTE_7D"` - `"GT_7D_LTE_10D"` - `"GT_10D_LTE_47D"` - `"GT_47D_LTE_100D"` - `"GT_100D_LTE_200D"` - `"GT_200D"` - `entryType: optional array of "PRECERTIFICATE" or "CERTIFICATE"` Filters results by entry type (certificate vs. pre-certificate). - `"PRECERTIFICATE"` - `"CERTIFICATE"` - `expirationStatus: optional array of "EXPIRED" or "VALID"` Filters results by expiration status (expired vs. valid). - `"EXPIRED"` - `"VALID"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `hasIps: optional array of boolean` Filters results based on whether the certificates are bound to specific IP addresses. - `hasWildcards: optional array of boolean` Filters results based on whether the certificates contain wildcard domains. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `log: optional array of string` Filters results by certificate log. - `logApi: optional array of "RFC6962" or "STATIC"` Filters results by certificate log API (RFC6962 vs. static). - `"RFC6962"` - `"STATIC"` - `logOperator: optional array of string` Filters results by certificate log operator. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "RAW_VALUES" or "PERCENTAGE"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"RAW_VALUES"` - `"PERCENTAGE"` - `publicKeyAlgorithm: optional array of "DSA" or "ECDSA" or "RSA"` Filters results by public key algorithm. - `"DSA"` - `"ECDSA"` - `"RSA"` - `signatureAlgorithm: optional array of "DSA_SHA_1" or "DSA_SHA_256" or "ECDSA_SHA_1" or 12 more` Filters results by signature algorithm. - `"DSA_SHA_1"` - `"DSA_SHA_256"` - `"ECDSA_SHA_1"` - `"ECDSA_SHA_256"` - `"ECDSA_SHA_384"` - `"ECDSA_SHA_512"` - `"PSS_SHA_256"` - `"PSS_SHA_384"` - `"PSS_SHA_512"` - `"RSA_MD2"` - `"RSA_MD5"` - `"RSA_SHA_1"` - `"RSA_SHA_256"` - `"RSA_SHA_384"` - `"RSA_SHA_512"` - `tld: optional array of string` Filters results by top-level domain. - `uniqueEntries: optional array of "true" or "false"` Specifies whether to filter out duplicate certificates and pre-certificates. Set to true for unique entries only. - `"true"` - `"false"` - `validationLevel: optional array of "DOMAIN" or "ORGANIZATION" or "EXTENDED"` Filters results by validation level. - `"DOMAIN"` - `"ORGANIZATION"` - `"EXTENDED"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps } or object { rfc6962, static } or object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more } or 5 more` - `UnnamedSchemaRef7826220e105d84352ba1108d9ed88e55 = object { timestamps }` - `timestamps: array of string` - `object { rfc6962, static }` - `rfc6962: array of string` - `static: array of string` - `object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more }` - `gt_121d: array of string` - `gt_16d_lte_31d: array of string` - `gt_31d_lte_91d: array of string` - `gt_3d_lte_16d: array of string` - `gt_91d_lte_121d: array of string` - `lte_3d: array of string` - `object { CERTIFICATE, PRECERTIFICATE }` - `CERTIFICATE: array of string` - `PRECERTIFICATE: array of string` - `object { EXPIRED, VALID }` - `EXPIRED: array of string` - `VALID: array of string` - `object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` - `object { DSA, ECDSA, RSA }` - `DSA: array of string` - `ECDSA: array of string` - `RSA: array of string` - `object { domain, extended, organization, unknown }` - `domain: array of string` - `extended: array of string` - `organization: array of string` - `unknown: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### CT Summary Response - `CTSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string] or object { rfc6962, static } or object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more } or 5 more` - `map[string]` - `object { rfc6962, static }` - `rfc6962: string` - `static: string` - `object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more }` - `gt_121d: string` - `gt_16d_lte_31d: string` - `gt_31d_lte_91d: string` - `gt_3d_lte_16d: string` - `gt_91d_lte_121d: string` - `lte_3d: string` - `object { CERTIFICATE, PRECERTIFICATE }` - `CERTIFICATE: string` - `PRECERTIFICATE: string` - `object { EXPIRED, VALID }` - `EXPIRED: string` - `VALID: string` - `object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` - `POSITIVE: string` - `object { DSA, ECDSA, RSA }` - `DSA: string` - `ECDSA: string` - `RSA: string` - `object { domain, extended, organization, unknown }` - `domain: string` - `extended: string` - `organization: string` - `unknown: string` ### CT Timeseries Response - `CTTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### CT Timeseries Groups Response - `CTTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps } or object { rfc6962, static } or object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more } or 5 more` - `UnnamedSchemaRef7826220e105d84352ba1108d9ed88e55 = object { timestamps }` - `timestamps: array of string` - `object { rfc6962, static }` - `rfc6962: array of string` - `static: array of string` - `object { gt_121d, gt_16d_lte_31d, gt_31d_lte_91d, 3 more }` - `gt_121d: array of string` - `gt_16d_lte_31d: array of string` - `gt_31d_lte_91d: array of string` - `gt_3d_lte_16d: array of string` - `gt_91d_lte_121d: array of string` - `lte_3d: array of string` - `object { CERTIFICATE, PRECERTIFICATE }` - `CERTIFICATE: array of string` - `PRECERTIFICATE: array of string` - `object { EXPIRED, VALID }` - `EXPIRED: array of string` - `VALID: array of string` - `object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` - `object { DSA, ECDSA, RSA }` - `DSA: array of string` - `ECDSA: array of string` - `RSA: array of string` - `object { domain, extended, organization, unknown }` - `domain: array of string` - `extended: array of string` - `organization: array of string` - `unknown: array of string` # Authorities ## Get certificate authority details **get** `/radar/ct/authorities/{ca_slug}` Retrieves the requested CA information. ### Path Parameters - `ca_slug: string` Certificate authority SHA256 fingerprint. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { certificateAuthority }` - `certificateAuthority: object { appleStatus, authorityKeyIdentifier, certificateRecordType, 15 more }` - `appleStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `authorityKeyIdentifier: string` The authorityKeyIdentifier value extracted from the certificate PEM. - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `chromeStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `country: string` The two-letter ISO country code where the CA organization is based. - `countryName: string` The full country name corresponding to the country code. - `microsoftStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `mozillaStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `name: string` The full name of the certificate authority (CA). - `owner: string` The organization that owns and operates the CA. - `parentName: string` The name of the parent/root certificate authority that issued this intermediate certificate. - `parentSha256Fingerprint: string` The SHA-256 fingerprint of the parent certificate. - `related: array of object { certificateRecordType, name, revocationStatus, sha256Fingerprint }` CAs from the same owner. - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `name: string` The full name of the certificate authority (CA). - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. - `subjectKeyIdentifier: string` The subjectKeyIdentifier value extracted from the certificate PEM. - `validFrom: string` The start date of the certificate’s validity period (ISO format). - `validTo: string` The end date of the certificate’s validity period (ISO format). - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/authorities/$CA_SLUG \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "certificateAuthority": { "appleStatus": "INCLUDED", "authorityKeyIdentifier": "1TkcnFtvBKqilUzvIN0pdKTFRXE", "certificateRecordType": "ROOT_CERTIFICATE", "chromeStatus": "INCLUDED", "country": "PT", "countryName": "Portugal", "microsoftStatus": "INCLUDED", "mozillaStatus": "INCLUDED", "name": "MULTICERT Advanced Certification Authority 005", "owner": "MULTICERT", "parentName": "MULTICERT Root Certification Authority 01", "parentSha256Fingerprint": "604D32D036895AED3BFEFAEB727C009EC0F2B3CDFA42A1C71730E6A72C3BE9D4", "related": [ { "certificateRecordType": "ROOT_CERTIFICATE", "name": "MULTICERT Advanced Certification Authority 005", "revocationStatus": "NOT_REVOKED", "sha256Fingerprint": "24EDD4E503A8D3FDB5FFB4AF66C887359901CBE687A5A0760D10A08EED99A7C3" } ], "revocationStatus": "NOT_REVOKED", "sha256Fingerprint": "24EDD4E503A8D3FDB5FFB4AF66C887359901CBE687A5A0760D10A08EED99A7C3", "subjectKeyIdentifier": "VbqXmCURhMmiMtD7nFY6iCr4z", "validFrom": "2019-12-09", "validTo": "2032-06-08" } }, "success": true } ``` ## List certificate authorities **get** `/radar/ct/authorities` Retrieves a list of certificate authorities. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { certificateAuthorities }` - `certificateAuthorities: array of object { certificateRecordType, country, countryName, 6 more }` - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `country: string` The two-letter ISO country code where the CA organization is based. - `countryName: string` The full country name corresponding to the country code. - `name: string` The full name of the certificate authority (CA). - `owner: string` The organization that owns and operates the CA. - `parentName: string` The name of the parent/root certificate authority that issued this intermediate certificate. - `parentSha256Fingerprint: string` The SHA-256 fingerprint of the parent certificate. - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/authorities \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "certificateAuthorities": [ { "certificateRecordType": "ROOT_CERTIFICATE", "country": "PT", "countryName": "Portugal", "name": "MULTICERT Advanced Certification Authority 005", "owner": "MULTICERT", "parentName": "MULTICERT Root Certification Authority 01", "parentSha256Fingerprint": "24EDD4E503A8D3FDB5FFB4AF66C887359901CBE687A5A0760D10A08EED99A7C3", "revocationStatus": "NOT_REVOKED", "sha256Fingerprint": "24EDD4E503A8D3FDB5FFB4AF66C887359901CBE687A5A0760D10A08EED99A7C3" } ] }, "success": true } ``` ## Domain Types ### Authority Get Response - `AuthorityGetResponse = object { certificateAuthority }` - `certificateAuthority: object { appleStatus, authorityKeyIdentifier, certificateRecordType, 15 more }` - `appleStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `authorityKeyIdentifier: string` The authorityKeyIdentifier value extracted from the certificate PEM. - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `chromeStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `country: string` The two-letter ISO country code where the CA organization is based. - `countryName: string` The full country name corresponding to the country code. - `microsoftStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `mozillaStatus: "INCLUDED" or "NOT_YET_INCLUDED" or "NOT_INCLUDED" or 4 more` The inclusion status of a Certificate Authority (CA) in the trust store. - `"INCLUDED"` - `"NOT_YET_INCLUDED"` - `"NOT_INCLUDED"` - `"NOT_BEFORE"` - `"REMOVED"` - `"DISABLED"` - `"BLOCKED"` - `name: string` The full name of the certificate authority (CA). - `owner: string` The organization that owns and operates the CA. - `parentName: string` The name of the parent/root certificate authority that issued this intermediate certificate. - `parentSha256Fingerprint: string` The SHA-256 fingerprint of the parent certificate. - `related: array of object { certificateRecordType, name, revocationStatus, sha256Fingerprint }` CAs from the same owner. - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `name: string` The full name of the certificate authority (CA). - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. - `subjectKeyIdentifier: string` The subjectKeyIdentifier value extracted from the certificate PEM. - `validFrom: string` The start date of the certificate’s validity period (ISO format). - `validTo: string` The end date of the certificate’s validity period (ISO format). ### Authority List Response - `AuthorityListResponse = object { certificateAuthorities }` - `certificateAuthorities: array of object { certificateRecordType, country, countryName, 6 more }` - `certificateRecordType: "ROOT_CERTIFICATE" or "INTERMEDIATE_CERTIFICATE"` Specifies the type of certificate in the trust chain. - `"ROOT_CERTIFICATE"` - `"INTERMEDIATE_CERTIFICATE"` - `country: string` The two-letter ISO country code where the CA organization is based. - `countryName: string` The full country name corresponding to the country code. - `name: string` The full name of the certificate authority (CA). - `owner: string` The organization that owns and operates the CA. - `parentName: string` The name of the parent/root certificate authority that issued this intermediate certificate. - `parentSha256Fingerprint: string` The SHA-256 fingerprint of the parent certificate. - `revocationStatus: "NOT_REVOKED" or "REVOKED" or "PARENT_CERT_REVOKED"` The current revocation status of a Certificate Authority (CA) certificate. - `"NOT_REVOKED"` - `"REVOKED"` - `"PARENT_CERT_REVOKED"` - `sha256Fingerprint: string` The SHA-256 fingerprint of the intermediate certificate. # Logs ## Get certificate log details **get** `/radar/ct/logs/{log_slug}` Retrieves the requested certificate log information. ### Path Parameters - `log_slug: string` Certificate log slug. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { certificateLog }` - `certificateLog: object { api, avgThroughput, description, 12 more }` - `api: "RFC6962" or "STATIC"` The API standard that the certificate log follows. - `"RFC6962"` - `"STATIC"` - `avgThroughput: number` The average throughput of the CT log, measured in certificates per hour (certs/hour). - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `lastUpdate: string` Timestamp of the most recent update to the CT log. - `operator: string` The organization responsible for operating the certificate log. - `performance: object { endpoints, responseTime, uptime }` Log performance metrics, including averages and per-endpoint details. - `endpoints: array of object { endpoint, responseTime, uptime }` - `endpoint: "add-chain (new)" or "add-chain (old)" or "add-pre-chain (new)" or 4 more` The certificate log endpoint names used in performance metrics. - `"add-chain (new)"` - `"add-chain (old)"` - `"add-pre-chain (new)"` - `"add-pre-chain (old)"` - `"get-entries"` - `"get-roots"` - `"get-sth"` - `responseTime: number` - `uptime: number` - `responseTime: number` - `uptime: number` - `related: array of object { description, endExclusive, slug, 2 more }` Logs from the same operator. - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `stateTimestamp: string` Timestamp of when the log state was last updated. - `submittableCertCount: string` Number of certificates that are eligible for inclusion to this log but have not been included yet. Based on certificates signed by trusted root CAs within the log's accepted date range. - `submittedCertCount: string` Number of certificates already included in this CT log. - `url: string` The URL for the certificate log. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/logs/$LOG_SLUG \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "certificateLog": { "api": "RFC6962", "avgThroughput": 0, "description": "Google 'Argon2024' log", "endExclusive": "2025-01-01T00:00:00Z", "lastUpdate": "2025-01-01T00:00:00Z", "operator": "Google", "performance": { "endpoints": [ { "endpoint": "add-chain (new)", "responseTime": 0, "uptime": 0 } ], "responseTime": 0, "uptime": 0 }, "related": [ { "description": "Google 'Argon2024' log", "endExclusive": "2025-01-01T00:00:00Z", "slug": "argon2024", "startInclusive": "2024-01-01T00:00:00Z", "state": "USABLE" } ], "slug": "argon2024", "startInclusive": "2024-01-01T00:00:00Z", "state": "USABLE", "stateTimestamp": "2025-02-01T08:53:20Z", "submittableCertCount": "10", "submittedCertCount": "10", "url": "https://ct.googleapis.com/logs/us1/argon2024/" } }, "success": true } ``` ## List certificate logs **get** `/radar/ct/logs` Retrieves a list of certificate logs. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { certificateLogs }` - `certificateLogs: array of object { api, description, endExclusive, 6 more }` - `api: "RFC6962" or "STATIC"` The API standard that the certificate log follows. - `"RFC6962"` - `"STATIC"` - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `operator: string` The organization responsible for operating the certificate log. - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `stateTimestamp: string` Timestamp of when the log state was last updated. - `url: string` The URL for the certificate log. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ct/logs \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "certificateLogs": [ { "api": "RFC6962", "description": "Google 'Argon2024' log", "endExclusive": "2025-01-01T00:00:00Z", "operator": "Google", "slug": "argon2024", "startInclusive": "2024-01-01T00:00:00Z", "state": "USABLE", "stateTimestamp": "2025-02-01T08:53:20Z", "url": "https://ct.googleapis.com/logs/us1/argon2024/" } ] }, "success": true } ``` ## Domain Types ### Log Get Response - `LogGetResponse = object { certificateLog }` - `certificateLog: object { api, avgThroughput, description, 12 more }` - `api: "RFC6962" or "STATIC"` The API standard that the certificate log follows. - `"RFC6962"` - `"STATIC"` - `avgThroughput: number` The average throughput of the CT log, measured in certificates per hour (certs/hour). - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `lastUpdate: string` Timestamp of the most recent update to the CT log. - `operator: string` The organization responsible for operating the certificate log. - `performance: object { endpoints, responseTime, uptime }` Log performance metrics, including averages and per-endpoint details. - `endpoints: array of object { endpoint, responseTime, uptime }` - `endpoint: "add-chain (new)" or "add-chain (old)" or "add-pre-chain (new)" or 4 more` The certificate log endpoint names used in performance metrics. - `"add-chain (new)"` - `"add-chain (old)"` - `"add-pre-chain (new)"` - `"add-pre-chain (old)"` - `"get-entries"` - `"get-roots"` - `"get-sth"` - `responseTime: number` - `uptime: number` - `responseTime: number` - `uptime: number` - `related: array of object { description, endExclusive, slug, 2 more }` Logs from the same operator. - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `stateTimestamp: string` Timestamp of when the log state was last updated. - `submittableCertCount: string` Number of certificates that are eligible for inclusion to this log but have not been included yet. Based on certificates signed by trusted root CAs within the log's accepted date range. - `submittedCertCount: string` Number of certificates already included in this CT log. - `url: string` The URL for the certificate log. ### Log List Response - `LogListResponse = object { certificateLogs }` - `certificateLogs: array of object { api, description, endExclusive, 6 more }` - `api: "RFC6962" or "STATIC"` The API standard that the certificate log follows. - `"RFC6962"` - `"STATIC"` - `description: string` A brief description of the certificate log. - `endExclusive: string` The end date and time for when the log will stop accepting certificates. - `operator: string` The organization responsible for operating the certificate log. - `slug: string` A URL-friendly, kebab-case identifier for the certificate log. - `startInclusive: string` The start date and time for when the log starts accepting certificates. - `state: "USABLE" or "PENDING" or "QUALIFIED" or 3 more` The current state of the certificate log. More details about log states can be found here: https://googlechrome.github.io/CertificateTransparency/log_states.html - `"USABLE"` - `"PENDING"` - `"QUALIFIED"` - `"READ_ONLY"` - `"RETIRED"` - `"REJECTED"` - `stateTimestamp: string` Timestamp of when the log state was last updated. - `url: string` The URL for the certificate log. # Annotations ## Get latest annotations **get** `/radar/annotations` Retrieves the latest annotations. ### Query Parameters - `asn: optional number` Filters results by Autonomous System. Specify a single Autonomous System Number (ASN) as integer. - `dataSource: optional "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Filters results by data source. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `eventType: optional "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Filters results by event type. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `offset: optional number` Skips the specified number of objects before fetching the results. - `origin: optional string` Filters results by origin. ### Returns - `result: object { annotations }` - `annotations: array of object { id, asns, asnsDetails, 12 more }` - `id: string` - `asns: array of number` - `asnsDetails: array of object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `dataSource: string` - `eventType: string` - `locations: array of string` - `locationsDetails: array of object { code, name }` - `code: string` - `name: string` - `origins: array of string` - `originsDetails: array of object { name, origin }` - `name: string` - `origin: string` - `outage: object { outageCause, outageType }` - `outageCause: string` - `outageType: string` - `startDate: string` - `description: optional string` - `endDate: optional string` - `linkedUrl: optional string` - `scope: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/annotations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "annotations": [ { "id": "550", "asns": [ 189 ], "asnsDetails": [ { "asn": "189", "name": "LUMEN-LEGACY-L3-PARTITION", "locations": { "code": "US", "name": "United States" } } ], "dataSource": "ALL", "eventType": "OUTAGE", "locations": [ "US" ], "locationsDetails": [ { "code": "US", "name": "United States" } ], "origins": [ "amazon-us-east-1" ], "originsDetails": [ { "name": "us-east-1 Amazon Web Services", "origin": "amazon-us-east-1" } ], "outage": { "outageCause": "CABLE_CUT", "outageType": "NATIONWIDE" }, "startDate": "2022-09-06T10:00:28Z", "description": "example", "endDate": "2022-09-08T10:00:28Z", "linkedUrl": "http://example.com", "scope": "Colima, Michoacán, México" } ] }, "success": true } ``` ## Domain Types ### Annotation List Response - `AnnotationListResponse = object { annotations }` - `annotations: array of object { id, asns, asnsDetails, 12 more }` - `id: string` - `asns: array of number` - `asnsDetails: array of object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `dataSource: string` - `eventType: string` - `locations: array of string` - `locationsDetails: array of object { code, name }` - `code: string` - `name: string` - `origins: array of string` - `originsDetails: array of object { name, origin }` - `name: string` - `origin: string` - `outage: object { outageCause, outageType }` - `outageCause: string` - `outageType: string` - `startDate: string` - `description: optional string` - `endDate: optional string` - `linkedUrl: optional string` - `scope: optional string` # Outages ## Get latest Internet outages and anomalies **get** `/radar/annotations/outages` Retrieves the latest Internet outages and anomalies. ### Query Parameters - `asn: optional number` Filters results by Autonomous System. Specify a single Autonomous System Number (ASN) as integer. - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `offset: optional number` Skips the specified number of objects before fetching the results. - `origin: optional string` Filters results by origin. ### Returns - `result: object { annotations }` - `annotations: array of object { id, asns, asnsDetails, 12 more }` - `id: string` - `asns: array of number` - `asnsDetails: array of object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `dataSource: string` - `eventType: string` - `locations: array of string` - `locationsDetails: array of object { code, name }` - `code: string` - `name: string` - `origins: array of string` - `originsDetails: array of object { name, origin }` - `name: string` - `origin: string` - `outage: object { outageCause, outageType }` - `outageCause: string` - `outageType: string` - `startDate: string` - `description: optional string` - `endDate: optional string` - `linkedUrl: optional string` - `scope: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/annotations/outages \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "annotations": [ { "id": "550", "asns": [ 189 ], "asnsDetails": [ { "asn": "189", "name": "LUMEN-LEGACY-L3-PARTITION", "locations": { "code": "US", "name": "United States" } } ], "dataSource": "ALL", "eventType": "OUTAGE", "locations": [ "US" ], "locationsDetails": [ { "code": "US", "name": "United States" } ], "origins": [ "amazon-us-east-1" ], "originsDetails": [ { "name": "us-east-1 Amazon Web Services", "origin": "amazon-us-east-1" } ], "outage": { "outageCause": "CABLE_CUT", "outageType": "NATIONWIDE" }, "startDate": "2019-12-27T18:11:19.117Z", "description": "example", "endDate": "2019-12-27T18:11:19.117Z", "linkedUrl": "http://example.com", "scope": "Colima, Michoacán, México" } ] }, "success": true } ``` ## Get the number of outages by location **get** `/radar/annotations/outages/locations` Retrieves the number of outages by location. ### Query Parameters - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. ### Returns - `result: object { annotations }` - `annotations: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/annotations/outages/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "annotations": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Outage Get Response - `OutageGetResponse = object { annotations }` - `annotations: array of object { id, asns, asnsDetails, 12 more }` - `id: string` - `asns: array of number` - `asnsDetails: array of object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `dataSource: string` - `eventType: string` - `locations: array of string` - `locationsDetails: array of object { code, name }` - `code: string` - `name: string` - `origins: array of string` - `originsDetails: array of object { name, origin }` - `name: string` - `origin: string` - `outage: object { outageCause, outageType }` - `outageCause: string` - `outageType: string` - `startDate: string` - `description: optional string` - `endDate: optional string` - `linkedUrl: optional string` - `scope: optional string` ### Outage Locations Response - `OutageLocationsResponse = object { annotations }` - `annotations: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # BGP ## Get BGP time series **get** `/radar/bgp/timeseries` Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `prefix: optional array of string` Filters results by BGP network prefix. - `updateType: optional array of "ANNOUNCEMENT" or "WITHDRAWAL"` Filters results by BGP update type. - `"ANNOUNCEMENT"` - `"WITHDRAWAL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, lastUpdated }` - `aggInterval: "15m" or "1h" or "1d" or "1w"` - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "15m", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z" }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "values": [ "10" ] } }, "success": true } ``` ## Domain Types ### BGP Timeseries Response - `BGPTimeseriesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, lastUpdated }` - `aggInterval: "15m" or "1h" or "1d" or "1w"` - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` # Leaks # Events ## Get BGP route leak events **get** `/radar/bgp/leaks/events` Retrieves the BGP route leak events. ### Query Parameters - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `eventId: optional number` The unique identifier of a event. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `involvedAsn: optional number` ASN that is causing or affected by a route leak event. - `involvedCountry: optional string` Country code of a involved ASN in a route leak event. - `leakAsn: optional number` The leaking AS of a route leak event. - `page: optional number` Current page number, starting from 1. - `per_page: optional number` Number of entries per page. - `sortBy: optional "ID" or "LEAKS" or "PEERS" or 3 more` Sorts results by the specified field. - `"ID"` - `"LEAKS"` - `"PEERS"` - `"PREFIXES"` - `"ORIGINS"` - `"TIME"` - `sortOrder: optional "ASC" or "DESC"` Sort order. - `"ASC"` - `"DESC"` ### Returns - `result: object { asn_info, events }` - `asn_info: array of object { asn, country_code, org_name }` - `asn: number` - `country_code: string` - `org_name: string` - `events: array of object { id, countries, detected_ts, 10 more }` - `id: number` - `countries: array of string` - `detected_ts: string` - `finished: boolean` - `leak_asn: number` - `leak_count: number` - `leak_seg: array of number` - `leak_type: number` - `max_ts: string` - `min_ts: string` - `origin_count: number` - `peer_count: number` - `prefix_count: number` - `result_info: object { count, page, per_page, total_count }` - `count: number` - `page: number` - `per_page: number` - `total_count: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/leaks/events \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asn_info": [ { "asn": 0, "country_code": "country_code", "org_name": "org_name" } ], "events": [ { "id": 0, "countries": [ "string" ], "detected_ts": "detected_ts", "finished": true, "leak_asn": 0, "leak_count": 0, "leak_seg": [ 0 ], "leak_type": 0, "max_ts": "max_ts", "min_ts": "min_ts", "origin_count": 0, "peer_count": 0, "prefix_count": 0 } ] }, "result_info": { "count": 0, "page": 0, "per_page": 0, "total_count": 0 }, "success": true } ``` ## Domain Types ### Event List Response - `EventListResponse = object { asn_info, events }` - `asn_info: array of object { asn, country_code, org_name }` - `asn: number` - `country_code: string` - `org_name: string` - `events: array of object { id, countries, detected_ts, 10 more }` - `id: number` - `countries: array of string` - `detected_ts: string` - `finished: boolean` - `leak_asn: number` - `leak_count: number` - `leak_seg: array of number` - `leak_type: number` - `max_ts: string` - `min_ts: string` - `origin_count: number` - `peer_count: number` - `prefix_count: number` # Top ## Get top prefixes by BGP updates **get** `/radar/bgp/top/prefixes` Retrieves the top network prefixes by BGP updates. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `updateType: optional array of "ANNOUNCEMENT" or "WITHDRAWAL"` Filters results by BGP update type. - `"ANNOUNCEMENT"` - `"WITHDRAWAL"` ### Returns - `result: object { meta, top_0 }` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `top_0: array of object { prefix, value }` - `prefix: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/top/prefixes \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ] }, "top_0": [ { "prefix": "2804:77cc:8000::/33", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Top Prefixes Response - `TopPrefixesResponse = object { meta, top_0 }` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `top_0: array of object { prefix, value }` - `prefix: string` - `value: string` A numeric string. # Ases ## Get top ASes by BGP updates **get** `/radar/bgp/top/ases` Retrieves the top autonomous systems by BGP updates (announcements only). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `prefix: optional array of string` Filters results by BGP network prefix. - `updateType: optional array of "ANNOUNCEMENT" or "WITHDRAWAL"` Filters results by BGP update type. - `"ANNOUNCEMENT"` - `"WITHDRAWAL"` ### Returns - `result: object { meta, top_0 }` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `top_0: array of object { asn, ASName, value }` - `asn: number` - `ASName: string` - `value: string` Percentage of updates by this AS out of the total updates by all autonomous systems. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/top/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ] }, "top_0": [ { "asn": 714, "ASName": "Apple-Engineering", "value": "0.73996" } ] }, "success": true } ``` ## Get top ASes by prefix count **get** `/radar/bgp/top/ases/prefixes` Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. ### Query Parameters - `country: optional string` Alpha-2 country code. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Maximum number of ASes to return. ### Returns - `result: object { asns, meta }` - `asns: array of object { asn, country, name, pfxs_count }` - `asn: number` - `country: string` - `name: string` - `pfxs_count: number` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/top/ases/prefixes \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asns": [ { "asn": 0, "country": "country", "name": "name", "pfxs_count": 0 } ], "meta": { "data_time": "data_time", "query_time": "query_time", "total_peers": 0 } }, "success": true } ``` ## Domain Types ### Ase Get Response - `AseGetResponse = object { meta, top_0 }` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `top_0: array of object { asn, ASName, value }` - `asn: number` - `ASName: string` - `value: string` Percentage of updates by this AS out of the total updates by all autonomous systems. ### Ase Prefixes Response - `AsePrefixesResponse = object { asns, meta }` - `asns: array of object { asn, country, name, pfxs_count }` - `asn: number` - `country: string` - `name: string` - `pfxs_count: number` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` # Hijacks # Events ## Get BGP hijack events **get** `/radar/bgp/hijacks/events` Retrieves the BGP hijack events. ### Query Parameters - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `eventId: optional number` The unique identifier of a event. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `hijackerAsn: optional number` The potential hijacker AS of a BGP hijack event. - `involvedAsn: optional number` The potential hijacker or victim AS of a BGP hijack event. - `involvedCountry: optional string` The country code of the potential hijacker or victim AS of a BGP hijack event. - `maxConfidence: optional number` Filters events by maximum confidence score (1-4 low, 5-7 mid, 8+ high). - `minConfidence: optional number` Filters events by minimum confidence score (1-4 low, 5-7 mid, 8+ high). - `page: optional number` Current page number, starting from 1. - `per_page: optional number` Number of entries per page. - `prefix: optional string` - `sortBy: optional "ID" or "TIME" or "CONFIDENCE"` Sorts results by the specified field. - `"ID"` - `"TIME"` - `"CONFIDENCE"` - `sortOrder: optional "ASC" or "DESC"` Sort order. - `"ASC"` - `"DESC"` - `victimAsn: optional number` The potential victim AS of a BGP hijack event. ### Returns - `result: object { asn_info, events, total_monitors }` - `asn_info: array of object { asn, country_code, org_name }` - `asn: number` - `country_code: string` - `org_name: string` - `events: array of object { id, confidence_score, duration, 15 more }` - `id: number` - `confidence_score: number` - `duration: number` - `event_type: number` - `hijack_msgs_count: number` - `hijacker_asn: number` - `hijacker_country: string` - `is_stale: boolean` - `max_hijack_ts: string` - `max_msg_ts: string` - `min_hijack_ts: string` - `on_going_count: number` - `peer_asns: array of number` - `peer_ip_count: number` - `prefixes: array of string` - `tags: array of object { name, score }` - `name: string` - `score: number` - `victim_asns: array of number` - `victim_countries: array of string` - `total_monitors: number` - `result_info: object { count, page, per_page, total_count }` - `count: number` - `page: number` - `per_page: number` - `total_count: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/hijacks/events \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asn_info": [ { "asn": 0, "country_code": "country_code", "org_name": "org_name" } ], "events": [ { "id": 0, "confidence_score": 0, "duration": 0, "event_type": 0, "hijack_msgs_count": 0, "hijacker_asn": 0, "hijacker_country": "hijacker_country", "is_stale": true, "max_hijack_ts": "max_hijack_ts", "max_msg_ts": "max_msg_ts", "min_hijack_ts": "min_hijack_ts", "on_going_count": 0, "peer_asns": [ 0 ], "peer_ip_count": 0, "prefixes": [ "string" ], "tags": [ { "name": "name", "score": 0 } ], "victim_asns": [ 0 ], "victim_countries": [ "string" ] } ], "total_monitors": 0 }, "result_info": { "count": 0, "page": 0, "per_page": 0, "total_count": 0 }, "success": true } ``` ## Domain Types ### Event List Response - `EventListResponse = object { asn_info, events, total_monitors }` - `asn_info: array of object { asn, country_code, org_name }` - `asn: number` - `country_code: string` - `org_name: string` - `events: array of object { id, confidence_score, duration, 15 more }` - `id: number` - `confidence_score: number` - `duration: number` - `event_type: number` - `hijack_msgs_count: number` - `hijacker_asn: number` - `hijacker_country: string` - `is_stale: boolean` - `max_hijack_ts: string` - `max_msg_ts: string` - `min_hijack_ts: string` - `on_going_count: number` - `peer_asns: array of number` - `peer_ip_count: number` - `prefixes: array of string` - `tags: array of object { name, score }` - `name: string` - `score: number` - `victim_asns: array of number` - `victim_countries: array of string` - `total_monitors: number` # Routes ## Get Multi-Origin AS (MOAS) prefixes **get** `/radar/bgp/routes/moas` Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `invalid_only: optional boolean` Lookup only RPKI invalid MOASes. - `origin: optional number` Lookup MOASes originated by the given ASN. - `prefix: optional string` ### Returns - `result: object { meta, moas }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `moas: array of object { origins, prefix }` - `origins: array of object { origin, peer_count, rpki_validation }` - `origin: number` - `peer_count: number` - `rpki_validation: string` - `prefix: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/routes/moas \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "data_time": "data_time", "query_time": "query_time", "total_peers": 0 }, "moas": [ { "origins": [ { "origin": 0, "peer_count": 0, "rpki_validation": "rpki_validation" } ], "prefix": "prefix" } ] }, "success": true } ``` ## Get prefix-to-ASN mapping **get** `/radar/bgp/routes/pfx2as` Retrieves the prefix-to-ASN mapping from global routing tables. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `longestPrefixMatch: optional boolean` Return only results with the longest prefix match for the given prefix. For example, specify a /32 prefix to lookup the origin ASN for an IPv4 address. - `origin: optional number` Lookup prefixes originated by the given ASN. - `prefix: optional string` - `rpkiStatus: optional "VALID" or "INVALID" or "UNKNOWN"` Return only results with matching rpki status: valid, invalid or unknown. - `"VALID"` - `"INVALID"` - `"UNKNOWN"` ### Returns - `result: object { meta, prefix_origins }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `prefix_origins: array of object { origin, peer_count, prefix, rpki_validation }` - `origin: number` - `peer_count: number` - `prefix: string` - `rpki_validation: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/routes/pfx2as \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "data_time": "data_time", "query_time": "query_time", "total_peers": 0 }, "prefix_origins": [ { "origin": 0, "peer_count": 0, "prefix": "prefix", "rpki_validation": "rpki_validation" } ] }, "success": true } ``` ## Get BGP routing table stats **get** `/radar/bgp/routes/stats` Retrieves the BGP routing table stats. ### Query Parameters - `asn: optional number` Filters results by Autonomous System. Specify a single Autonomous System Number (ASN) as integer. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional string` Filters results by location. Specify an alpha-2 location code. ### Returns - `result: object { meta, stats }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `stats: object { distinct_origins, distinct_origins_ipv4, distinct_origins_ipv6, 15 more }` - `distinct_origins: number` - `distinct_origins_ipv4: number` - `distinct_origins_ipv6: number` - `distinct_prefixes: number` - `distinct_prefixes_ipv4: number` - `distinct_prefixes_ipv6: number` - `routes_invalid: number` - `routes_invalid_ipv4: number` - `routes_invalid_ipv6: number` - `routes_total: number` - `routes_total_ipv4: number` - `routes_total_ipv6: number` - `routes_unknown: number` - `routes_unknown_ipv4: number` - `routes_unknown_ipv6: number` - `routes_valid: number` - `routes_valid_ipv4: number` - `routes_valid_ipv6: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/routes/stats \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "data_time": "data_time", "query_time": "query_time", "total_peers": 0 }, "stats": { "distinct_origins": 0, "distinct_origins_ipv4": 0, "distinct_origins_ipv6": 0, "distinct_prefixes": 0, "distinct_prefixes_ipv4": 0, "distinct_prefixes_ipv6": 0, "routes_invalid": 0, "routes_invalid_ipv4": 0, "routes_invalid_ipv6": 0, "routes_total": 0, "routes_total_ipv4": 0, "routes_total_ipv6": 0, "routes_unknown": 0, "routes_unknown_ipv4": 0, "routes_unknown_ipv6": 0, "routes_valid": 0, "routes_valid_ipv4": 0, "routes_valid_ipv6": 0 } }, "success": true } ``` ## List ASes from global routing tables **get** `/radar/bgp/routes/ases` Retrieves all ASes in the current global routing tables with routing statistics. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `sortBy: optional "cone" or "pfxs" or "ipv4" or 4 more` Sorts results by the specified field. - `"cone"` - `"pfxs"` - `"ipv4"` - `"ipv6"` - `"rpki_valid"` - `"rpki_invalid"` - `"rpki_unknown"` - `sortOrder: optional "ASC" or "DESC"` Sort order. - `"ASC"` - `"DESC"` ### Returns - `result: object { asns, meta }` - `asns: array of object { asn, coneSize, country, 7 more }` - `asn: number` - `coneSize: number` AS's customer cone size. - `country: string` Alpha-2 code for the AS's registration country. - `ipv4Count: number` Number of IPv4 addresses originated by the AS. - `ipv6Count: string` Number of IPv6 addresses originated by the AS. - `name: string` Name of the AS. - `pfxsCount: number` Number of total IP prefixes originated by the AS. - `rpkiInvalid: number` Number of RPKI invalid prefixes originated by the AS. - `rpkiUnknown: number` Number of RPKI unknown prefixes originated by the AS. - `rpkiValid: number` Number of RPKI valid prefixes originated by the AS. - `meta: object { dataTime, queryTime, totalPeers }` - `dataTime: string` The timestamp of when the data is generated. - `queryTime: string` The timestamp of the query. - `totalPeers: number` Total number of route collector peers used to generate this data. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/routes/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asns": [ { "asn": 0, "coneSize": 0, "country": "US", "ipv4Count": 0, "ipv6Count": "1.21e24", "name": "name", "pfxsCount": 0, "rpkiInvalid": 0, "rpkiUnknown": 0, "rpkiValid": 0 } ], "meta": { "dataTime": "2024-06-03T14:00:00", "queryTime": "2024-06-03T14:00:00", "totalPeers": 0 } }, "success": true } ``` ## Get real-time BGP routes for a prefix **get** `/radar/bgp/routes/realtime` Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `prefix: optional string` ### Returns - `result: object { meta, routes }` - `meta: object { asn_info, collectors, data_time, 2 more }` - `asn_info: array of object { as_name, asn, country_code, 2 more }` - `as_name: string` Name of the autonomous system. - `asn: number` AS number. - `country_code: string` Alpha-2 code for the AS's registration country. - `org_id: string` Organization ID. - `org_name: string` Organization name. - `collectors: array of object { collector, latest_realtime_ts, latest_rib_ts, 4 more }` - `collector: string` Public route collector ID. - `latest_realtime_ts: string` Latest real-time stream timestamp for this collector. - `latest_rib_ts: string` Latest RIB dump MRT file timestamp for this collector. - `latest_updates_ts: string` Latest BGP updates MRT file timestamp for this collector. - `peers_count: number` Total number of collector peers used from this collector. - `peers_v4_count: number` Total number of collector peers used from this collector for IPv4 prefixes. - `peers_v6_count: number` Total number of collector peers used from this collector for IPv6 prefixes. - `data_time: string` The most recent data timestamp for from the real-time sources. - `prefix_origins: array of object { origin, prefix, rpki_validation, 3 more }` - `origin: number` Origin ASN. - `prefix: string` IP prefix of this query. - `rpki_validation: string` Prefix-origin RPKI validation: valid, invalid, unknown. - `total_peers: number` Total number of peers. - `total_visible: number` Total number of peers seeing this prefix. - `visibility: number` Ratio of peers seeing this prefix to total number of peers. - `query_time: string` The timestamp of this query. - `routes: array of object { as_path, collector, communities, 2 more }` - `as_path: array of number` AS-level path for this route, from collector to origin. - `collector: string` Public collector ID for this route. - `communities: array of string` BGP community values. - `prefix: string` IP prefix of this query. - `timestamp: string` Latest timestamp of change for this route. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/routes/realtime \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "asn_info": [ { "as_name": "as_name", "asn": 0, "country_code": "country_code", "org_id": "org_id", "org_name": "org_name" } ], "collectors": [ { "collector": "collector", "latest_realtime_ts": "latest_realtime_ts", "latest_rib_ts": "latest_rib_ts", "latest_updates_ts": "latest_updates_ts", "peers_count": 0, "peers_v4_count": 0, "peers_v6_count": 0 } ], "data_time": "data_time", "prefix_origins": [ { "origin": 0, "prefix": "prefix", "rpki_validation": "rpki_validation", "total_peers": 0, "total_visible": 0, "visibility": 0 } ], "query_time": "query_time" }, "routes": [ { "as_path": [ 0 ], "collector": "collector", "communities": [ "string" ], "prefix": "prefix", "timestamp": "timestamp" } ] }, "success": true } ``` ## Domain Types ### Route Moas Response - `RouteMoasResponse = object { meta, moas }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `moas: array of object { origins, prefix }` - `origins: array of object { origin, peer_count, rpki_validation }` - `origin: number` - `peer_count: number` - `rpki_validation: string` - `prefix: string` ### Route Pfx2as Response - `RoutePfx2asResponse = object { meta, prefix_origins }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `prefix_origins: array of object { origin, peer_count, prefix, rpki_validation }` - `origin: number` - `peer_count: number` - `prefix: string` - `rpki_validation: string` ### Route Stats Response - `RouteStatsResponse = object { meta, stats }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `stats: object { distinct_origins, distinct_origins_ipv4, distinct_origins_ipv6, 15 more }` - `distinct_origins: number` - `distinct_origins_ipv4: number` - `distinct_origins_ipv6: number` - `distinct_prefixes: number` - `distinct_prefixes_ipv4: number` - `distinct_prefixes_ipv6: number` - `routes_invalid: number` - `routes_invalid_ipv4: number` - `routes_invalid_ipv6: number` - `routes_total: number` - `routes_total_ipv4: number` - `routes_total_ipv6: number` - `routes_unknown: number` - `routes_unknown_ipv4: number` - `routes_unknown_ipv6: number` - `routes_valid: number` - `routes_valid_ipv4: number` - `routes_valid_ipv6: number` ### Route Ases Response - `RouteAsesResponse = object { asns, meta }` - `asns: array of object { asn, coneSize, country, 7 more }` - `asn: number` - `coneSize: number` AS's customer cone size. - `country: string` Alpha-2 code for the AS's registration country. - `ipv4Count: number` Number of IPv4 addresses originated by the AS. - `ipv6Count: string` Number of IPv6 addresses originated by the AS. - `name: string` Name of the AS. - `pfxsCount: number` Number of total IP prefixes originated by the AS. - `rpkiInvalid: number` Number of RPKI invalid prefixes originated by the AS. - `rpkiUnknown: number` Number of RPKI unknown prefixes originated by the AS. - `rpkiValid: number` Number of RPKI valid prefixes originated by the AS. - `meta: object { dataTime, queryTime, totalPeers }` - `dataTime: string` The timestamp of when the data is generated. - `queryTime: string` The timestamp of the query. - `totalPeers: number` Total number of route collector peers used to generate this data. ### Route Realtime Response - `RouteRealtimeResponse = object { meta, routes }` - `meta: object { asn_info, collectors, data_time, 2 more }` - `asn_info: array of object { as_name, asn, country_code, 2 more }` - `as_name: string` Name of the autonomous system. - `asn: number` AS number. - `country_code: string` Alpha-2 code for the AS's registration country. - `org_id: string` Organization ID. - `org_name: string` Organization name. - `collectors: array of object { collector, latest_realtime_ts, latest_rib_ts, 4 more }` - `collector: string` Public route collector ID. - `latest_realtime_ts: string` Latest real-time stream timestamp for this collector. - `latest_rib_ts: string` Latest RIB dump MRT file timestamp for this collector. - `latest_updates_ts: string` Latest BGP updates MRT file timestamp for this collector. - `peers_count: number` Total number of collector peers used from this collector. - `peers_v4_count: number` Total number of collector peers used from this collector for IPv4 prefixes. - `peers_v6_count: number` Total number of collector peers used from this collector for IPv6 prefixes. - `data_time: string` The most recent data timestamp for from the real-time sources. - `prefix_origins: array of object { origin, prefix, rpki_validation, 3 more }` - `origin: number` Origin ASN. - `prefix: string` IP prefix of this query. - `rpki_validation: string` Prefix-origin RPKI validation: valid, invalid, unknown. - `total_peers: number` Total number of peers. - `total_visible: number` Total number of peers seeing this prefix. - `visibility: number` Ratio of peers seeing this prefix to total number of peers. - `query_time: string` The timestamp of this query. - `routes: array of object { as_path, collector, communities, 2 more }` - `as_path: array of number` AS-level path for this route, from collector to origin. - `collector: string` Public collector ID for this route. - `communities: array of string` BGP community values. - `prefix: string` IP prefix of this query. - `timestamp: string` Latest timestamp of change for this route. # IPs ## Get announced IP address space time series **get** `/radar/bgp/ips/timeseries` Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `includeDelay: optional boolean` Includes data delay meta information. - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 4 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `delay: optional object { asn_data, country_data, healthy, nowTs }` - `asn_data: object { delaySecs, delayStr, healthy, latest }` - `delaySecs: number` - `delayStr: string` - `healthy: boolean` - `latest: object { entries_count, path, timestamp }` - `entries_count: number` - `path: string` - `timestamp: number` - `country_data: object { delaySecs, delayStr, healthy, latest }` - `delaySecs: number` - `delayStr: string` - `healthy: boolean` - `latest: object { count, timestamp }` - `count: number` - `timestamp: number` - `healthy: boolean` - `nowTs: number` - `serie_0: object { ipv4, ipv6, timestamps }` - `ipv4: array of string` - `ipv6: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/ips/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ], "delay": { "asn_data": { "delaySecs": 0, "delayStr": "delayStr", "healthy": true, "latest": { "entries_count": 0, "path": "path", "timestamp": 0 } }, "country_data": { "delaySecs": 0, "delayStr": "delayStr", "healthy": true, "latest": { "count": 0, "timestamp": 0 } }, "healthy": true, "nowTs": 0 } }, "serie_0": { "ipv4": [ "10" ], "ipv6": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Domain Types ### IP Timeseries Response - `IPTimeseriesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 4 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `delay: optional object { asn_data, country_data, healthy, nowTs }` - `asn_data: object { delaySecs, delayStr, healthy, latest }` - `delaySecs: number` - `delayStr: string` - `healthy: boolean` - `latest: object { entries_count, path, timestamp }` - `entries_count: number` - `path: string` - `timestamp: number` - `country_data: object { delaySecs, delayStr, healthy, latest }` - `delaySecs: number` - `delayStr: string` - `healthy: boolean` - `latest: object { count, timestamp }` - `count: number` - `timestamp: number` - `healthy: boolean` - `nowTs: number` - `serie_0: object { ipv4, ipv6, timestamps }` - `ipv4: array of string` - `ipv6: array of string` - `timestamps: array of string` # RPKI # ASPA ## Get ASPA objects snapshot **get** `/radar/bgp/rpki/aspa/snapshot` Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. ### Query Parameters - `customerAsn: optional number` Filter by customer ASN (the ASN publishing the ASPA object). - `date: optional string` Filters results by the specified datetime (ISO 8601). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `includeAsnInfo: optional boolean` Include ASN metadata (name, country) in response. - `providerAsn: optional number` Filter by provider ASN (an authorized upstream provider in ASPA objects). ### Returns - `result: object { asnInfo, aspaObjects, meta }` - `asnInfo: object { "13335" }` - `"13335": object { asn, country, name }` - `asn: number` ASN number. - `country: string` Alpha-2 country code. - `name: string` AS name. - `aspaObjects: array of object { customerAsn, providers }` - `customerAsn: number` The customer ASN publishing the ASPA object. - `providers: array of number` - `meta: object { dataTime, queryTime, totalCount }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. - `totalCount: number` Total number of ASPA objects. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/rpki/aspa/snapshot \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asnInfo": { "13335": { "asn": 0, "country": "country", "name": "name" } }, "aspaObjects": [ { "customerAsn": 0, "providers": [ 0 ] } ], "meta": { "dataTime": "2019-12-27T18:11:19.117Z", "queryTime": "2019-12-27T18:11:19.117Z", "totalCount": 0 } }, "success": true } ``` ## Get ASPA changes over time **get** `/radar/bgp/rpki/aspa/changes` Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. ### Query Parameters - `asn: optional number` Filter changes involving this ASN (as customer or provider). - `dateEnd: optional string` End of the date range (inclusive). - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `includeAsnInfo: optional boolean` Include ASN metadata (name, country) in response. ### Returns - `result: object { asnInfo, changes, meta }` - `asnInfo: object { "13335" }` - `"13335": object { asn, country, name }` - `asn: number` ASN number. - `country: string` Alpha-2 country code. - `name: string` AS name. - `changes: array of object { customersAdded, customersRemoved, date, 4 more }` - `customersAdded: number` Number of new ASPA objects created. - `customersRemoved: number` Number of ASPA objects deleted. - `date: string` Date of the changes in ISO 8601 format. - `entries: array of object { customerAsn, providers, type }` - `customerAsn: number` The customer ASN affected. - `providers: array of number` - `type: "CustomerAdded" or "CustomerRemoved" or "ProvidersAdded" or "ProvidersRemoved"` - `"CustomerAdded"` - `"CustomerRemoved"` - `"ProvidersAdded"` - `"ProvidersRemoved"` - `providersAdded: number` Number of providers added to existing objects. - `providersRemoved: number` Number of providers removed from existing objects. - `totalCount: number` Running total of active ASPA objects after this day. - `meta: object { dataTime, queryTime }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/rpki/aspa/changes \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asnInfo": { "13335": { "asn": 0, "country": "country", "name": "name" } }, "changes": [ { "customersAdded": 0, "customersRemoved": 0, "date": "2019-12-27T18:11:19.117Z", "entries": [ { "customerAsn": 0, "providers": [ 0 ], "type": "CustomerAdded" } ], "providersAdded": 0, "providersRemoved": 0, "totalCount": 0 } ], "meta": { "dataTime": "2019-12-27T18:11:19.117Z", "queryTime": "2019-12-27T18:11:19.117Z" } }, "success": true } ``` ## Get ASPA count time series **get** `/radar/bgp/rpki/aspa/timeseries` Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. ### Query Parameters - `dateEnd: optional string` End of the date range (inclusive). - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `name: optional array of string` Array of names used to label the series in the response. - `rir: optional array of "RIPE_NCC" or "ARIN" or "APNIC" or 2 more` Filter by Regional Internet Registry (RIR). Multiple RIRs generate multiple series. - `"RIPE_NCC"` - `"ARIN"` - `"APNIC"` - `"LACNIC"` - `"AFRINIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { dataTime, queryTime }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bgp/rpki/aspa/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "dataTime": "2019-12-27T18:11:19.117Z", "queryTime": "2019-12-27T18:11:19.117Z" }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "values": [ "10" ] } }, "success": true } ``` ## Domain Types ### ASPA Snapshot Response - `ASPASnapshotResponse = object { asnInfo, aspaObjects, meta }` - `asnInfo: object { "13335" }` - `"13335": object { asn, country, name }` - `asn: number` ASN number. - `country: string` Alpha-2 country code. - `name: string` AS name. - `aspaObjects: array of object { customerAsn, providers }` - `customerAsn: number` The customer ASN publishing the ASPA object. - `providers: array of number` - `meta: object { dataTime, queryTime, totalCount }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. - `totalCount: number` Total number of ASPA objects. ### ASPA Changes Response - `ASPAChangesResponse = object { asnInfo, changes, meta }` - `asnInfo: object { "13335" }` - `"13335": object { asn, country, name }` - `asn: number` ASN number. - `country: string` Alpha-2 country code. - `name: string` AS name. - `changes: array of object { customersAdded, customersRemoved, date, 4 more }` - `customersAdded: number` Number of new ASPA objects created. - `customersRemoved: number` Number of ASPA objects deleted. - `date: string` Date of the changes in ISO 8601 format. - `entries: array of object { customerAsn, providers, type }` - `customerAsn: number` The customer ASN affected. - `providers: array of number` - `type: "CustomerAdded" or "CustomerRemoved" or "ProvidersAdded" or "ProvidersRemoved"` - `"CustomerAdded"` - `"CustomerRemoved"` - `"ProvidersAdded"` - `"ProvidersRemoved"` - `providersAdded: number` Number of providers added to existing objects. - `providersRemoved: number` Number of providers removed from existing objects. - `totalCount: number` Running total of active ASPA objects after this day. - `meta: object { dataTime, queryTime }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. ### ASPA Timeseries Response - `ASPATimeseriesResponse = object { meta, serie_0 }` - `meta: object { dataTime, queryTime }` - `dataTime: string` Timestamp of the underlying data. - `queryTime: string` Timestamp when the query was executed. - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` # Bots ## List bots **get** `/radar/bots` Retrieves a list of bots. ### Query Parameters - `botCategory: optional "SEARCH_ENGINE_CRAWLER" or "SEARCH_ENGINE_OPTIMIZATION" or "MONITORING_AND_ANALYTICS" or 13 more` Filters results by bot category. - `"SEARCH_ENGINE_CRAWLER"` - `"SEARCH_ENGINE_OPTIMIZATION"` - `"MONITORING_AND_ANALYTICS"` - `"ADVERTISING_AND_MARKETING"` - `"SOCIAL_MEDIA_MARKETING"` - `"PAGE_PREVIEW"` - `"ACADEMIC_RESEARCH"` - `"SECURITY"` - `"ACCESSIBILITY"` - `"WEBHOOKS"` - `"FEED_FETCHER"` - `"AI_CRAWLER"` - `"AGGREGATOR"` - `"AI_ASSISTANT"` - `"AI_SEARCH"` - `"ARCHIVER"` - `botOperator: optional string` Filters results by bot operator. - `botVerificationStatus: optional "VERIFIED"` Filters results by bot verification status. - `"VERIFIED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `kind: optional "AGENT" or "BOT"` Filters results by bot kind. - `"AGENT"` - `"BOT"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { bots }` - `bots: array of object { category, description, kind, 4 more }` - `category: string` The category of the bot. - `description: string` A summary for the bot (e.g., purpose). - `kind: string` The kind of the bot. - `name: string` The name of the bot. - `operator: string` The organization that owns and operates the bot. - `slug: string` A kebab-case identifier derived from the bot name. - `userAgentPatterns: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "bots": [ { "category": "AI_CRAWLER", "description": "OpenAI/ChatGPT's web crawler", "kind": "AGENT", "name": "GPTBot", "operator": "OpenAI", "slug": "gptbot", "userAgentPatterns": [ "GPTBot" ] } ] }, "success": true } ``` ## Get bot details **get** `/radar/bots/{bot_slug}` Retrieves the requested bot information. ### Path Parameters - `bot_slug: string` Bot slug. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { bot }` - `bot: object { category, description, kind, 6 more }` - `category: string` The category of the bot. - `description: string` A summary for the bot (e.g., purpose). - `kind: string` The kind of the bot. - `name: string` The name of the bot. - `operator: string` The organization that owns and operates the bot. - `operatorUrl: string` The link to the bot documentation. - `slug: string` A kebab-case identifier derived from the bot name. - `userAgentPatterns: array of string` - `userAgents: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/$BOT_SLUG \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "bot": { "category": "AI_CRAWLER", "description": "OpenAI/ChatGPT's web crawler", "kind": "AGENT", "name": "GPTBot", "operator": "OpenAI", "operatorUrl": "https://platform.openai.com/docs/bots", "slug": "gptbot", "userAgentPatterns": [ "GPTBot" ], "userAgents": [ "GPTBot" ] } }, "success": true } ``` ## Get bots HTTP requests distribution by dimension **get** `/radar/bots/summary/{dimension}` Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. ### Path Parameters - `dimension: "BOT" or "BOT_KIND" or "BOT_OPERATOR" or "BOT_CATEGORY"` Specifies the attribute by which to group the results. - `"BOT"` - `"BOT_KIND"` - `"BOT_OPERATOR"` - `"BOT_CATEGORY"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `bot: optional array of string` Filters results by bot name. - `botCategory: optional array of "SEARCH_ENGINE_CRAWLER" or "SEARCH_ENGINE_OPTIMIZATION" or "MONITORING_AND_ANALYTICS" or 13 more` Filters results by bot category. - `"SEARCH_ENGINE_CRAWLER"` - `"SEARCH_ENGINE_OPTIMIZATION"` - `"MONITORING_AND_ANALYTICS"` - `"ADVERTISING_AND_MARKETING"` - `"SOCIAL_MEDIA_MARKETING"` - `"PAGE_PREVIEW"` - `"ACADEMIC_RESEARCH"` - `"SECURITY"` - `"ACCESSIBILITY"` - `"WEBHOOKS"` - `"FEED_FETCHER"` - `"AI_CRAWLER"` - `"AGGREGATOR"` - `"AI_ASSISTANT"` - `"AI_SEARCH"` - `"ARCHIVER"` - `botKind: optional array of "AGENT" or "BOT"` Filters results by bot kind. - `"AGENT"` - `"BOT"` - `botOperator: optional array of string` Filters results by bot operator. - `botVerificationStatus: optional array of "VERIFIED"` Filters results by bot verification status (Verified vs. Unverified). - `"VERIFIED"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Facebook": "10.274394", "GPTBot": "63.40249", "GoogleBot": "8.381743" } }, "success": true } ``` ## Get bots HTTP requests time series **get** `/radar/bots/timeseries` Retrieves bots HTTP request volume over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `bot: optional array of string` Filters results by bot name. - `botCategory: optional array of "SEARCH_ENGINE_CRAWLER" or "SEARCH_ENGINE_OPTIMIZATION" or "MONITORING_AND_ANALYTICS" or 13 more` Filters results by bot category. - `"SEARCH_ENGINE_CRAWLER"` - `"SEARCH_ENGINE_OPTIMIZATION"` - `"MONITORING_AND_ANALYTICS"` - `"ADVERTISING_AND_MARKETING"` - `"SOCIAL_MEDIA_MARKETING"` - `"PAGE_PREVIEW"` - `"ACADEMIC_RESEARCH"` - `"SECURITY"` - `"ACCESSIBILITY"` - `"WEBHOOKS"` - `"FEED_FETCHER"` - `"AI_CRAWLER"` - `"AGGREGATOR"` - `"AI_ASSISTANT"` - `"AI_SEARCH"` - `"ARCHIVER"` - `botKind: optional array of "AGENT" or "BOT"` Filters results by bot kind. - `"AGENT"` - `"BOT"` - `botOperator: optional array of string` Filters results by bot operator. - `botVerificationStatus: optional array of "VERIFIED"` Filters results by bot verification status (Verified vs. Unverified). - `"VERIFIED"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get time series distribution of bots HTTP requests by dimension. **get** `/radar/bots/timeseries_groups/{dimension}` Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. ### Path Parameters - `dimension: "BOT" or "BOT_KIND" or "BOT_OPERATOR" or "BOT_CATEGORY"` Specifies the attribute by which to group the results. - `"BOT"` - `"BOT_KIND"` - `"BOT_OPERATOR"` - `"BOT_CATEGORY"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `bot: optional array of string` Filters results by bot name. - `botCategory: optional array of "SEARCH_ENGINE_CRAWLER" or "SEARCH_ENGINE_OPTIMIZATION" or "MONITORING_AND_ANALYTICS" or 13 more` Filters results by bot category. - `"SEARCH_ENGINE_CRAWLER"` - `"SEARCH_ENGINE_OPTIMIZATION"` - `"MONITORING_AND_ANALYTICS"` - `"ADVERTISING_AND_MARKETING"` - `"SOCIAL_MEDIA_MARKETING"` - `"PAGE_PREVIEW"` - `"ACADEMIC_RESEARCH"` - `"SECURITY"` - `"ACCESSIBILITY"` - `"WEBHOOKS"` - `"FEED_FETCHER"` - `"AI_CRAWLER"` - `"AGGREGATOR"` - `"AI_ASSISTANT"` - `"AI_SEARCH"` - `"ARCHIVER"` - `botKind: optional array of "AGENT" or "BOT"` Filters results by bot kind. - `"AGENT"` - `"BOT"` - `botOperator: optional array of string` Filters results by bot operator. - `botVerificationStatus: optional array of "VERIFIED"` Filters results by bot verification status (Verified vs. Unverified). - `"VERIFIED"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Bot List Response - `BotListResponse = object { bots }` - `bots: array of object { category, description, kind, 4 more }` - `category: string` The category of the bot. - `description: string` A summary for the bot (e.g., purpose). - `kind: string` The kind of the bot. - `name: string` The name of the bot. - `operator: string` The organization that owns and operates the bot. - `slug: string` A kebab-case identifier derived from the bot name. - `userAgentPatterns: array of string` ### Bot Get Response - `BotGetResponse = object { bot }` - `bot: object { category, description, kind, 6 more }` - `category: string` The category of the bot. - `description: string` A summary for the bot (e.g., purpose). - `kind: string` The kind of the bot. - `name: string` The name of the bot. - `operator: string` The organization that owns and operates the bot. - `operatorUrl: string` The link to the bot documentation. - `slug: string` A kebab-case identifier derived from the bot name. - `userAgentPatterns: array of string` - `userAgents: array of string` ### Bot Summary Response - `BotSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Bot Timeseries Response - `BotTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### Bot Timeseries Groups Response - `BotTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Web Crawlers ## Get crawler HTTP request distribution by dimension **get** `/radar/bots/crawlers/summary/{dimension}` Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. ### Path Parameters - `dimension: "CLIENT_TYPE" or "USER_AGENT" or "REFERER" or 3 more` Specifies the attribute by which to group the results. - `"CLIENT_TYPE"` - `"USER_AGENT"` - `"REFERER"` - `"CRAWL_REFER_RATIO"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `botOperator: optional array of string` Filters results by bot operator. - `clientType: optional array of "HUMAN" or "NON_AI_BOT" or "AI_BOT" or "MIXED_PURPOSE"` Filters results by agent type. - `"HUMAN"` - `"NON_AI_BOT"` - `"AI_BOT"` - `"MIXED_PURPOSE"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/crawlers/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Claude": "63.40249", "DuckDuckGo": "10.274394", "Google": "8.381743" } }, "success": true } ``` ## Get time series of crawler HTTP request distribution by dimension **get** `/radar/bots/crawlers/timeseries_groups/{dimension}` Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. ### Path Parameters - `dimension: "CLIENT_TYPE" or "USER_AGENT" or "REFERER" or 3 more` Specifies the attribute by which to group the results. - `"CLIENT_TYPE"` - `"USER_AGENT"` - `"REFERER"` - `"CRAWL_REFER_RATIO"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `botOperator: optional array of string` Filters results by bot operator. - `clientType: optional array of "HUMAN" or "NON_AI_BOT" or "AI_BOT" or "MIXED_PURPOSE"` Filters results by agent type. - `"HUMAN"` - `"NON_AI_BOT"` - `"AI_BOT"` - `"MIXED_PURPOSE"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `industry: optional array of string` Filters results by industry. - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `vertical: optional array of string` Filters results by vertical. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/bots/crawlers/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Web Crawler Summary Response - `WebCrawlerSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Web Crawler Timeseries Groups Response - `WebCrawlerTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Datasets ## List datasets **get** `/radar/datasets` Retrieves a list of datasets. ### Query Parameters - `datasetType: optional "RANKING_BUCKET" or "REPORT"` Filters results by dataset type. - `"RANKING_BUCKET"` - `"REPORT"` - `date: optional string` Filters results by the specified date. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { datasets }` - `datasets: array of object { id, description, meta, 3 more }` - `id: number` - `description: string` - `meta: unknown` - `tags: array of string` - `title: string` - `type: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/datasets \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "datasets": [ { "id": 3, "description": "This dataset contains a list of the op 20000 domains globally", "meta": {}, "tags": [ "global" ], "title": "Top bucket 20000 domains", "type": "RANKING_BUCKET" } ] }, "success": true } ``` ## Get dataset CSV stream **get** `/radar/datasets/{alias}` Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date. ### Path Parameters - `alias: string` Dataset alias or ID. ### Example ```http curl https://api.cloudflare.com/client/v4/radar/datasets/$ALIAS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` ## Get dataset download URL **post** `/radar/datasets/download` Retrieves an URL to download a single dataset. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Body Parameters - `datasetId: number` ### Returns - `result: object { dataset }` - `dataset: object { url }` - `url: string` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/datasets/download \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{ "datasetId": 3 }' ``` #### Response ```json { "result": { "dataset": { "url": "https://example.com/download" } } } ``` ## Domain Types ### Dataset List Response - `DatasetListResponse = object { datasets }` - `datasets: array of object { id, description, meta, 3 more }` - `id: number` - `description: string` - `meta: unknown` - `tags: array of string` - `title: string` - `type: string` ### Dataset Get Response - `DatasetGetResponse = string` ### Dataset Download Response - `DatasetDownloadResponse = object { dataset }` - `dataset: object { url }` - `url: string` # DNS ## Get DNS summary by dimension **get** `/radar/dns/summary/{dimension}` Retrieves the distribution of DNS queries by the specified dimension. ### Path Parameters - `dimension: "AS" or "CACHE_HIT" or "DNSSEC" or 11 more` Specifies the attribute by which to group the results. - `"AS"` - `"CACHE_HIT"` - `"DNSSEC"` - `"DNSSEC_AWARE"` - `"DNSSEC_E2E"` - `"IP_VERSION"` - `"LOCATION"` - `"MATCHING_ANSWER"` - `"PROTOCOL"` - `"QUERY_TYPE"` - `"RESPONSE_CODE"` - `"RESPONSE_TTL"` - `"TLD"` - `"TLD_DNS_MAGNITUDE"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `cacheHit: optional array of boolean` Filters results based on cache status. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"` Filters results based on DNSSEC (DNS Security Extensions) support. - `"INVALID"` - `"INSECURE"` - `"SECURE"` - `"OTHER"` - `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"` Filters results based on DNSSEC (DNS Security Extensions) client awareness. - `"SUPPORTED"` - `"NOT_SUPPORTED"` - `dnssecE2e: optional array of boolean` Filters results based on DNSSEC-validated answers by end-to-end security status. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `matchingAnswer: optional array of boolean` Filters results based on whether the queries have a matching answer. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more` Filters results by DNS response TTL. - `"LTE_1M"` - `"GT_1M_LTE_5M"` - `"GT_5M_LTE_15M"` - `"GT_15M_LTE_1H"` - `"GT_1H_LTE_1D"` - `"GT_1D_LTE_1W"` - `"GT_1W"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "50.168733", "IPv6": "25.084366" } }, "success": true } ``` ## Get DNS queries time series **get** `/radar/dns/timeseries` Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `cacheHit: optional array of boolean` Filters results based on cache status. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"` Filters results based on DNSSEC (DNS Security Extensions) support. - `"INVALID"` - `"INSECURE"` - `"SECURE"` - `"OTHER"` - `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"` Filters results based on DNSSEC (DNS Security Extensions) client awareness. - `"SUPPORTED"` - `"NOT_SUPPORTED"` - `dnssecE2e: optional array of boolean` Filters results based on DNSSEC-validated answers by end-to-end security status. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `matchingAnswer: optional array of boolean` Filters results based on whether the queries have a matching answer. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more` Filters results by DNS response TTL. - `"LTE_1M"` - `"GT_1M_LTE_5M"` - `"GT_5M_LTE_15M"` - `"GT_15M_LTE_1H"` - `"GT_1H_LTE_1D"` - `"GT_1D_LTE_1W"` - `"GT_1W"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get DNS time series grouped by dimension **get** `/radar/dns/timeseries_groups/{dimension}` Retrieves the distribution of DNS queries grouped by dimension over time. ### Path Parameters - `dimension: "AS" or "CACHE_HIT" or "DNSSEC" or 10 more` Specifies the attribute by which to group the results. - `"AS"` - `"CACHE_HIT"` - `"DNSSEC"` - `"DNSSEC_AWARE"` - `"DNSSEC_E2E"` - `"IP_VERSION"` - `"LOCATION"` - `"MATCHING_ANSWER"` - `"PROTOCOL"` - `"QUERY_TYPE"` - `"RESPONSE_CODE"` - `"RESPONSE_TTL"` - `"TLD"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `cacheHit: optional array of boolean` Filters results based on cache status. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"` Filters results based on DNSSEC (DNS Security Extensions) support. - `"INVALID"` - `"INSECURE"` - `"SECURE"` - `"OTHER"` - `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"` Filters results based on DNSSEC (DNS Security Extensions) client awareness. - `"SUPPORTED"` - `"NOT_SUPPORTED"` - `dnssecE2e: optional array of boolean` Filters results based on DNSSEC-validated answers by end-to-end security status. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `matchingAnswer: optional array of boolean` Filters results based on whether the queries have a matching answer. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more` Filters results by DNS response TTL. - `"LTE_1M"` - `"GT_1M_LTE_5M"` - `"GT_5M_LTE_15M"` - `"GT_15M_LTE_1H"` - `"GT_1H_LTE_1D"` - `"GT_1D_LTE_1W"` - `"GT_1W"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### DNS Summary V2 Response - `DNSSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### DNS Timeseries Response - `DNSTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### DNS Timeseries Groups V2 Response - `DNSTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Top ## Get top ASes by DNS queries **get** `/radar/dns/top/ases` Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `cacheHit: optional array of boolean` Filters results based on cache status. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"` Filters results based on DNSSEC (DNS Security Extensions) support. - `"INVALID"` - `"INSECURE"` - `"SECURE"` - `"OTHER"` - `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"` Filters results based on DNSSEC (DNS Security Extensions) client awareness. - `"SUPPORTED"` - `"NOT_SUPPORTED"` - `dnssecE2e: optional array of boolean` Filters results based on DNSSEC-validated answers by end-to-end security status. - `domain: optional array of string` Filters results by domain name. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `matchingAnswer: optional array of boolean` Filters results based on whether the queries have a matching answer. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more` Filters results by DNS response TTL. - `"LTE_1M"` - `"GT_1M_LTE_5M"` - `"GT_5M_LTE_15M"` - `"GT_15M_LTE_1H"` - `"GT_1H_LTE_1D"` - `"GT_1D_LTE_1W"` - `"GT_1W"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/top/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Get top locations by DNS queries **get** `/radar/dns/top/locations` Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `cacheHit: optional array of boolean` Filters results based on cache status. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"` Filters results based on DNSSEC (DNS Security Extensions) support. - `"INVALID"` - `"INSECURE"` - `"SECURE"` - `"OTHER"` - `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"` Filters results based on DNSSEC (DNS Security Extensions) client awareness. - `"SUPPORTED"` - `"NOT_SUPPORTED"` - `dnssecE2e: optional array of boolean` Filters results based on DNSSEC-validated answers by end-to-end security status. - `domain: optional array of string` Filters results by domain name. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `matchingAnswer: optional array of boolean` Filters results based on whether the queries have a matching answer. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more` Filters results by DNS response TTL. - `"LTE_1M"` - `"GT_1M_LTE_5M"` - `"GT_5M_LTE_15M"` - `"GT_15M_LTE_1H"` - `"GT_1H_LTE_1D"` - `"GT_1D_LTE_1W"` - `"GT_1W"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/top/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Top Ases Response - `TopAsesResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. ### Top Locations Response - `TopLocationsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Summary ## Get DNS queries by cache status summary **get** `/radar/dns/summary/cache_hit` Retrieves the distribution of DNS queries by cache status. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/cache_hit \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NEGATIVE": "10", "POSITIVE": "10" } }, "success": true } ``` ## Get DNS queries by DNSSEC support summary **get** `/radar/dns/summary/dnssec` Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { INSECURE, INVALID, OTHER, SECURE }` - `INSECURE: string` A numeric string. - `INVALID: string` A numeric string. - `OTHER: string` A numeric string. - `SECURE: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "INSECURE": "10", "INVALID": "10", "OTHER": "10", "SECURE": "10" } }, "success": true } ``` ## Get DNS queries by DNSSEC awareness summary **get** `/radar/dns/summary/dnssec_aware` Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec_aware \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SUPPORTED": "10", "SUPPORTED": "10" } }, "success": true } ``` ## Get DNS queries by DNSSEC end-to-end summary **get** `/radar/dns/summary/dnssec_e2e` Retrieves the distribution of DNSSEC-validated answers by end-to-end security status. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec_e2e \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NEGATIVE": "10", "POSITIVE": "10" } }, "success": true } ``` ## Get DNS queries by IP version summary **get** `/radar/dns/summary/ip_version` Retrieves the distribution of DNS queries by IP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "10", "IPv6": "10" } }, "success": true } ``` ## Get DNS queries by matching answer summary **get** `/radar/dns/summary/matching_answer` Retrieves the distribution of DNS queries by matching answers. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/matching_answer \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NEGATIVE": "10", "POSITIVE": "10" } }, "success": true } ``` ## Get DNS queries by protocol summary **get** `/radar/dns/summary/protocol` Retrieves the distribution of DNS queries by DNS transport protocol. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: string` A numeric string. - `TCP: string` A numeric string. - `TLS: string` A numeric string. - `UDP: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTPS": "10", "TCP": "10", "TLS": "10", "UDP": "10" } }, "success": true } ``` ## Get DNS queries by type summary **get** `/radar/dns/summary/query_type` Retrieves the distribution of DNS queries by type. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/query_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "A": "20", "AAAA": "20", "HTTPS": "20", "NS": "20", "PTR": "20" } }, "success": true } ``` ## Get DNS queries by response code summary **get** `/radar/dns/summary/response_code` Retrieves the distribution of DNS queries by response code. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/response_code \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOERROR": "70", "NOTIMP": "5", "NXDOMAIN": "10", "REFUSED": "5", "SERVFAIL": "5" } }, "success": true } ``` ## Get DNS queries by response TTL summary **get** `/radar/dns/summary/response_ttl` Retrieves the distribution of DNS queries by minimum response TTL. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }` - `gt_15m_lte_1h: string` A numeric string. - `gt_1d_lte_1w: string` A numeric string. - `gt_1h_lte_1d: string` A numeric string. - `gt_1m_lte_5m: string` A numeric string. - `gt_1w: string` A numeric string. - `gt_5m_lte_15m: string` A numeric string. - `lte_1m: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/summary/response_ttl \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "gt_15m_lte_1h": "10", "gt_1d_lte_1w": "10", "gt_1h_lte_1d": "10", "gt_1m_lte_5m": "10", "gt_1w": "10", "gt_5m_lte_15m": "10", "lte_1m": "10" } }, "success": true } ``` ## Domain Types ### Summary Cache Hit Response - `SummaryCacheHitResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. ### Summary DNSSEC Response - `SummaryDNSSECResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { INSECURE, INVALID, OTHER, SECURE }` - `INSECURE: string` A numeric string. - `INVALID: string` A numeric string. - `OTHER: string` A numeric string. - `SECURE: string` A numeric string. ### Summary DNSSEC Aware Response - `SummaryDNSSECAwareResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. ### Summary DNSSEC E2E Response - `SummaryDNSSECE2EResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. ### Summary Matching Answer Response - `SummaryMatchingAnswerResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: string` A numeric string. - `POSITIVE: string` A numeric string. ### Summary Protocol Response - `SummaryProtocolResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: string` A numeric string. - `TCP: string` A numeric string. - `TLS: string` A numeric string. - `UDP: string` A numeric string. ### Summary Query Type Response - `SummaryQueryTypeResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Response Code Response - `SummaryResponseCodeResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Response TTL Response - `SummaryResponseTTLResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }` - `gt_15m_lte_1h: string` A numeric string. - `gt_1d_lte_1w: string` A numeric string. - `gt_1h_lte_1d: string` A numeric string. - `gt_1m_lte_5m: string` A numeric string. - `gt_1w: string` A numeric string. - `gt_5m_lte_15m: string` A numeric string. - `lte_1m: string` A numeric string. # Timeseries Groups ## Get DNS queries by cache status time series **get** `/radar/dns/timeseries_groups/cache_hit` Retrieves the distribution of DNS queries by cache status over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/cache_hit \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NEGATIVE": [ "10" ], "POSITIVE": [ "10" ] } }, "success": true } ``` ## Get DNS queries by DNSSEC support time series **get** `/radar/dns/timeseries_groups/dnssec` Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { INSECURE, INVALID, OTHER, SECURE }` - `INSECURE: array of string` - `INVALID: array of string` - `OTHER: array of string` - `SECURE: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "INSECURE": [ "10" ], "INVALID": [ "10" ], "OTHER": [ "10" ], "SECURE": [ "10" ] } }, "success": true } ``` ## Get DNS queries by DNSSEC awareness time series **get** `/radar/dns/timeseries_groups/dnssec_aware` Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec_aware \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SUPPORTED": [ "10" ], "SUPPORTED": [ "10" ] } }, "success": true } ``` ## Get DNS queries by DNSSEC end-to-end time series **get** `/radar/dns/timeseries_groups/dnssec_e2e` Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec_e2e \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NEGATIVE": [ "10" ], "POSITIVE": [ "10" ] } }, "success": true } ``` ## Get DNS queries by IP version time series **get** `/radar/dns/timeseries_groups/ip_version` Retrieves the distribution of DNS queries by IP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ] } }, "success": true } ``` ## Get DNS queries by matching answer time series **get** `/radar/dns/timeseries_groups/matching_answer` Retrieves the distribution of DNS queries by matching answers over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/matching_answer \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NEGATIVE": [ "10" ], "POSITIVE": [ "10" ] } }, "success": true } ``` ## Get DNS queries by protocol time series **get** `/radar/dns/timeseries_groups/protocol` Retrieves the distribution of DNS queries by DNS transport protocol over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: array of string` - `TCP: array of string` - `TLS: array of string` - `UDP: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "HTTPS": [ "10" ], "TCP": [ "10" ], "TLS": [ "10" ], "UDP": [ "10" ] } }, "success": true } ``` ## Get DNS queries by type time series **get** `/radar/dns/timeseries_groups/query_type` Retrieves the distribution of DNS queries by type over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/query_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get DNS queries by response code time series **get** `/radar/dns/timeseries_groups/response_code` Retrieves the distribution of DNS queries by response code over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/response_code \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get DNS queries by response TTL time series **get** `/radar/dns/timeseries_groups/response_ttl` Retrieves the distribution of DNS queries by minimum answer TTL over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `nodata: optional array of boolean` Specifies whether the response includes empty DNS responses (NODATA). - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` - `tld: optional array of string` Filters results by top-level domain. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }` - `gt_15m_lte_1h: array of string` - `gt_1d_lte_1w: array of string` - `gt_1h_lte_1d: array of string` - `gt_1m_lte_5m: array of string` - `gt_1w: array of string` - `gt_5m_lte_15m: array of string` - `lte_1m: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/response_ttl \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "gt_15m_lte_1h": [ "10" ], "gt_1d_lte_1w": [ "10" ], "gt_1h_lte_1d": [ "10" ], "gt_1m_lte_5m": [ "10" ], "gt_1w": [ "10" ], "gt_5m_lte_15m": [ "10" ], "lte_1m": [ "10" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Cache Hit Response - `TimeseriesGroupCacheHitResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` ### Timeseries Group DNSSEC Response - `TimeseriesGroupDNSSECResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { INSECURE, INVALID, OTHER, SECURE }` - `INSECURE: array of string` - `INVALID: array of string` - `OTHER: array of string` - `SECURE: array of string` ### Timeseries Group DNSSEC Aware Response - `TimeseriesGroupDNSSECAwareResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` ### Timeseries Group DNSSEC E2E Response - `TimeseriesGroupDNSSECE2EResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` ### Timeseries Group Matching Answer Response - `TimeseriesGroupMatchingAnswerResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NEGATIVE, POSITIVE }` - `NEGATIVE: array of string` - `POSITIVE: array of string` ### Timeseries Group Protocol Response - `TimeseriesGroupProtocolResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: array of string` - `TCP: array of string` - `TLS: array of string` - `UDP: array of string` ### Timeseries Group Query Type Response - `TimeseriesGroupQueryTypeResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Response Code Response - `TimeseriesGroupResponseCodeResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Response TTL Response - `TimeseriesGroupResponseTTLResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }` - `gt_15m_lte_1h: array of string` - `gt_1d_lte_1w: array of string` - `gt_1h_lte_1d: array of string` - `gt_1m_lte_5m: array of string` - `gt_1w: array of string` - `gt_5m_lte_15m: array of string` - `lte_1m: array of string` # NetFlows ## Get network traffic time series **get** `/radar/netflows/timeseries` Retrieves network traffic (NetFlows) over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` - `product: optional array of "HTTP" or "ALL"` Filters the results by network traffic product types. - `"HTTP"` - `"ALL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "values": [ "10" ] } }, "success": true } ``` ## Get network traffic summary **get** `/radar/netflows/summary` Retrieves the distribution of network traffic (NetFlows) by HTTP vs other protocols. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTP, OTHER }` - `HTTP: string` A numeric string. - `OTHER: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/summary \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP": "10", "OTHER": "10" } }, "success": true } ``` ## Get network traffic distribution by dimension **get** `/radar/netflows/summary/{dimension}` Retrieves the distribution of network traffic (NetFlows) by the specified dimension. ### Path Parameters - `dimension: "ADM1" or "AS" or "LOCATION" or "PRODUCT"` Specifies the NetFlows attribute by which to group the results. - `"ADM1"` - `"AS"` - `"LOCATION"` - `"PRODUCT"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `product: optional array of "HTTP" or "ALL"` Filters the results by network traffic product types. - `"HTTP"` - `"ALL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Germany": "25.084366", "United States": "50.168733" } }, "success": true } ``` ## Get time series distribution of network traffic by dimension **get** `/radar/netflows/timeseries_groups/{dimension}` Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. ### Path Parameters - `dimension: "ADM1" or "AS" or "LOCATION" or "PRODUCT"` Specifies the NetFlows attribute by which to group the results. - `"ADM1"` - `"AS"` - `"LOCATION"` - `"PRODUCT"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `product: optional array of "HTTP" or "ALL"` Filters the results by network traffic product types. - `"HTTP"` - `"ALL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### NetFlows Timeseries Response - `NetFlowsTimeseriesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` ### NetFlows Summary Response - `NetFlowsSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTP, OTHER }` - `HTTP: string` A numeric string. - `OTHER: string` A numeric string. ### NetFlows Summary V2 Response - `NetFlowsSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### NetFlows Timeseries Groups Response - `NetFlowsTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Top ## Get top ASes by network traffic **get** `/radar/netflows/top/ases` Retrieves the top autonomous systems by network traffic (NetFlows). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/top/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 16509, "clientASName": "AMAZON-02", "value": "10" } ] }, "success": true } ``` ## Get top locations by network traffic **get** `/radar/netflows/top/locations` Retrieves the top locations by network traffic (NetFlows). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/netflows/top/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "US", "clientCountryName": "United States", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Top Ases Response - `TopAsesResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. ### Top Locations Response - `TopLocationsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Post Quantum # Origin ## Get Origin Post-Quantum Data Summary **get** `/radar/post_quantum/origin/summary/{dimension}` Returns a summary of origin post-quantum data grouped by the specified dimension. ### Path Parameters - `dimension: "KEY_AGREEMENT"` Specifies the origin post-quantum data dimension by which to group the results. - `"KEY_AGREEMENT"` ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/post_quantum/origin/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "CurveP256": "99.1234", "CurveP384": "85.5678", "CurveP521": "45.9012", "X25519": "98.3456", "X25519MLKEM768": "12.7890" } }, "success": true } ``` ## Get Origin Post-Quantum Data Over Time **get** `/radar/post_quantum/origin/timeseries_groups/{dimension}` Returns a timeseries of origin post-quantum data grouped by the specified dimension. ### Path Parameters - `dimension: "KEY_AGREEMENT"` Specifies the origin post-quantum data dimension by which to group the results. - `"KEY_AGREEMENT"` ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/post_quantum/origin/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Origin Summary Response - `OriginSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Origin Timeseries Groups Response - `OriginTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # TLS ## Check Post-Quantum TLS support **get** `/radar/post_quantum/tls/support` Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm and whether it uses PQ cryptography. ### Query Parameters - `host: string` Hostname or IP address to test for Post-Quantum TLS support, optionally with port (defaults to 443). ### Returns - `result: object { host, kex, kexName, pq }` - `host: string` The host that was tested - `kex: number` TLS CurveID of the negotiated key exchange - `kexName: string` Human-readable name of the key exchange algorithm - `pq: boolean` Whether the negotiated key exchange uses Post-Quantum cryptography - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/post_quantum/tls/support \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "host": "host", "kex": 0, "kexName": "kexName", "pq": true }, "success": true } ``` ## Domain Types ### TLS Support Response - `TLSSupportResponse = object { host, kex, kexName, pq }` - `host: string` The host that was tested - `kex: number` TLS CurveID of the negotiated key exchange - `kexName: string` Human-readable name of the key exchange algorithm - `pq: boolean` Whether the negotiated key exchange uses Post-Quantum cryptography # Search ## Search for locations, ASes, reports, and more **get** `/radar/search/global` Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). ### Query Parameters - `query: string` String used to perform the search operation. - `exclude: optional array of "ADM1S" or "ASNS" or "BOTS" or 9 more` Search types excluded from results. - `"ADM1S"` - `"ASNS"` - `"BOTS"` - `"CERTIFICATE_AUTHORITIES"` - `"CERTIFICATE_LOGS"` - `"ORIGINS"` - `"ORIGIN_REGIONS"` - `"INDUSTRIES"` - `"LOCATIONS"` - `"NOTEBOOKS"` - `"TLDS"` - `"VERTICALS"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `include: optional array of "ADM1S" or "ASNS" or "BOTS" or 9 more` Search types included in results. - `"ADM1S"` - `"ASNS"` - `"BOTS"` - `"CERTIFICATE_AUTHORITIES"` - `"CERTIFICATE_LOGS"` - `"ORIGINS"` - `"ORIGIN_REGIONS"` - `"INDUSTRIES"` - `"LOCATIONS"` - `"NOTEBOOKS"` - `"TLDS"` - `"VERTICALS"` - `limit: optional number` Limits the number of objects returned in the response. - `limitPerGroup: optional number` Limits the number of objects per search category. ### Returns - `result: object { search }` - `search: array of object { code, name, type }` - `code: string` - `name: string` - `type: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/search/global \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "search": [ { "code": "13335", "name": "Cloudflare", "type": "asn" } ] }, "success": true } ``` ## Domain Types ### Search Global Response - `SearchGlobalResponse = object { search }` - `search: array of object { code, name, type }` - `code: string` - `name: string` - `type: string` # Verified Bots # Top ## Get top verified bots by HTTP requests **get** `/radar/verified_bots/top/bots` Retrieves the top verified bots by HTTP requests, with owner and category. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { botCategory, botName, botOwner, value }` - `botCategory: string` - `botName: string` - `botOwner: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/verified_bots/top/bots \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "botCategory": "Search Engine Crawler", "botName": "GoogleBot", "botOwner": "Google", "value": "10" } ] }, "success": true } ``` ## Get top verified bot categories by HTTP requests **get** `/radar/verified_bots/top/categories` Retrieves the top verified bot categories by HTTP requests, along with their corresponding percentage, over the total verified bot HTTP requests. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { botCategory, value }` - `botCategory: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/verified_bots/top/categories \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "botCategory": "Search", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Top Bots Response - `TopBotsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { botCategory, botName, botOwner, value }` - `botCategory: string` - `botName: string` - `botOwner: string` - `value: string` A numeric string. ### Top Categories Response - `TopCategoriesResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { botCategory, value }` - `botCategory: string` - `value: string` A numeric string. # AS112 ## Get AS112 DNS queries time series **get** `/radar/as112/timeseries` Retrieves the AS112 DNS queries over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get AS112 summary by dimension **get** `/radar/as112/summary/{dimension}` Retrieves the distribution of AS112 queries by the specified dimension. ### Path Parameters - `dimension: "DNSSEC" or "EDNS" or "IP_VERSION" or 3 more` Specifies the attribute by which to group the results. - `"DNSSEC"` - `"EDNS"` - `"IP_VERSION"` - `"PROTOCOL"` - `"QUERY_TYPE"` - `"RESPONSE_CODE"` ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "50.168733", "IPv6": "25.084366" } }, "success": true } ``` ## Get AS112 time series grouped by dimension **get** `/radar/as112/timeseries_groups/{dimension}` Retrieves the distribution of AS112 queries grouped by dimension over time. ### Path Parameters - `dimension: "DNSSEC" or "EDNS" or "IP_VERSION" or 3 more` Specifies the attribute by which to group the results. - `"DNSSEC"` - `"EDNS"` - `"IP_VERSION"` - `"PROTOCOL"` - `"QUERY_TYPE"` - `"RESPONSE_CODE"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### AS112 Timeseries Response - `AS112TimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### AS112 Summary V2 Response - `AS112SummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### AS112 Timeseries Groups V2 Response - `AS112TimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get AS112 DNS queries by DNSSEC summary **get** `/radar/as112/summary/dnssec` Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/dnssec \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SUPPORTED": "10", "SUPPORTED": "10" } }, "success": true } ``` ## Get AS112 DNS queries by EDNS summary **get** `/radar/as112/summary/edns` Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/edns \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SUPPORTED": "10", "SUPPORTED": "10" } }, "success": true } ``` ## Get AS112 DNS queries by IP version summary **get** `/radar/as112/summary/ip_version` Retrieves the distribution of DNS queries to AS112 by IP version. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "10", "IPv6": "10" } }, "success": true } ``` ## Get AS112 DNS queries by DNS protocol summary **get** `/radar/as112/summary/protocol` Retrieves the distribution of DNS queries to AS112 by protocol. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: string` A numeric string. - `TCP: string` A numeric string. - `TLS: string` A numeric string. - `UDP: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTPS": "10", "TCP": "10", "TLS": "10", "UDP": "10" } }, "success": true } ``` ## Get AS112 DNS queries by type summary **get** `/radar/as112/summary/query_type` Retrieves the distribution of DNS queries to AS112 by type. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/query_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "A": "19", "AAAA": "1", "PTR": "74", "SOA": "5", "SRV": "1" } }, "success": true } ``` ## Get AS112 DNS queries by response code summary **get** `/radar/as112/summary/response_codes` Retrieves the distribution of AS112 DNS requests classified by response code. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/summary/response_codes \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOERROR": "70", "NOTIMP": "5", "NXDOMAIN": "10", "REFUSED": "5", "SERVFAIL": "5" } }, "success": true } ``` ## Domain Types ### Summary DNSSEC Response - `SummaryDNSSECResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. ### Summary Edns Response - `SummaryEdnsResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. ### Summary Protocol Response - `SummaryProtocolResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: string` A numeric string. - `TCP: string` A numeric string. - `TLS: string` A numeric string. - `UDP: string` A numeric string. ### Summary Query Type Response - `SummaryQueryTypeResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Response Codes Response - `SummaryResponseCodesResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups ## Get AS112 DNS queries by DNS protocol time series **get** `/radar/as112/timeseries_groups/protocol` Retrieves the distribution of AS112 DNS requests classified by protocol over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: array of string` - `TCP: array of string` - `TLS: array of string` - `UDP: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "HTTPS": [ "10" ], "TCP": [ "10" ], "TLS": [ "10" ], "UDP": [ "10" ] } }, "success": true } ``` ## Get AS112 DNS queries by type time series **get** `/radar/as112/timeseries_groups/query_type` Retrieves the distribution of AS112 DNS queries by type over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/query_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get AS112 DNS queries by response code time series **get** `/radar/as112/timeseries_groups/response_codes` Retrieves the distribution of AS112 DNS requests classified by response code over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/response_codes \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get AS112 DNS queries by DNSSEC support time series **get** `/radar/as112/timeseries_groups/dnssec` Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/dnssec \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SUPPORTED": [ "10" ], "SUPPORTED": [ "10" ] } }, "success": true } ``` ## Get AS112 DNS queries by EDNS support summary **get** `/radar/as112/timeseries_groups/edns` Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS) support over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/edns \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SUPPORTED": [ "10" ], "SUPPORTED": [ "10" ] } }, "success": true } ``` ## Get AS112 DNS queries by IP version time series **get** `/radar/as112/timeseries_groups/ip_version` Retrieves the distribution of AS112 DNS queries by IP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"` Filters results by DNS transport protocol. - `"UDP"` - `"TCP"` - `"HTTPS"` - `"TLS"` - `queryType: optional array of "A" or "AAAA" or "A6" or 85 more` Filters results by DNS query type. - `"A"` - `"AAAA"` - `"A6"` - `"AFSDB"` - `"ANY"` - `"APL"` - `"ATMA"` - `"AXFR"` - `"CAA"` - `"CDNSKEY"` - `"CDS"` - `"CERT"` - `"CNAME"` - `"CSYNC"` - `"DHCID"` - `"DLV"` - `"DNAME"` - `"DNSKEY"` - `"DOA"` - `"DS"` - `"EID"` - `"EUI48"` - `"EUI64"` - `"GPOS"` - `"GID"` - `"HINFO"` - `"HIP"` - `"HTTPS"` - `"IPSECKEY"` - `"ISDN"` - `"IXFR"` - `"KEY"` - `"KX"` - `"L32"` - `"L64"` - `"LOC"` - `"LP"` - `"MAILA"` - `"MAILB"` - `"MB"` - `"MD"` - `"MF"` - `"MG"` - `"MINFO"` - `"MR"` - `"MX"` - `"NAPTR"` - `"NB"` - `"NBSTAT"` - `"NID"` - `"NIMLOC"` - `"NINFO"` - `"NS"` - `"NSAP"` - `"NSEC"` - `"NSEC3"` - `"NSEC3PARAM"` - `"NULL"` - `"NXT"` - `"OPENPGPKEY"` - `"OPT"` - `"PTR"` - `"PX"` - `"RKEY"` - `"RP"` - `"RRSIG"` - `"RT"` - `"SIG"` - `"SINK"` - `"SMIMEA"` - `"SOA"` - `"SPF"` - `"SRV"` - `"SSHFP"` - `"SVCB"` - `"TA"` - `"TALINK"` - `"TKEY"` - `"TLSA"` - `"TSIG"` - `"TXT"` - `"UINFO"` - `"UID"` - `"UNSPEC"` - `"URI"` - `"WKS"` - `"X25"` - `"ZONEMD"` - `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more` Filters results by DNS response code. - `"NOERROR"` - `"FORMERR"` - `"SERVFAIL"` - `"NXDOMAIN"` - `"NOTIMP"` - `"REFUSED"` - `"YXDOMAIN"` - `"YXRRSET"` - `"NXRRSET"` - `"NOTAUTH"` - `"NOTZONE"` - `"BADSIG"` - `"BADKEY"` - `"BADTIME"` - `"BADMODE"` - `"BADNAME"` - `"BADALG"` - `"BADTRUNC"` - `"BADCOOKIE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Protocol Response - `TimeseriesGroupProtocolResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { HTTPS, TCP, TLS, UDP }` - `HTTPS: array of string` - `TCP: array of string` - `TLS: array of string` - `UDP: array of string` ### Timeseries Group Query Type Response - `TimeseriesGroupQueryTypeResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Response Codes Response - `TimeseriesGroupResponseCodesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group DNSSEC Response - `TimeseriesGroupDNSSECResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` ### Timeseries Group Edns Response - `TimeseriesGroupEdnsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` # Top ## Get top locations by AS112 DNS queries **get** `/radar/as112/top/locations` Retrieves the top locations by AS112 DNS queries. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/top/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Get top locations by AS112 DNS queries with DNSSEC support **get** `/radar/as112/top/locations/dnssec/{dnssec}` Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. ### Path Parameters - `dnssec: "SUPPORTED" or "NOT_SUPPORTED"` DNSSEC (DNS Security Extensions) status. - `"SUPPORTED"` - `"NOT_SUPPORTED"` ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/top/locations/dnssec/$DNSSEC \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Get top locations by AS112 DNS queries with EDNS support **get** `/radar/as112/top/locations/edns/{edns}` Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. ### Path Parameters - `edns: "SUPPORTED" or "NOT_SUPPORTED"` EDNS (Extension Mechanisms for DNS) status. - `"SUPPORTED"` - `"NOT_SUPPORTED"` ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/top/locations/edns/$EDNS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Get top locations by AS112 DNS queries for an IP version **get** `/radar/as112/top/locations/ip_version/{ip_version}` Retrieves the top locations of DNS queries to AS112 for an IP version. ### Path Parameters - `ip_version: "IPv4" or "IPv6"` IP version. - `"IPv4"` - `"IPv6"` ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/as112/top/locations/ip_version/$IP_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Top Locations Response - `TopLocationsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. ### Top DNSSEC Response - `TopDNSSECResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. ### Top Edns Response - `TopEdnsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. ### Top IP Version Response - `TopIPVersionResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Email ## Domain Types ### Radar Email Series - `RadarEmailSeries = object { FAIL, NONE, PASS }` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Radar Email Summary - `RadarEmailSummary = object { FAIL, NONE, PASS }` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. # Routing ## Get email routing summary by dimension **get** `/radar/email/routing/summary/{dimension}` Retrieves the distribution of email routing metrics by the specified dimension. ### Path Parameters - `dimension: "IP_VERSION" or "ENCRYPTED" or "ARC" or 3 more` Specifies the attribute by which to group the results. - `"IP_VERSION"` - `"ENCRYPTED"` - `"ARC"` - `"DKIM"` - `"DMARC"` - `"SPF"` ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "25.084366", "PASS": "50.168733" } }, "success": true } ``` ## Get email routing time series grouped by dimension **get** `/radar/email/routing/timeseries_groups/{dimension}` Retrieves the distribution of email routing metrics grouped by dimension over time. ### Path Parameters - `dimension: "IP_VERSION" or "ENCRYPTED" or "ARC" or 3 more` Specifies the attribute by which to group the results. - `"IP_VERSION"` - `"ENCRYPTED"` - `"ARC"` - `"DKIM"` - `"DMARC"` - `"SPF"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Routing Summary V2 Response - `RoutingSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Routing Timeseries Groups V2 Response - `RoutingTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get email ARC validation summary **get** `/radar/email/routing/summary/arc` Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/arc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email DKIM validation summary **get** `/radar/email/routing/summary/dkim` Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/dkim \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email DMARC validation summary **get** `/radar/email/routing/summary/dmarc` Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/dmarc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email encryption status summary **get** `/radar/email/routing/summary/encrypted` Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted). ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { ENCRYPTED, NOT_ENCRYPTED }` - `ENCRYPTED: string` A numeric string. - `NOT_ENCRYPTED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/encrypted \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "ENCRYPTED": "10", "NOT_ENCRYPTED": "10" } }, "success": true } ``` ## Get email IP version summary **get** `/radar/email/routing/summary/ip_version` Retrieves the distribution of emails by IP version. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "10", "IPv6": "10" } }, "success": true } ``` ## Get email SPF validation summary **get** `/radar/email/routing/summary/spf` Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/summary/spf \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Domain Types ### Summary ARC Response - `SummaryARCResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary DKIM Response - `SummaryDKIMResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary DMARC Response - `SummaryDMARCResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary Encrypted Response - `SummaryEncryptedResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { ENCRYPTED, NOT_ENCRYPTED }` - `ENCRYPTED: string` A numeric string. - `NOT_ENCRYPTED: string` A numeric string. ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. ### Summary SPF Response - `SummarySPFResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. # Timeseries Groups ## Get email ARC validation time series **get** `/radar/email/routing/timeseries_groups/arc` Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/arc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email DKIM validation time series **get** `/radar/email/routing/timeseries_groups/dkim` Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/dkim \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email DMARC validation time series **get** `/radar/email/routing/timeseries_groups/dmarc` Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/dmarc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email encryption status time series **get** `/radar/email/routing/timeseries_groups/encrypted` Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted) over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { ENCRYPTED, NOT_ENCRYPTED }` - `ENCRYPTED: array of string` - `NOT_ENCRYPTED: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/encrypted \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "ENCRYPTED": [ "10" ], "NOT_ENCRYPTED": [ "10" ] } }, "success": true } ``` ## Get email IP version time series **get** `/radar/email/routing/timeseries_groups/ip_version` Retrieves the distribution of emails by IP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ] } }, "success": true } ``` ## Get email SPF validation time series **get** `/radar/email/routing/timeseries_groups/spf` Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `encrypted: optional array of "ENCRYPTED" or "NOT_ENCRYPTED"` Filters results by encryption status (encrypted vs. not-encrypted). - `"ENCRYPTED"` - `"NOT_ENCRYPTED"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/routing/timeseries_groups/spf \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group ARC Response - `TimeseriesGroupARCResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group DKIM Response - `TimeseriesGroupDKIMResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group DMARC Response - `TimeseriesGroupDMARCResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group Encrypted Response - `TimeseriesGroupEncryptedResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { ENCRYPTED, NOT_ENCRYPTED }` - `ENCRYPTED: array of string` - `NOT_ENCRYPTED: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6 }` - `IPv4: array of string` - `IPv6: array of string` ### Timeseries Group SPF Response - `TimeseriesGroupSPFResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` # Security ## Get email security summary by dimension **get** `/radar/email/security/summary/{dimension}` Retrieves the distribution of email security metrics by the specified dimension. ### Path Parameters - `dimension: "SPAM" or "MALICIOUS" or "SPOOF" or 6 more` Specifies the attribute by which to group the results. - `"SPAM"` - `"MALICIOUS"` - `"SPOOF"` - `"THREAT_CATEGORY"` - `"ARC"` - `"DKIM"` - `"DMARC"` - `"SPF"` - `"TLS_VERSION"` ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "25.084366", "PASS": "50.168733" } }, "success": true } ``` ## Get email security time series grouped by dimension **get** `/radar/email/security/timeseries_groups/{dimension}` Retrieves the distribution of email security metrics grouped by dimension over time. ### Path Parameters - `dimension: "SPAM" or "MALICIOUS" or "SPOOF" or 6 more` Specifies the attribute by which to group the results. - `"SPAM"` - `"MALICIOUS"` - `"SPOOF"` - `"THREAT_CATEGORY"` - `"ARC"` - `"DKIM"` - `"DMARC"` - `"SPF"` - `"TLS_VERSION"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Security Summary V2 Response - `SecuritySummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Security Timeseries Groups V2 Response - `SecurityTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Top # TLDs ## Get top TLDs by email message volume **get** `/radar/email/security/top/tlds` Retrieves the top TLDs by number of email messages. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tldCategory: optional "CLASSIC" or "COUNTRY"` Filters results by TLD category. - `"CLASSIC"` - `"COUNTRY"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/top/tlds \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "com.", "value": "10" } ] }, "success": true } ``` ## Domain Types ### TLD Get Response - `TLDGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. # Malicious ## Get top TLDs by email malicious classification **get** `/radar/email/security/top/tlds/malicious/{malicious}` Retrieves the top TLDs by emails classified as malicious or not. ### Path Parameters - `malicious: "MALICIOUS" or "NOT_MALICIOUS"` Malicious classification. - `"MALICIOUS"` - `"NOT_MALICIOUS"` ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tldCategory: optional "CLASSIC" or "COUNTRY"` Filters results by TLD category. - `"CLASSIC"` - `"COUNTRY"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/top/tlds/malicious/$MALICIOUS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "com.", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Malicious Get Response - `MaliciousGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. # Spam ## Get top TLDs by email spam classification **get** `/radar/email/security/top/tlds/spam/{spam}` Retrieves the top TLDs by emails classified as spam or not. ### Path Parameters - `spam: "SPAM" or "NOT_SPAM"` Spam classification. - `"SPAM"` - `"NOT_SPAM"` ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tldCategory: optional "CLASSIC" or "COUNTRY"` Filters results by TLD category. - `"CLASSIC"` - `"COUNTRY"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/top/tlds/spam/$SPAM \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "com.", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Spam Get Response - `SpamGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. # Spoof ## Get top TLDs by email spoof classification **get** `/radar/email/security/top/tlds/spoof/{spoof}` Retrieves the top TLDs by emails classified as spoof or not. ### Path Parameters - `spoof: "SPOOF" or "NOT_SPOOF"` Spoof classification. - `"SPOOF"` - `"NOT_SPOOF"` ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tldCategory: optional "CLASSIC" or "COUNTRY"` Filters results by TLD category. - `"CLASSIC"` - `"COUNTRY"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/top/tlds/spoof/$SPOOF \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "com.", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Spoof Get Response - `SpoofGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` A numeric string. # Summary ## Get email ARC validation summary **get** `/radar/email/security/summary/arc` Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/arc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email DKIM validation summary **get** `/radar/email/security/summary/dkim` Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/dkim \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email DMARC validation summary **get** `/radar/email/security/summary/dmarc` Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/dmarc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email malicious classification summary **get** `/radar/email/security/summary/malicious` Retrieves the distribution of emails by malicious classification. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { MALICIOUS, NOT_MALICIOUS }` - `MALICIOUS: string` A numeric string. - `NOT_MALICIOUS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/malicious \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "MALICIOUS": "10", "NOT_MALICIOUS": "10" } }, "success": true } ``` ## Get email spam classification summary **get** `/radar/email/security/summary/spam` Retrieves the proportion of emails by spam classification (spam vs. non-spam). ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SPAM, SPAM }` - `NOT_SPAM: string` A numeric string. - `SPAM: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/spam \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SPAM": "10", "SPAM": "10" } }, "success": true } ``` ## Get email SPF validation summary **get** `/radar/email/security/summary/spf` Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/spf \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "FAIL": "10", "NONE": "10", "PASS": "10" } }, "success": true } ``` ## Get email threat category summary **get** `/radar/email/security/summary/threat_category` Retrieves the distribution of emails by threat categories. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { BrandImpersonation, CredentialHarvester, IdentityDeception, Link }` - `BrandImpersonation: string` A numeric string. - `CredentialHarvester: string` A numeric string. - `IdentityDeception: string` A numeric string. - `Link: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/threat_category \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "BrandImpersonation": "10", "CredentialHarvester": "10", "IdentityDeception": "10", "Link": "10" } }, "success": true } ``` ## Get email spoof classification summary **get** `/radar/email/security/summary/spoof` Retrieves the proportion of emails by spoof classification (spoof vs. non-spoof). ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SPOOF, SPOOF }` - `NOT_SPOOF: string` A numeric string. - `SPOOF: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/spoof \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SPOOF": "10", "SPOOF": "10" } }, "success": true } ``` ## Get email TLS version summary **get** `/radar/email/security/summary/tls_version` Retrieves the distribution of emails by TLS version. ### Query Parameters - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3" }` - `"TLS 1.0": string` A numeric string. - `"TLS 1.1": string` A numeric string. - `"TLS 1.2": string` A numeric string. - `"TLS 1.3": string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/summary/tls_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "TLS 1.0": "10", "TLS 1.1": "10", "TLS 1.2": "10", "TLS 1.3": "10" } }, "success": true } ``` ## Domain Types ### Summary ARC Response - `SummaryARCResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary DKIM Response - `SummaryDKIMResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary DMARC Response - `SummaryDMARCResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary Malicious Response - `SummaryMaliciousResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { MALICIOUS, NOT_MALICIOUS }` - `MALICIOUS: string` A numeric string. - `NOT_MALICIOUS: string` A numeric string. ### Summary Spam Response - `SummarySpamResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SPAM, SPAM }` - `NOT_SPAM: string` A numeric string. - `SPAM: string` A numeric string. ### Summary SPF Response - `SummarySPFResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: RadarEmailSummary` - `FAIL: string` A numeric string. - `NONE: string` A numeric string. - `PASS: string` A numeric string. ### Summary Threat Category Response - `SummaryThreatCategoryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { BrandImpersonation, CredentialHarvester, IdentityDeception, Link }` - `BrandImpersonation: string` A numeric string. - `CredentialHarvester: string` A numeric string. - `IdentityDeception: string` A numeric string. - `Link: string` A numeric string. ### Summary Spoof Response - `SummarySpoofResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SPOOF, SPOOF }` - `NOT_SPOOF: string` A numeric string. - `SPOOF: string` A numeric string. ### Summary TLS Version Response - `SummaryTLSVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3" }` - `"TLS 1.0": string` A numeric string. - `"TLS 1.1": string` A numeric string. - `"TLS 1.2": string` A numeric string. - `"TLS 1.3": string` A numeric string. # Timeseries Groups ## Get email ARC validation time series **get** `/radar/email/security/timeseries_groups/arc` Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/arc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email DKIM validation time series **get** `/radar/email/security/timeseries_groups/dkim` Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/dkim \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email DMARC validation time series **get** `/radar/email/security/timeseries_groups/dmarc` Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/dmarc \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email malicious classification time series **get** `/radar/email/security/timeseries_groups/malicious` Retrieves the distribution of emails by malicious classification over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { MALICIOUS, NOT_MALICIOUS }` - `MALICIOUS: array of string` - `NOT_MALICIOUS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/malicious \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "MALICIOUS": [ "10" ], "NOT_MALICIOUS": [ "10" ] } }, "success": true } ``` ## Get email spam classification time series **get** `/radar/email/security/timeseries_groups/spam` Retrieves the distribution of emails by spam classification (spam vs. non-spam) over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SPAM, SPAM }` - `NOT_SPAM: array of string` - `SPAM: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/spam \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SPAM": [ "10" ], "SPAM": [ "10" ] } }, "success": true } ``` ## Get email SPF validation time series **get** `/radar/email/security/timeseries_groups/spf` Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/spf \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "FAIL": [ "10" ], "NONE": [ "10" ], "PASS": [ "10" ] } }, "success": true } ``` ## Get email threat category time series **get** `/radar/email/security/timeseries_groups/threat_category` Retrieves the distribution of emails by threat category over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { BrandImpersonation, CredentialHarvester, IdentityDeception, Link }` - `BrandImpersonation: array of string` - `CredentialHarvester: array of string` - `IdentityDeception: array of string` - `Link: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/threat_category \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "BrandImpersonation": [ "10" ], "CredentialHarvester": [ "10" ], "IdentityDeception": [ "10" ], "Link": [ "10" ] } }, "success": true } ``` ## Get email spoof classification time series **get** `/radar/email/security/timeseries_groups/spoof` Retrieves the distribution of emails by spoof classification (spoof vs. non-spoof) over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or "TLSv1_3"` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SPOOF, SPOOF }` - `NOT_SPOOF: array of string` - `SPOOF: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/spoof \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SPOOF": [ "10" ], "SPOOF": [ "10" ] } }, "success": true } ``` ## Get email TLS version time series **get** `/radar/email/security/timeseries_groups/tls_version` Retrieves the distribution of emails by TLS version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `arc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by ARC (Authenticated Received Chain) validation. - `"PASS"` - `"NONE"` - `"FAIL"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `dkim: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DKIM (DomainKeys Identified Mail) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `dmarc: optional array of "PASS" or "NONE" or "FAIL"` Filters results by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `spf: optional array of "PASS" or "NONE" or "FAIL"` Filters results by SPF (Sender Policy Framework) validation status. - `"PASS"` - `"NONE"` - `"FAIL"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3" }` - `"TLS 1.0": array of string` - `"TLS 1.1": array of string` - `"TLS 1.2": array of string` - `"TLS 1.3": array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/email/security/timeseries_groups/tls_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "TLS 1.0": [ "10" ], "TLS 1.1": [ "10" ], "TLS 1.2": [ "10" ], "TLS 1.3": [ "10" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group ARC Response - `TimeseriesGroupARCResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group DKIM Response - `TimeseriesGroupDKIMResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group DMARC Response - `TimeseriesGroupDMARCResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group Malicious Response - `TimeseriesGroupMaliciousResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { MALICIOUS, NOT_MALICIOUS }` - `MALICIOUS: array of string` - `NOT_MALICIOUS: array of string` ### Timeseries Group Spam Response - `TimeseriesGroupSpamResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SPAM, SPAM }` - `NOT_SPAM: array of string` - `SPAM: array of string` ### Timeseries Group SPF Response - `TimeseriesGroupSPFResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: RadarEmailSeries` - `FAIL: array of string` - `NONE: array of string` - `PASS: array of string` ### Timeseries Group Threat Category Response - `TimeseriesGroupThreatCategoryResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { BrandImpersonation, CredentialHarvester, IdentityDeception, Link }` - `BrandImpersonation: array of string` - `CredentialHarvester: array of string` - `IdentityDeception: array of string` - `Link: array of string` ### Timeseries Group Spoof Response - `TimeseriesGroupSpoofResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SPOOF, SPOOF }` - `NOT_SPOOF: array of string` - `SPOOF: array of string` ### Timeseries Group TLS Version Response - `TimeseriesGroupTLSVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3" }` - `"TLS 1.0": array of string` - `"TLS 1.1": array of string` - `"TLS 1.2": array of string` - `"TLS 1.3": array of string` # Attacks # Layer3 ## Get layer 3 attacks summary by dimension **get** `/radar/attacks/layer3/summary/{dimension}` Retrieves the distribution of layer 3 attacks by the specified dimension. ### Path Parameters - `dimension: "PROTOCOL" or "IP_VERSION" or "VECTOR" or 4 more` Specifies the attribute by which to group the results. - `"PROTOCOL"` - `"IP_VERSION"` - `"VECTOR"` - `"DURATION"` - `"BITRATE"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "TCP": "50.168733", "UDP": "25.084366" } }, "success": true } ``` ## Get layer 3 attacks by bytes time series **get** `/radar/attacks/layer3/timeseries` Retrieves layer 3 attacks over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `metric: optional "BYTES" or "BYTES_OLD"` Measurement units, eg. bytes. - `"BYTES"` - `"BYTES_OLD"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get layer 3 attacks time series grouped by dimension **get** `/radar/attacks/layer3/timeseries_groups/{dimension}` Retrieves the distribution of layer 3 attacks grouped by dimension over time. ### Path Parameters - `dimension: "PROTOCOL" or "IP_VERSION" or "VECTOR" or 4 more` Specifies the attribute by which to group the results. - `"PROTOCOL"` - `"IP_VERSION"` - `"VECTOR"` - `"DURATION"` - `"BITRATE"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Layer3 Summary V2 Response - `Layer3SummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Layer3 Timeseries Response - `Layer3TimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### Layer3 Timeseries Groups V2 Response - `Layer3TimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get layer 3 attacks by bitrate summary **get** `/radar/attacks/layer3/summary/bitrate` Retrieves the distribution of layer 3 attacks by bitrate. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { _1_GBPS_TO_10_GBPS, _10_GBPS_TO_100_GBPS, _500_MBPS_TO_1_GBPS, 2 more }` - `_1_GBPS_TO_10_GBPS: string` A numeric string. - `_10_GBPS_TO_100_GBPS: string` A numeric string. - `_500_MBPS_TO_1_GBPS: string` A numeric string. - `OVER_100_GBPS: string` A numeric string. - `UNDER_500_MBPS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/bitrate \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "_1_GBPS_TO_10_GBPS": "10", "_10_GBPS_TO_100_GBPS": "10", "_500_MBPS_TO_1_GBPS": "10", "OVER_100_GBPS": "10", "UNDER_500_MBPS": "10" } }, "success": true } ``` ## Get layer 3 attacks by duration summary **get** `/radar/attacks/layer3/summary/duration` Retrieves the distribution of layer 3 attacks by duration. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { _1_HOUR_TO_3_HOURS, _10_MINS_TO_20_MINS, _20_MINS_TO_40_MINS, 3 more }` - `_1_HOUR_TO_3_HOURS: string` A numeric string. - `_10_MINS_TO_20_MINS: string` A numeric string. - `_20_MINS_TO_40_MINS: string` A numeric string. - `_40_MINS_TO_1_HOUR: string` A numeric string. - `OVER_3_HOURS: string` A numeric string. - `UNDER_10_MINS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/duration \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "_1_HOUR_TO_3_HOURS": "10", "_10_MINS_TO_20_MINS": "10", "_20_MINS_TO_40_MINS": "10", "_40_MINS_TO_1_HOUR": "10", "OVER_3_HOURS": "10", "UNDER_10_MINS": "10" } }, "success": true } ``` ## Get layer 3 attacks by IP version summary **get** `/radar/attacks/layer3/summary/ip_version` Retrieves the distribution of layer 3 attacks by IP version. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "10", "IPv6": "10" } }, "success": true } ``` ## Get layer 3 attacks by protocol summary **get** `/radar/attacks/layer3/summary/protocol` Retrieves the distribution of layer 3 attacks by protocol. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { GRE, ICMP, TCP, UDP }` - `GRE: string` A numeric string. - `ICMP: string` A numeric string. - `TCP: string` A numeric string. - `UDP: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "GRE": "10", "ICMP": "10", "TCP": "10", "UDP": "10" } }, "success": true } ``` ## Get layer 3 attacks by vector summary **get** `/radar/attacks/layer3/summary/vector` Retrieves the distribution of layer 3 attacks by vector. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/vector \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "ACK Flood": "65.662148", "SYN Flood": "16.86401" } }, "success": true } ``` ## Get layer 3 attacks by targeted industry summary **get** `/radar/attacks/layer3/summary/industry` Retrieves the distribution of layer 3 attacks by targeted industry. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Computer Software": "65" } }, "success": true } ``` ## Get layer 3 attacks by targeted vertical summary **get** `/radar/attacks/layer3/summary/vertical` Retrieves the distribution of layer 3 attacks by targeted vertical. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/summary/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Internet and Telecom": "5.519081" } }, "success": true } ``` ## Domain Types ### Summary Bitrate Response - `SummaryBitrateResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { _1_GBPS_TO_10_GBPS, _10_GBPS_TO_100_GBPS, _500_MBPS_TO_1_GBPS, 2 more }` - `_1_GBPS_TO_10_GBPS: string` A numeric string. - `_10_GBPS_TO_100_GBPS: string` A numeric string. - `_500_MBPS_TO_1_GBPS: string` A numeric string. - `OVER_100_GBPS: string` A numeric string. - `UNDER_500_MBPS: string` A numeric string. ### Summary Duration Response - `SummaryDurationResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { _1_HOUR_TO_3_HOURS, _10_MINS_TO_20_MINS, _20_MINS_TO_40_MINS, 3 more }` - `_1_HOUR_TO_3_HOURS: string` A numeric string. - `_10_MINS_TO_20_MINS: string` A numeric string. - `_20_MINS_TO_40_MINS: string` A numeric string. - `_40_MINS_TO_1_HOUR: string` A numeric string. - `OVER_3_HOURS: string` A numeric string. - `UNDER_10_MINS: string` A numeric string. ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. ### Summary Protocol Response - `SummaryProtocolResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { GRE, ICMP, TCP, UDP }` - `GRE: string` A numeric string. - `ICMP: string` A numeric string. - `TCP: string` A numeric string. - `UDP: string` A numeric string. ### Summary Vector Response - `SummaryVectorResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Industry Response - `SummaryIndustryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Vertical Response - `SummaryVerticalResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups ## Get layer 3 attacks by target industries time series **get** `/radar/attacks/layer3/timeseries_groups/industry` Retrieves the distribution of layer 3 attacks by targeted industry over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 3 attacks by IP version time series **get** `/radar/attacks/layer3/timeseries_groups/ip_version` Retrieves the distribution of layer 3 attacks by IP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get layer 3 attacks by protocol time series **get** `/radar/attacks/layer3/timeseries_groups/protocol` Retrieves the distribution of layer 3 attacks by protocol over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { GRE, ICMP, TCP, 2 more }` - `GRE: array of string` - `ICMP: array of string` - `TCP: array of string` - `timestamps: array of string` - `UDP: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "GRE": [ "10" ], "ICMP": [ "10" ], "TCP": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ], "UDP": [ "10" ] } }, "success": true } ``` ## Get layer 3 attacks by vector time series **get** `/radar/attacks/layer3/timeseries_groups/vector` Retrieves the distribution of layer 3 attacks by vector over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/vector \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 3 attacks by vertical time series **get** `/radar/attacks/layer3/timeseries_groups/vertical` Retrieves the distribution of layer 3 attacks by targeted vertical over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 3 attacks by bitrate time series **get** `/radar/attacks/layer3/timeseries_groups/bitrate` Retrieves the distribution of layer 3 attacks by bitrate over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { _1_GBPS_TO_10_GBPS, _10_GBPS_TO_100_GBPS, _500_MBPS_TO_1_GBPS, 3 more }` - `_1_GBPS_TO_10_GBPS: array of string` - `_10_GBPS_TO_100_GBPS: array of string` - `_500_MBPS_TO_1_GBPS: array of string` - `OVER_100_GBPS: array of string` - `timestamps: array of string` - `UNDER_500_MBPS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/bitrate \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "_1_GBPS_TO_10_GBPS": [ "10" ], "_10_GBPS_TO_100_GBPS": [ "10" ], "_500_MBPS_TO_1_GBPS": [ "10" ], "OVER_100_GBPS": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ], "UNDER_500_MBPS": [ "10" ] } }, "success": true } ``` ## Get layer 3 attacks by duration time series **get** `/radar/attacks/layer3/timeseries_groups/duration` Retrieves the distribution of layer 3 attacks by duration over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `direction: optional "ORIGIN" or "TARGET"` Specifies whether the `location` filter applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { _1_HOUR_TO_3_HOURS, _10_MINS_TO_20_MINS, _20_MINS_TO_40_MINS, 4 more }` - `_1_HOUR_TO_3_HOURS: array of string` - `_10_MINS_TO_20_MINS: array of string` - `_20_MINS_TO_40_MINS: array of string` - `_40_MINS_TO_1_HOUR: array of string` - `OVER_3_HOURS: array of string` - `timestamps: array of string` - `UNDER_10_MINS: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/timeseries_groups/duration \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "_1_HOUR_TO_3_HOURS": [ "10" ], "_10_MINS_TO_20_MINS": [ "10" ], "_20_MINS_TO_40_MINS": [ "10" ], "_40_MINS_TO_1_HOUR": [ "10" ], "OVER_3_HOURS": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ], "UNDER_10_MINS": [ "10" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Industry Response - `TimeseriesGroupIndustryResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` ### Timeseries Group Protocol Response - `TimeseriesGroupProtocolResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { GRE, ICMP, TCP, 2 more }` - `GRE: array of string` - `ICMP: array of string` - `TCP: array of string` - `timestamps: array of string` - `UDP: array of string` ### Timeseries Group Vector Response - `TimeseriesGroupVectorResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Vertical Response - `TimeseriesGroupVerticalResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Bitrate Response - `TimeseriesGroupBitrateResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { _1_GBPS_TO_10_GBPS, _10_GBPS_TO_100_GBPS, _500_MBPS_TO_1_GBPS, 3 more }` - `_1_GBPS_TO_10_GBPS: array of string` - `_10_GBPS_TO_100_GBPS: array of string` - `_500_MBPS_TO_1_GBPS: array of string` - `OVER_100_GBPS: array of string` - `timestamps: array of string` - `UNDER_500_MBPS: array of string` ### Timeseries Group Duration Response - `TimeseriesGroupDurationResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { _1_HOUR_TO_3_HOURS, _10_MINS_TO_20_MINS, _20_MINS_TO_40_MINS, 4 more }` - `_1_HOUR_TO_3_HOURS: array of string` - `_10_MINS_TO_20_MINS: array of string` - `_20_MINS_TO_40_MINS: array of string` - `_40_MINS_TO_1_HOUR: array of string` - `OVER_3_HOURS: array of string` - `timestamps: array of string` - `UNDER_10_MINS: array of string` # Top ## Get top layer 3 attack pairs (origin and target locations) **get** `/radar/attacks/layer3/top/attacks` Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `limitDirection: optional "ORIGIN" or "TARGET"` Specifies whether the `limitPerLocation` applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `limitPerLocation: optional number` Limits the number of attacks per origin/target (refer to `limitDirection` parameter) location. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `magnitude: optional "MITIGATED_BYTES" or "MITIGATED_ATTACKS"` Orders results based on attack magnitude, defined by total mitigated bytes or total mitigated attacks. - `"MITIGATED_BYTES"` - `"MITIGATED_ATTACKS"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN_MAX"` - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/top/attacks \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "FR", "originCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Get top industries targeted by layer 3 attacks **get** `/radar/attacks/layer3/top/industry` This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/top/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Computer Software", "value": "65" } ] }, "success": true } ``` ## Get top verticals targeted by layer 3 attacks **get** `/radar/attacks/layer3/top/vertical` This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/top/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Internet and Telecom", "value": "65" } ] }, "success": true } ``` ## Domain Types ### Top Attacks Response - `TopAttacksResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `value: string` ### Top Industry Response - `TopIndustryResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` ### Top Vertical Response - `TopVerticalResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` # Locations ## Get top origin locations of layer 3 attacks **get** `/radar/attacks/layer3/top/locations/origin` Retrieves the origin locations of layer 3 attacks. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/top/locations/origin \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "FR", "originCountryName": "France", "rank": 1, "value": "4.323214" } ] }, "success": true } ``` ## Get top target locations of layer 3 attacks **get** `/radar/attacks/layer3/top/locations/target` Retrieves the target locations of layer 3 attacks. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `protocol: optional array of "UDP" or "TCP" or "ICMP" or "GRE"` Filters the results by layer 3/4 protocol. - `"UDP"` - `"TCP"` - `"ICMP"` - `"GRE"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer3/top/locations/target \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "rank": 1, "targetCountryAlpha2": "FR", "targetCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Domain Types ### Location Origin Response - `LocationOriginResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` ### Location Target Response - `LocationTargetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` # Layer7 ## Get layer 7 attacks summary by dimension **get** `/radar/attacks/layer7/summary/{dimension}` Retrieves the distribution of layer 7 attacks by the specified dimension. ### Path Parameters - `dimension: "HTTP_METHOD" or "HTTP_VERSION" or "IP_VERSION" or 4 more` Specifies the attribute by which to group the results. - `"HTTP_METHOD"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"MANAGED_RULES"` - `"MITIGATION_PRODUCT"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "GET": "50.168733", "POST": "25.084366" } }, "success": true } ``` ## Get layer 7 attacks time series **get** `/radar/attacks/layer7/timeseries` Retrieves layer 7 attacks over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "values": [ "10" ] } }, "success": true } ``` ## Get layer 7 attacks time series grouped by dimension **get** `/radar/attacks/layer7/timeseries_groups/{dimension}` Retrieves the distribution of layer 7 attacks grouped by dimension over time. ### Path Parameters - `dimension: "HTTP_METHOD" or "HTTP_VERSION" or "IP_VERSION" or 4 more` Specifies the attribute by which to group the results. - `"HTTP_METHOD"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"MANAGED_RULES"` - `"MITIGATION_PRODUCT"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Layer7 Summary V2 Response - `Layer7SummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Layer7 Timeseries Response - `Layer7TimeseriesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, values }` - `timestamps: array of string` - `values: array of string` ### Layer7 Timeseries Groups V2 Response - `Layer7TimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get layer 7 attacks by IP version summary **get** `/radar/attacks/layer7/summary/ip_version` Retrieves the distribution of layer 7 attacks by IP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` - `IPv6: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "99.935733", "IPv6": "0.064267" } }, "success": true } ``` ## Get layer 7 attacks by HTTP method summary **get** `/radar/attacks/layer7/summary/http_method` Retrieves the distribution of layer 7 attacks by HTTP method. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/http_method \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "GET": "99.100257", "POST": "0.899743" } }, "success": true } ``` ## Get layer 7 attacks by HTTP version summary **get** `/radar/attacks/layer7/summary/http_version` Retrieves the distribution of layer 7 attacks by HTTP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` - `"HTTP/2": string` - `"HTTP/3": string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP/1.x": "21.722365", "HTTP/2": "77.056555", "HTTP/3": "1.22108" } }, "success": true } ``` ## Get layer 7 attacks by managed rules summary **get** `/radar/attacks/layer7/summary/managed_rules` Retrieves the distribution of layer 7 attacks by managed rules. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/managed_rules \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP Anomaly": "85.714286", "XSS": "10.274394" } }, "success": true } ``` ## Get layer 7 attacks by mitigation product summary **get** `/radar/attacks/layer7/summary/mitigation_product` Retrieves the distribution of layer 7 attacks by mitigation product. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/mitigation_product \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "DDOS": "24.421594", "WAF": "53.213368" } }, "success": true } ``` ## Get layer 7 attacks by targeted industry summary **get** `/radar/attacks/layer7/summary/industry` Retrieves the distribution of layer 7 attacks by targeted industry. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Computer Software": "65" } }, "success": true } ``` ## Get layer 7 attacks by targeted vertical summary **get** `/radar/attacks/layer7/summary/vertical` Retrieves the distribution of layer 7 attacks by targeted vertical. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Internet and Telecom": "5.519081" } }, "success": true } ``` ## Domain Types ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` - `IPv6: string` ### Summary HTTP Method Response - `SummaryHTTPMethodResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary HTTP Version Response - `SummaryHTTPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` - `"HTTP/2": string` - `"HTTP/3": string` ### Summary Managed Rules Response - `SummaryManagedRulesResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Mitigation Product Response - `SummaryMitigationProductResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Industry Response - `SummaryIndustryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Vertical Response - `SummaryVerticalResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups ## Get layer 7 attacks by target industries time series **get** `/radar/attacks/layer7/timeseries_groups/industry` Retrieves the distribution of layer 7 attacks by targeted industry over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by IP version time series **get** `/radar/attacks/layer7/timeseries_groups/ip_version` Retrieves the distribution of layer 7 attacks by IP version used over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get layer 7 attacks by vertical time series **get** `/radar/attacks/layer7/timeseries_groups/vertical` Retrieves the distribution of layer 7 attacks by targeted vertical over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by HTTP method time series **get** `/radar/attacks/layer7/timeseries_groups/http_method` Retrieves the distribution of layer 7 attacks by HTTP method over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/http_method \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by HTTP version time series **get** `/radar/attacks/layer7/timeseries_groups/http_version` Retrieves the distribution of layer 7 attacks by HTTP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "HTTP/1.x": [ "50.338734" ], "HTTP/2": [ "48.661266" ], "HTTP/3": [ "1.22108" ], "timestamps": [ "2023-10-01T00:00:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by managed rules time series **get** `/radar/attacks/layer7/timeseries_groups/managed_rules` Retrieves the distribution of layer 7 attacks by managed rules over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/managed_rules \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by mitigation product time series **get** `/radar/attacks/layer7/timeseries_groups/mitigation_product` Retrieves the distribution of layer 7 attacks by mitigation product over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/mitigation_product \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Industry Response - `TimeseriesGroupIndustryResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` ### Timeseries Group Vertical Response - `TimeseriesGroupVerticalResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group HTTP Method Response - `TimeseriesGroupHTTPMethodResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group HTTP Version Response - `TimeseriesGroupHTTPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` ### Timeseries Group Managed Rules Response - `TimeseriesGroupManagedRulesResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Mitigation Product Response - `TimeseriesGroupMitigationProductResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Top ## Get top layer 7 attack pairs (origin and target locations) **get** `/radar/attacks/layer7/top/attacks` Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `limitDirection: optional "ORIGIN" or "TARGET"` Specifies whether the `limitPerLocation` applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `limitPerLocation: optional number` Limits the number of attacks per origin/target (refer to `limitDirection` parameter) location. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN_MAX"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, targetCountryAlpha2, 2 more }` - `originCountryAlpha2: string` - `originCountryName: string` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/attacks \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "US", "originCountryName": "United States", "targetCountryAlpha2": "FR", "targetCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Get top industries targeted by layer 7 attacks **get** `/radar/attacks/layer7/top/industry` This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Computer Software", "value": "65" } ] }, "success": true } ``` ## Get top verticals targeted by layer 7 attacks **get** `/radar/attacks/layer7/top/vertical` This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Internet and Telecom", "value": "65" } ] }, "success": true } ``` ## Domain Types ### Top Attacks Response - `TopAttacksResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, targetCountryAlpha2, 2 more }` - `originCountryAlpha2: string` - `originCountryName: string` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` ### Top Industry Response - `TopIndustryResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` ### Top Vertical Response - `TopVerticalResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` # Locations ## Get top origin locations of layer 7 attacks **get** `/radar/attacks/layer7/top/locations/origin` Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/locations/origin \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "FR", "originCountryName": "France", "rank": 1, "value": "4.323214" } ] }, "success": true } ``` ## Get top target locations of layer 7 attacks **get** `/radar/attacks/layer7/top/locations/target` Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/locations/target \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "rank": 1, "targetCountryAlpha2": "FR", "targetCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Domain Types ### Location Origin Response - `LocationOriginResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` ### Location Target Response - `LocationTargetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` # Ases ## Get top origin ASes of layer 7 attacks **get** `/radar/attacks/layer7/top/ases/origin` Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originAsn, originAsnName, rank, value }` - `originAsn: string` - `originAsnName: string` - `rank: number` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/ases/origin \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originAsn": "55836", "originAsnName": "RELIANCEJIO-IN Reliance Jio Infocomm Limited", "rank": 1, "value": "4.323214" } ] }, "success": true } ``` ## Domain Types ### Ase Origin Response - `AseOriginResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { originAsn, originAsnName, rank, value }` - `originAsn: string` - `originAsnName: string` - `rank: number` - `value: string` # Entities ## Get IP address details **get** `/radar/entities/ip` Retrieves IP address information. ### Query Parameters - `ip: string` IP address. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { ip }` - `ip: object { asn, asnLocation, asnName, 5 more }` - `asn: string` - `asnLocation: string` - `asnName: string` - `asnOrgName: string` - `ip: string` - `ipVersion: string` - `location: string` - `locationName: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/ip \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "ip": { "asn": "15169", "asnLocation": "US", "asnName": "GOOGLE", "asnOrgName": "Google LLC", "ip": "8.8.8.8", "ipVersion": "IPv4", "location": "GB", "locationName": "United Kingdom" } }, "success": true } ``` ## Domain Types ### Entity Get Response - `EntityGetResponse = object { ip }` - `ip: object { asn, asnLocation, asnName, 5 more }` - `asn: string` - `asnLocation: string` - `asnName: string` - `asnOrgName: string` - `ip: string` - `ipVersion: string` - `location: string` - `locationName: string` # ASNs ## List autonomous systems **get** `/radar/entities/asns` Retrieves a list of autonomous systems. ### Query Parameters - `asn: optional string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `offset: optional number` Skips the specified number of objects before fetching the results. - `orderBy: optional "ASN" or "POPULATION"` Specifies the metric to order the ASNs by. - `"ASN"` - `"POPULATION"` ### Returns - `result: object { asns }` - `asns: array of object { asn, country, countryName, 4 more }` - `asn: number` - `country: string` - `countryName: string` - `name: string` - `aka: optional string` - `orgName: optional string` - `website: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asns": [ { "asn": 714, "country": "GB", "countryName": "United Kingdom", "name": "Apple Inc.", "aka": "aka", "orgName": "orgName", "website": "https://www.apple.com/support/systemstatus/" } ] }, "success": true } ``` ## Get AS details by ASN **get** `/radar/entities/asns/{asn}` Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). ### Path Parameters - `asn: number` Single Autonomous System Number (ASN) as integer. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { asn }` - `asn: object { asn, confidenceLevel, country, 8 more }` - `asn: number` - `confidenceLevel: number` - `country: string` - `countryName: string` - `estimatedUsers: object { locations, estimatedUsers }` - `locations: array of object { locationAlpha2, locationName, estimatedUsers }` - `locationAlpha2: string` - `locationName: string` - `estimatedUsers: optional number` Estimated users per location. - `estimatedUsers: optional number` Total estimated users. - `name: string` - `orgName: string` - `related: array of object { asn, name, aka, estimatedUsers }` - `asn: number` - `name: string` - `aka: optional string` - `estimatedUsers: optional number` Total estimated users. - `source: string` Regional Internet Registry. - `website: string` - `aka: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns/$ASN \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asn": { "asn": 714, "confidenceLevel": 5, "country": "GB", "countryName": "United Kingdom", "estimatedUsers": { "locations": [ { "locationAlpha2": "US", "locationName": "United States", "estimatedUsers": 16710 } ], "estimatedUsers": 86099 }, "name": "Apple Inc.", "orgName": "orgName", "related": [ { "asn": 174, "name": "Cogent-174", "aka": "aka", "estimatedUsers": 65345 } ], "source": "RIPE", "website": "https://www.apple.com/support/systemstatus/", "aka": "aka" } }, "success": true } ``` ## Get AS-level relationships by ASN **get** `/radar/entities/asns/{asn}/rel` Retrieves AS-level relationship for given networks. ### Path Parameters - `asn: number` Retrieves all ASNs with provider-customer or peering relationships with the given ASN. ### Query Parameters - `asn2: optional number` Retrieves the AS relationship of ASN2 with respect to the given ASN. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { meta, rels }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `rels: array of object { asn1, asn1_country, asn1_name, 4 more }` - `asn1: number` - `asn1_country: string` - `asn1_name: string` - `asn2: number` - `asn2_country: string` - `asn2_name: string` - `rel: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns/$ASN/rel \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "data_time": "data_time", "query_time": "query_time", "total_peers": 0 }, "rels": [ { "asn1": 0, "asn1_country": "asn1_country", "asn1_name": "asn1_name", "asn2": 0, "asn2_country": "asn2_country", "asn2_name": "asn2_name", "rel": "rel" } ] }, "success": true } ``` ## Get IRR AS-SETs that an AS is a member of **get** `/radar/entities/asns/{asn}/as_set` Retrieves Internet Routing Registry AS-SETs that an AS is a member of. ### Path Parameters - `asn: number` Retrieves all AS-SETs that the given AS is a member of. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { as_sets, paths }` - `as_sets: array of object { as_members_count, as_set_members_count, as_set_upstreams_count, 6 more }` - `as_members_count: number` The number of AS members in the AS-SET - `as_set_members_count: number` The number of AS-SET members in the AS-SET - `as_set_upstreams_count: number` The number of recursive upstream AS-SETs - `asn_cone_size: number` The number of unique ASNs in the AS-SETs recursive downstream - `irr_sources: array of string` The IRR sources of the AS-SET - `name: string` The name of the AS-SET - `hierarchical_asn: optional number` The AS number following hierarchical AS-SET name - `inferred_asn: optional number` The inferred AS number of the AS-SET - `peeringdb_asn: optional number` The AS number matching PeeringDB record - `paths: array of array of string` Paths from the AS-SET that include the given AS to its upstreams recursively - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns/$ASN/as_set \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "as_sets": [ { "as_members_count": 0, "as_set_members_count": 0, "as_set_upstreams_count": 0, "asn_cone_size": 0, "irr_sources": [ "string" ], "name": "name", "hierarchical_asn": 0, "inferred_asn": 0, "peeringdb_asn": 0 } ], "paths": [ [ "string" ] ] }, "success": true } ``` ## Get AS details by IP address **get** `/radar/entities/asns/ip` Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). ### Query Parameters - `ip: string` IP address. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { asn }` - `asn: object { asn, country, countryName, 7 more }` - `asn: number` - `country: string` - `countryName: string` - `estimatedUsers: object { locations, estimatedUsers }` - `locations: array of object { locationAlpha2, locationName, estimatedUsers }` - `locationAlpha2: string` - `locationName: string` - `estimatedUsers: optional number` Estimated users per location. - `estimatedUsers: optional number` Total estimated users. - `name: string` - `orgName: string` - `related: array of object { asn, name, aka, estimatedUsers }` - `asn: number` - `name: string` - `aka: optional string` - `estimatedUsers: optional number` Total estimated users. - `source: string` Regional Internet Registry. - `website: string` - `aka: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns/ip \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "asn": { "asn": 714, "country": "GB", "countryName": "United Kingdom", "estimatedUsers": { "locations": [ { "locationAlpha2": "US", "locationName": "United States", "estimatedUsers": 16710 } ], "estimatedUsers": 86099 }, "name": "Apple Inc.", "orgName": "orgName", "related": [ { "asn": 0, "name": "name", "aka": "aka", "estimatedUsers": 65345 } ], "source": "RIPE", "website": "https://www.apple.com/support/systemstatus/", "aka": "aka" } }, "success": true } ``` ## Get AS rankings by botnet threat feed activity **get** `/radar/entities/asns/botnet_threat_feed` Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `compareDateRange: optional string` Relative date range for rank change comparison (e.g., "1d", "7d", "30d"). - `date: optional string` The date to retrieve (YYYY-MM-DD format). If not specified, returns the most recent available data. Note: This is the date the report was generated. The report is generated from information collected from the previous day (e.g., the 2026-02-23 entry contains data from 2026-02-22). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `metric: optional "OFFENSE_COUNT" or "NUMBER_OF_OFFENDING_IPS"` Metric to rank ASNs by. - `"OFFENSE_COUNT"` - `"NUMBER_OF_OFFENDING_IPS"` - `offset: optional number` Skips the specified number of objects before fetching the results. - `sortOrder: optional "ASC" or "DESC"` Sort order. - `"ASC"` - `"DESC"` ### Returns - `result: object { ases, meta }` - `ases: array of object { asn, country, name, 2 more }` - `asn: number` - `country: string` - `name: string` - `rank: number` - `rankChange: optional number` - `meta: object { date, total, compareDate }` - `date: string` - `total: number` - `compareDate: optional string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/asns/botnet_threat_feed \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "ases": [ { "asn": 4134, "country": "CN", "name": "CHINANET-BACKBONE", "rank": 1, "rankChange": -2 } ], "meta": { "date": "2026-02-04", "total": 50, "compareDate": "2026-01-28" } }, "success": true } ``` ## Domain Types ### ASN List Response - `ASNListResponse = object { asns }` - `asns: array of object { asn, country, countryName, 4 more }` - `asn: number` - `country: string` - `countryName: string` - `name: string` - `aka: optional string` - `orgName: optional string` - `website: optional string` ### ASN Get Response - `ASNGetResponse = object { asn }` - `asn: object { asn, confidenceLevel, country, 8 more }` - `asn: number` - `confidenceLevel: number` - `country: string` - `countryName: string` - `estimatedUsers: object { locations, estimatedUsers }` - `locations: array of object { locationAlpha2, locationName, estimatedUsers }` - `locationAlpha2: string` - `locationName: string` - `estimatedUsers: optional number` Estimated users per location. - `estimatedUsers: optional number` Total estimated users. - `name: string` - `orgName: string` - `related: array of object { asn, name, aka, estimatedUsers }` - `asn: number` - `name: string` - `aka: optional string` - `estimatedUsers: optional number` Total estimated users. - `source: string` Regional Internet Registry. - `website: string` - `aka: optional string` ### ASN Rel Response - `ASNRelResponse = object { meta, rels }` - `meta: object { data_time, query_time, total_peers }` - `data_time: string` - `query_time: string` - `total_peers: number` - `rels: array of object { asn1, asn1_country, asn1_name, 4 more }` - `asn1: number` - `asn1_country: string` - `asn1_name: string` - `asn2: number` - `asn2_country: string` - `asn2_name: string` - `rel: string` ### ASN As Set Response - `ASNAsSetResponse = object { as_sets, paths }` - `as_sets: array of object { as_members_count, as_set_members_count, as_set_upstreams_count, 6 more }` - `as_members_count: number` The number of AS members in the AS-SET - `as_set_members_count: number` The number of AS-SET members in the AS-SET - `as_set_upstreams_count: number` The number of recursive upstream AS-SETs - `asn_cone_size: number` The number of unique ASNs in the AS-SETs recursive downstream - `irr_sources: array of string` The IRR sources of the AS-SET - `name: string` The name of the AS-SET - `hierarchical_asn: optional number` The AS number following hierarchical AS-SET name - `inferred_asn: optional number` The inferred AS number of the AS-SET - `peeringdb_asn: optional number` The AS number matching PeeringDB record - `paths: array of array of string` Paths from the AS-SET that include the given AS to its upstreams recursively ### ASN IP Response - `ASNIPResponse = object { asn }` - `asn: object { asn, country, countryName, 7 more }` - `asn: number` - `country: string` - `countryName: string` - `estimatedUsers: object { locations, estimatedUsers }` - `locations: array of object { locationAlpha2, locationName, estimatedUsers }` - `locationAlpha2: string` - `locationName: string` - `estimatedUsers: optional number` Estimated users per location. - `estimatedUsers: optional number` Total estimated users. - `name: string` - `orgName: string` - `related: array of object { asn, name, aka, estimatedUsers }` - `asn: number` - `name: string` - `aka: optional string` - `estimatedUsers: optional number` Total estimated users. - `source: string` Regional Internet Registry. - `website: string` - `aka: optional string` ### ASN Botnet Threat Feed Response - `ASNBotnetThreatFeedResponse = object { ases, meta }` - `ases: array of object { asn, country, name, 2 more }` - `asn: number` - `country: string` - `name: string` - `rank: number` - `rankChange: optional number` - `meta: object { date, total, compareDate }` - `date: string` - `total: number` - `compareDate: optional string` # Locations ## List locations **get** `/radar/entities/locations` Retrieves a list of locations. ### Query Parameters - `continent: optional "AF" or "AS" or "EU" or 3 more` Filters results by continent code. - `"AF"` - `"AS"` - `"EU"` - `"NA"` - `"OC"` - `"SA"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `offset: optional number` Skips the specified number of objects before fetching the results. - `region: optional string` Filters results by region. - `subregion: optional string` Filters results by subregion. ### Returns - `result: object { locations }` - `locations: array of object { alpha2, continent, latitude, 4 more }` - `alpha2: string` - `continent: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `region: string` - `subregion: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "locations": [ { "alpha2": "AF", "continent": "AS", "latitude": "10", "longitude": "10", "name": "Afghanistan", "region": "Middle East", "subregion": "Southern Asia" } ] }, "success": true } ``` ## Get location details **get** `/radar/entities/locations/{location}` Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location). ### Path Parameters - `location: string` Location alpha-2 code. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { location }` - `location: object { alpha2, confidenceLevel, continent, 5 more }` - `alpha2: string` - `confidenceLevel: number` - `continent: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `region: string` - `subregion: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/entities/locations/$LOCATION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "location": { "alpha2": "AF", "confidenceLevel": 5, "continent": "AS", "latitude": "10", "longitude": "10", "name": "Afghanistan", "region": "Middle East", "subregion": "Southern Asia" } }, "success": true } ``` ## Domain Types ### Location List Response - `LocationListResponse = object { locations }` - `locations: array of object { alpha2, continent, latitude, 4 more }` - `alpha2: string` - `continent: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `region: string` - `subregion: string` ### Location Get Response - `LocationGetResponse = object { location }` - `location: object { alpha2, confidenceLevel, continent, 5 more }` - `alpha2: string` - `confidenceLevel: number` - `continent: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `region: string` - `subregion: string` # Geolocations ## List Geolocations **get** `/radar/geolocations` Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional string` Filters results by geolocation. Specify a comma-separated list of GeoNames IDs. - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { geolocations }` - `geolocations: array of object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 4 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/geolocations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "geolocations": [ { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "parent": { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "parent": { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" }, "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" }, "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" } ] }, "success": true } ``` ## Get Geolocation details **get** `/radar/geolocations/{geo_id}` Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). ### Path Parameters - `geo_id: string` Geolocation ID. Refer to [GeoNames](https://download.geonames.org/export/dump/readme.txt) ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { geolocation }` - `geolocation: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 4 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/geolocations/$GEO_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "geolocation": { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "parent": { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "parent": { "geoId": "2267056", "latitude": "10", "longitude": "10", "name": "Lisbon", "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" }, "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" }, "type": "CONTINENT", "code": "PT-11", "locale": "pt-PT" } }, "success": true } ``` ## Domain Types ### Geolocation List Response - `GeolocationListResponse = object { geolocations }` - `geolocations: array of object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 4 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation ### Geolocation Get Response - `GeolocationGetResponse = object { geolocation }` - `geolocation: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 5 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `parent: object { geoId, latitude, longitude, 4 more }` - `geoId: string` - `latitude: string` A numeric string. - `longitude: string` A numeric string. - `name: string` - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation - `type: "CONTINENT" or "COUNTRY" or "ADM1"` The type of the geolocation. - `"CONTINENT"` - `"COUNTRY"` - `"ADM1"` - `code: optional string` - `locale: optional string` BCP 47 locale code used for the geolocation name translation # HTTP ## Get HTTP requests summary by dimension **get** `/radar/http/summary/{dimension}` Retrieves the distribution of HTTP requests by the specified dimension. ### Path Parameters - `dimension: "ADM1" or "AS" or "BOT_CLASS" or 10 more` Specifies the HTTP attribute by which to group the results. - `"ADM1"` - `"AS"` - `"BOT_CLASS"` - `"BROWSER"` - `"BROWSER_FAMILY"` - `"DEVICE_TYPE"` - `"HTTP_PROTOCOL"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"LOCATION"` - `"OS"` - `"POST_QUANTUM"` - `"TLS_VERSION"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Chrome": "50.168733", "Firefox": "25.084366" } }, "success": true } ``` ## Get HTTP requests time series **get** `/radar/http/timeseries` Retrieves the HTTP requests over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get HTTP requests time series grouped by dimension **get** `/radar/http/timeseries_groups/{dimension}` Retrieves the distribution of HTTP requests grouped by dimension. ### Path Parameters - `dimension: "ADM1" or "AS" or "BOT_CLASS" or 10 more` Specifies the HTTP attribute by which to group the results. - `"ADM1"` - `"AS"` - `"BOT_CLASS"` - `"BROWSER"` - `"BROWSER_FAMILY"` - `"DEVICE_TYPE"` - `"HTTP_PROTOCOL"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"LOCATION"` - `"OS"` - `"POST_QUANTUM"` - `"TLS_VERSION"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### HTTP Summary V2 Response - `HTTPSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### HTTP Timeseries Response - `HTTPTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### HTTP Timeseries Groups V2 Response - `HTTPTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Locations ## Get top locations by HTTP requests **get** `/radar/http/top/locations` Retrieves the top locations by HTTP requests. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Location Get Response - `LocationGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Bot Class ## Get top locations by HTTP requests for a bot class **get** `/radar/http/top/locations/bot_class/{bot_class}` Retrieves the top locations, by HTTP requests, of the requested bot class. ### Path Parameters - `bot_class: "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/bot_class/$BOT_CLASS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Bot Class Get Response - `BotClassGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Device Type ## Get top locations by HTTP requests for a device type **get** `/radar/http/top/locations/device_type/{device_type}` Retrieves the top locations, by HTTP requests, of the requested device type. ### Path Parameters - `device_type: "DESKTOP" or "MOBILE" or "OTHER"` Device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/device_type/$DEVICE_TYPE \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Device Type Get Response - `DeviceTypeGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # HTTP Protocol ## Get top locations by HTTP requests for an HTTP protocol **get** `/radar/http/top/locations/http_protocol/{http_protocol}` Retrieves the top locations, by HTTP requests, of the requested HTTP protocol. ### Path Parameters - `http_protocol: "HTTP" or "HTTPS"` HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/http_protocol/$HTTP_PROTOCOL \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### HTTP Protocol Get Response - `HTTPProtocolGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # HTTP Method ## Get top locations by HTTP requests for an HTTP version **get** `/radar/http/top/locations/http_version/{http_version}` Retrieves the top locations, by HTTP requests, of the requested HTTP version. ### Path Parameters - `http_version: "HTTPv1" or "HTTPv2" or "HTTPv3"` HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/http_version/$HTTP_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### HTTP Method Get Response - `HTTPMethodGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # IP Version ## Get top locations by HTTP requests for an IP version **get** `/radar/http/top/locations/ip_version/{ip_version}` Retrieves the top locations, by HTTP requests, of the requested IP version. ### Path Parameters - `ip_version: "IPv4" or "IPv6"` IP version. - `"IPv4"` - `"IPv6"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/ip_version/$IP_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### IP Version Get Response - `IPVersionGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # OS ## Get top locations by HTTP requests for an OS **get** `/radar/http/top/locations/os/{os}` Retrieves the top locations, by HTTP requests, of the requested operating system. ### Path Parameters - `os: "WINDOWS" or "MACOSX" or "IOS" or 4 more` Operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/os/$OS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### OS Get Response - `OSGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # TLS Version ## Get top locations by HTTP requests for a TLS version **get** `/radar/http/top/locations/tls_version/{tls_version}` Retrieves the top locations, by HTTP requests, of the requested TLS protocol version. ### Path Parameters - `tls_version: "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/tls_version/$TLS_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### TLS Version Get Response - `TLSVersionGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Browser Family ## Get top locations by HTTP requests for a browser family **get** `/radar/http/top/locations/browser_family/{browser_family}` Retrieves the top locations, by HTTP requests, of the requested browser family. ### Path Parameters - `browser_family: "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/locations/browser_family/$BROWSER_FAMILY \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Browser Family Get Response - `BrowserFamilyGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # Ases ## Get top ASes by HTTP requests **get** `/radar/http/top/ases` Retrieves the top autonomous systems by HTTP requests. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Ase Get Response - `AseGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # Bot Class ## Get top ASes by HTTP requests for a bot class **get** `/radar/http/top/ases/bot_class/{bot_class}` Retrieves the top autonomous systems, by HTTP requests, of the requested bot class. ### Path Parameters - `bot_class: "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/bot_class/$BOT_CLASS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Bot Class Get Response - `BotClassGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # Device Type ## Get top ASes by HTTP requests for a device type **get** `/radar/http/top/ases/device_type/{device_type}` Retrieves the top autonomous systems, by HTTP requests, of the requested device type. ### Path Parameters - `device_type: "DESKTOP" or "MOBILE" or "OTHER"` Device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/device_type/$DEVICE_TYPE \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Device Type Get Response - `DeviceTypeGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # HTTP Protocol ## Get top ASes by HTTP requests for an HTTP protocol **get** `/radar/http/top/ases/http_protocol/{http_protocol}` Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol. ### Path Parameters - `http_protocol: "HTTP" or "HTTPS"` HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/http_protocol/$HTTP_PROTOCOL \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### HTTP Protocol Get Response - `HTTPProtocolGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # HTTP Method ## Get top ASes by HTTP requests for an HTTP version **get** `/radar/http/top/ases/http_version/{http_version}` Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version. ### Path Parameters - `http_version: "HTTPv1" or "HTTPv2" or "HTTPv3"` HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/http_version/$HTTP_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### HTTP Method Get Response - `HTTPMethodGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # IP Version ## Get top ASes by HTTP requests for an IP version **get** `/radar/http/top/ases/ip_version/{ip_version}` Retrieves the top autonomous systems, by HTTP requests, of the requested IP version. ### Path Parameters - `ip_version: "IPv4" or "IPv6"` IP version. - `"IPv4"` - `"IPv6"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/ip_version/$IP_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### IP Version Get Response - `IPVersionGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # OS ## Get top ASes by HTTP requests for an OS **get** `/radar/http/top/ases/os/{os}` Retrieves the top autonomous systems, by HTTP requests, of the requested operating system. ### Path Parameters - `os: "WINDOWS" or "MACOSX" or "IOS" or 4 more` Operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/os/$OS \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### OS Get Response - `OSGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # TLS Version ## Get top ASes by HTTP requests for a TLS version **get** `/radar/http/top/ases/tls_version/{tls_version}` Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version. ### Path Parameters - `tls_version: "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/tls_version/$TLS_VERSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### TLS Version Get Response - `TLSVersionGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # Browser Family ## Get top ASes by HTTP requests for a browser family **get** `/radar/http/top/ases/browser_family/{browser_family}` Retrieves the top autonomous systems, by HTTP requests, of the requested browser family. ### Path Parameters - `browser_family: "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/ases/browser_family/$BROWSER_FAMILY \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "clientASN": 3243, "clientASName": "MEO", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Browser Family Get Response - `BrowserFamilyGetResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { clientASN, clientASName, value }` - `clientASN: number` - `clientASName: string` - `value: string` A numeric string. # Summary ## Get HTTP requests by bot class summary **get** `/radar/http/summary/bot_class` Retrieves the distribution of bot-generated HTTP requests to genuine human traffic, as classified by Cloudflare. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bot, human }` - `bot: string` A numeric string. - `human: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/bot_class \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "bot": "10", "human": "10" } }, "success": true } ``` ## Get HTTP requests by device type summary **get** `/radar/http/summary/device_type` Retrieves the distribution of HTTP requests generated by mobile, desktop, and other types of devices. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { desktop, mobile, other }` - `desktop: string` A numeric string. - `mobile: string` A numeric string. - `other: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/device_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "desktop": "10", "mobile": "10", "other": "10" } }, "success": true } ``` ## Get HTTP requests by HTTP/HTTPS summary **get** `/radar/http/summary/http_protocol` Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { http, https }` - `http: string` A numeric string. - `https: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/http_protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "http": "10", "https": "10" } }, "success": true } ``` ## Get HTTP requests by HTTP version summary **get** `/radar/http/summary/http_version` Retrieves the distribution of HTTP requests by HTTP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` A numeric string. - `"HTTP/2": string` A numeric string. - `"HTTP/3": string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP/1.x": "10", "HTTP/2": "10", "HTTP/3": "10" } }, "success": true } ``` ## Get HTTP requests by IP version summary **get** `/radar/http/summary/ip_version` Retrieves the distribution of HTTP requests by IP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "10", "IPv6": "10" } }, "success": true } ``` ## Get HTTP requests by OS summary **get** `/radar/http/summary/os` Retrieves the distribution of HTTP requests by operating system (Windows, macOS, Android, iOS, and others). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { ANDROID, IOS }` - `ANDROID: string` A numeric string. - `IOS: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/os \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "ANDROID": "10", "IOS": "10" } }, "success": true } ``` ## Get HTTP requests by TLS version summary **get** `/radar/http/summary/tls_version` Retrieves the distribution of HTTP requests by TLS version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", 2 more }` - `"TLS 1.0": string` A numeric string. - `"TLS 1.1": string` A numeric string. - `"TLS 1.2": string` A numeric string. - `"TLS 1.3": string` A numeric string. - `"TLS QUIC": string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/tls_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "TLS 1.0": "10", "TLS 1.1": "10", "TLS 1.2": "10", "TLS 1.3": "10", "TLS QUIC": "10" } }, "success": true } ``` ## Get HTTP requests by post-quantum support summary **get** `/radar/http/summary/post_quantum` Retrieves the distribution of HTTP requests by post-quantum support. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/summary/post_quantum \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "NOT_SUPPORTED": "10", "SUPPORTED": "10" } }, "success": true } ``` ## Domain Types ### Summary Bot Class Response - `SummaryBotClassResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bot, human }` - `bot: string` A numeric string. - `human: string` A numeric string. ### Summary Device Type Response - `SummaryDeviceTypeResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { desktop, mobile, other }` - `desktop: string` A numeric string. - `mobile: string` A numeric string. - `other: string` A numeric string. ### Summary HTTP Protocol Response - `SummaryHTTPProtocolResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { http, https }` - `http: string` A numeric string. - `https: string` A numeric string. ### Summary HTTP Version Response - `SummaryHTTPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` A numeric string. - `"HTTP/2": string` A numeric string. - `"HTTP/3": string` A numeric string. ### Summary IP Version Response - `SummaryIPVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { IPv4, IPv6 }` - `IPv4: string` A numeric string. - `IPv6: string` A numeric string. ### Summary OS Response - `SummaryOSResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { ANDROID, IOS }` - `ANDROID: string` A numeric string. - `IOS: string` A numeric string. ### Summary TLS Version Response - `SummaryTLSVersionResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { "TLS 1.0", "TLS 1.1", "TLS 1.2", 2 more }` - `"TLS 1.0": string` A numeric string. - `"TLS 1.1": string` A numeric string. - `"TLS 1.2": string` A numeric string. - `"TLS 1.3": string` A numeric string. - `"TLS QUIC": string` A numeric string. ### Summary Post Quantum Response - `SummaryPostQuantumResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { NOT_SUPPORTED, SUPPORTED }` - `NOT_SUPPORTED: string` A numeric string. - `SUPPORTED: string` A numeric string. # Timeseries Groups ## Get HTTP requests by TLS version time series **get** `/radar/http/timeseries_groups/tls_version` Retrieves the distribution of HTTP requests by TLS version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, "TLS 1.0", "TLS 1.1", 3 more }` - `timestamps: array of string` - `"TLS 1.0": array of string` - `"TLS 1.1": array of string` - `"TLS 1.2": array of string` - `"TLS 1.3": array of string` - `"TLS QUIC": array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/tls_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "TLS 1.0": [ "10" ], "TLS 1.1": [ "10" ], "TLS 1.2": [ "10" ], "TLS 1.3": [ "10" ], "TLS QUIC": [ "10" ] } }, "success": true } ``` ## Get HTTP requests by bot class time series **get** `/radar/http/timeseries_groups/bot_class` Retrieves the distribution of HTTP requests classified as automated or human over time. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { bot, human, timestamps }` - `bot: array of string` - `human: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/bot_class \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "bot": [ "10" ], "human": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP requests by user agent time series **get** `/radar/http/timeseries_groups/browser` Retrieves the distribution of HTTP requests by user agent over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/browser \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get HTTP requests by user agent family time series **get** `/radar/http/timeseries_groups/browser_family` Retrieves the distribution of HTTP requests by user agent family over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/browser_family \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get HTTP requests by device type time series **get** `/radar/http/timeseries_groups/device_type` Retrieves the distribution of HTTP requests by device type over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { desktop, mobile, other, timestamps }` - `desktop: array of string` - `mobile: array of string` - `other: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/device_type \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "desktop": [ "10" ], "mobile": [ "10" ], "other": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP requests by HTTP/HTTPS time series **get** `/radar/http/timeseries_groups/http_protocol` Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS) over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { http, https, timestamps }` - `http: array of string` - `https: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/http_protocol \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "http": [ "10" ], "https": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP requests by HTTP version time series **get** `/radar/http/timeseries_groups/http_version` Retrieves the distribution of HTTP requests by HTTP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "HTTP/1.x": [ "10" ], "HTTP/2": [ "10" ], "HTTP/3": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP requests by IP version time series **get** `/radar/http/timeseries_groups/ip_version` Retrieves the distribution of HTTP requests by IP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP requests by OS time series **get** `/radar/http/timeseries_groups/os` Retrieves the distribution of HTTP requests by operating system over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/os \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get HTTP requests by post-quantum support time series **get** `/radar/http/timeseries_groups/post_quantum` Retrieves the distribution of HTTP requests by post-quantum support over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED, timestamps }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/timeseries_groups/post_quantum \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "NOT_SUPPORTED": [ "10" ], "SUPPORTED": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group TLS Version Response - `TimeseriesGroupTLSVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps, "TLS 1.0", "TLS 1.1", 3 more }` - `timestamps: array of string` - `"TLS 1.0": array of string` - `"TLS 1.1": array of string` - `"TLS 1.2": array of string` - `"TLS 1.3": array of string` - `"TLS QUIC": array of string` ### Timeseries Group Bot Class Response - `TimeseriesGroupBotClassResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { bot, human, timestamps }` - `bot: array of string` - `human: array of string` - `timestamps: array of string` ### Timeseries Group Browser Response - `TimeseriesGroupBrowserResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Browser Family Response - `TimeseriesGroupBrowserFamilyResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Device Type Response - `TimeseriesGroupDeviceTypeResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { desktop, mobile, other, timestamps }` - `desktop: array of string` - `mobile: array of string` - `other: array of string` - `timestamps: array of string` ### Timeseries Group HTTP Protocol Response - `TimeseriesGroupHTTPProtocolResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { http, https, timestamps }` - `http: array of string` - `https: array of string` - `timestamps: array of string` ### Timeseries Group HTTP Version Response - `TimeseriesGroupHTTPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` ### Timeseries Group OS Response - `TimeseriesGroupOSResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Timeseries Group Post Quantum Response - `TimeseriesGroupPostQuantumResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { NOT_SUPPORTED, SUPPORTED, timestamps }` - `NOT_SUPPORTED: array of string` - `SUPPORTED: array of string` - `timestamps: array of string` # Top ## Get top user agents by HTTP requests **get** `/radar/http/top/browser` Retrieves the top user agents by HTTP requests. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `browserFamily: optional array of "CHROME" or "EDGE" or "FIREFOX" or "SAFARI"` Filters results by browser family. - `"CHROME"` - `"EDGE"` - `"FIREFOX"` - `"SAFARI"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/browser \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "chrome", "value": "value" } ] }, "success": true } ``` ## Get top user agent families by HTTP requests **get** `/radar/http/top/browser_family` Retrieves the top user agents, aggregated in families, by HTTP requests. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `deviceType: optional array of "DESKTOP" or "MOBILE" or "OTHER"` Filters results by device type. - `"DESKTOP"` - `"MOBILE"` - `"OTHER"` - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `geoId: optional array of string` Filters results by Geolocation. Specify a comma-separated list of GeoNames IDs. Prefix with `-` to exclude geoIds from results. For example, `-2267056,360689` excludes results from the 2267056 (Lisbon), but includes results from 5128638 (New York). - `httpProtocol: optional array of "HTTP" or "HTTPS"` Filters results by HTTP protocol (HTTP vs. HTTPS). - `"HTTP"` - `"HTTPS"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `os: optional array of "WINDOWS" or "MACOSX" or "IOS" or 4 more` Filters results by operating system. - `"WINDOWS"` - `"MACOSX"` - `"IOS"` - `"ANDROID"` - `"CHROMEOS"` - `"LINUX"` - `"SMART_TV"` - `tlsVersion: optional array of "TLSv1_0" or "TLSv1_1" or "TLSv1_2" or 2 more` Filters results by TLS version. - `"TLSv1_0"` - `"TLSv1_1"` - `"TLSv1_2"` - `"TLSv1_3"` - `"TLSvQUIC"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/http/top/browser_family \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "chrome", "value": "value" } ] }, "success": true } ``` ## Domain Types ### Top Browser Response - `TopBrowserResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` ### Top Browser Family Response - `TopBrowserFamilyResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: string` # Origins ## List Origins **get** `/radar/origins` Retrieves a list of origins with their regions. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. ### Returns - `result: object { origins }` - `origins: array of object { regions, slug }` - `regions: array of object { region }` - `region: string` The region code. - `slug: string` The origin slug. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/origins \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "origins": [ { "regions": [ { "region": "us-east-1" } ], "slug": "amazon" } ] }, "success": true } ``` ## Get Origin details **get** `/radar/origins/{slug}` Retrieves the requested origin information with its regions. ### Path Parameters - `slug: "AMAZON" or "GOOGLE" or "MICROSOFT" or "ORACLE"` Origin slug. - `"AMAZON"` - `"GOOGLE"` - `"MICROSOFT"` - `"ORACLE"` ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { origin }` - `origin: object { regions, slug }` - `regions: array of object { region }` - `region: string` The region code. - `slug: string` The origin slug. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/origins/$SLUG \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "origin": { "regions": [ { "region": "us-east-1" } ], "slug": "amazon" } }, "success": true } ``` ## Get origin metrics time series **get** `/radar/origins/timeseries` Retrieves the time series of origin metrics for the specified origin. ### Query Parameters - `metric: "CONNECTION_FAILURES" or "REQUESTS" or "RESPONSE_HEADER_RECEIVE_DURATION" or 3 more` Specifies the metric to retrieve. - `"CONNECTION_FAILURES"` - `"REQUESTS"` - `"RESPONSE_HEADER_RECEIVE_DURATION"` - `"TCP_HANDSHAKE_DURATION"` - `"TCP_RTT"` - `"TLS_HANDSHAKE_DURATION"` - `origin: array of "AMAZON" or "GOOGLE" or "MICROSOFT" or "ORACLE"` Filters results by origin. - `"AMAZON"` - `"GOOGLE"` - `"MICROSOFT"` - `"ORACLE"` - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. - `region: optional array of string` Filters results by origin region. ### Returns - `result: object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/origins/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Get origin metrics distribution by dimension **get** `/radar/origins/summary/{dimension}` Retrieves an aggregated summary of origin metrics grouped by the specified dimension. ### Path Parameters - `dimension: "REGION" or "SUCCESS_RATE" or "PERCENTILE"` Specifies the origin attribute by which to group the results. - `"REGION"` - `"SUCCESS_RATE"` - `"PERCENTILE"` ### Query Parameters - `metric: "CONNECTION_FAILURES" or "REQUESTS" or "RESPONSE_HEADER_RECEIVE_DURATION" or 3 more` Specifies the metric to retrieve. - `"CONNECTION_FAILURES"` - `"REQUESTS"` - `"RESPONSE_HEADER_RECEIVE_DURATION"` - `"TCP_HANDSHAKE_DURATION"` - `"TCP_RTT"` - `"TLS_HANDSHAKE_DURATION"` - `origin: array of "AMAZON" or "GOOGLE" or "MICROSOFT" or "ORACLE"` Filters results by origin. - `"AMAZON"` - `"GOOGLE"` - `"MICROSOFT"` - `"ORACLE"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `region: optional array of string` Filters results by origin region. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/origins/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "eu-west-1": "52.14", "us-east-1": "45.23", "us-west-2": "38.67" } }, "success": true } ``` ## Get origin metrics time series grouped by dimension **get** `/radar/origins/timeseries_groups/{dimension}` Retrieves the distribution of origin metrics grouped by the specified dimension over time. ### Path Parameters - `dimension: "REGION" or "SUCCESS_RATE" or "PERCENTILE"` Specifies the origin attribute by which to group the results. - `"REGION"` - `"SUCCESS_RATE"` - `"PERCENTILE"` ### Query Parameters - `metric: "CONNECTION_FAILURES" or "REQUESTS" or "RESPONSE_HEADER_RECEIVE_DURATION" or 3 more` Specifies the metric to retrieve. - `"CONNECTION_FAILURES"` - `"REQUESTS"` - `"RESPONSE_HEADER_RECEIVE_DURATION"` - `"TCP_HANDSHAKE_DURATION"` - `"TCP_RTT"` - `"TLS_HANDSHAKE_DURATION"` - `origin: array of "AMAZON" or "GOOGLE" or "MICROSOFT" or "ORACLE"` Filters results by origin. - `"AMAZON"` - `"GOOGLE"` - `"MICROSOFT"` - `"ORACLE"` - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `region: optional array of string` Filters results by origin region. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/origins/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Origin List Response - `OriginListResponse = object { origins }` - `origins: array of object { regions, slug }` - `regions: array of object { region }` - `region: string` The region code. - `slug: string` The origin slug. ### Origin Get Response - `OriginGetResponse = object { origin }` - `origin: object { regions, slug }` - `regions: array of object { region }` - `region: string` The region code. - `slug: string` The origin slug. ### Origin Timeseries Response - `OriginTimeseriesResponse = object { meta }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` ### Origin Summary Response - `OriginSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Origin Timeseries Groups Response - `OriginTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Quality # IQI ## Get Internet Quality Index (IQI) summary **get** `/radar/quality/iqi/summary` Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). ### Query Parameters - `metric: "BANDWIDTH" or "DNS" or "LATENCY"` Defines which metric to return (bandwidth, latency, or DNS response time). - `"BANDWIDTH"` - `"DNS"` - `"LATENCY"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { p25, p50, p75 }` - `p25: string` - `p50: string` - `p75: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/iqi/summary \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "p25": "32.20938", "p50": "61.819881", "p75": "133.813087" } }, "success": true } ``` ## Get Internet Quality Index (IQI) time series **get** `/radar/quality/iqi/timeseries_groups` Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). ### Query Parameters - `metric: "BANDWIDTH" or "DNS" or "LATENCY"` Defines which metric to return (bandwidth, latency, or DNS response time). - `"BANDWIDTH"` - `"DNS"` - `"LATENCY"` - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `interpolation: optional boolean` Enables interpolation for all series (using the average). - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { p25, p50, p75, timestamps }` - `p25: array of string` - `p50: array of string` - `p75: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/iqi/timeseries_groups \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "p25": [ "31.253439" ], "p50": [ "60.337738" ], "p75": [ "125.940175" ], "timestamps": [ "2023-04-17T00:00:00Z" ] } }, "success": true } ``` ## Domain Types ### IQI Summary Response - `IQISummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { p25, p50, p75 }` - `p25: string` - `p50: string` - `p75: string` ### IQI Timeseries Groups Response - `IQITimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { p25, p50, p75, timestamps }` - `p25: array of string` - `p50: array of string` - `p75: array of string` - `timestamps: array of string` # Speed ## Get speed tests summary **get** `/radar/quality/speed/summary` Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bandwidthDownload, bandwidthUpload, jitterIdle, 4 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `packetLoss: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/speed/summary \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "bandwidthDownload": "83.765201", "bandwidthUpload": "39.005561", "jitterIdle": "25.648713", "jitterLoaded": "77.462155", "latencyIdle": "83.165385", "latencyLoaded": "270.561124", "packetLoss": "1.23705" } }, "success": true } ``` ## Get speed tests histogram **get** `/radar/quality/speed/histogram` Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `bucketSize: optional number` Specifies the width for every bucket in the histogram. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `metricGroup: optional "BANDWIDTH" or "LATENCY" or "JITTER"` Metrics to be returned. - `"BANDWIDTH"` - `"LATENCY"` - `"JITTER"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { histogram_0, meta }` - `histogram_0: object { bandwidthDownload, bandwidthUpload, bucketMin }` - `bandwidthDownload: array of string` - `bandwidthUpload: array of string` - `bucketMin: array of string` - `meta: object { bucketSize, confidenceInfo, dateRange, 4 more }` Metadata for the results. - `bucketSize: number` The width for every bucket in the histogram. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `totalTests: array of number` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/speed/histogram \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "histogram_0": { "bandwidthDownload": [ "83681" ], "bandwidthUpload": [ "181079" ], "bucketMin": [ "0" ] }, "meta": { "bucketSize": 0, "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "totalTests": [ 0 ], "units": [ { "name": "*", "value": "requests" } ] } }, "success": true } ``` ## Domain Types ### Speed Summary Response - `SpeedSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bandwidthDownload, bandwidthUpload, jitterIdle, 4 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `packetLoss: string` ### Speed Histogram Response - `SpeedHistogramResponse = object { histogram_0, meta }` - `histogram_0: object { bandwidthDownload, bandwidthUpload, bucketMin }` - `bandwidthDownload: array of string` - `bandwidthUpload: array of string` - `bucketMin: array of string` - `meta: object { bucketSize, confidenceInfo, dateRange, 4 more }` Metadata for the results. - `bucketSize: number` The width for every bucket in the histogram. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `totalTests: array of number` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` # Top ## Get top ASes by speed test results **get** `/radar/quality/speed/top/ases` Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `orderBy: optional "BANDWIDTH_DOWNLOAD" or "BANDWIDTH_UPLOAD" or "LATENCY_IDLE" or 3 more` Specifies the metric to order the results by. - `"BANDWIDTH_DOWNLOAD"` - `"BANDWIDTH_UPLOAD"` - `"LATENCY_IDLE"` - `"LATENCY_LOADED"` - `"JITTER_IDLE"` - `"JITTER_LOADED"` - `reverse: optional boolean` Reverses the order of results. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { bandwidthDownload, bandwidthUpload, clientASN, 7 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `clientASN: number` - `clientASName: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `numTests: number` - `rankPower: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/speed/top/ases \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "bandwidthDownload": "642.509004", "bandwidthUpload": "300.672274", "clientASN": 33353, "clientASName": "SIE-CGEI-ASN-1", "jitterIdle": "2.956908", "jitterLoaded": "19.500469", "latencyIdle": "15.925", "latencyLoaded": "65.65", "numTests": 13123, "rankPower": 0.77 } ] }, "success": true } ``` ## Get top locations by speed test results **get** `/radar/quality/speed/top/locations` Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `orderBy: optional "BANDWIDTH_DOWNLOAD" or "BANDWIDTH_UPLOAD" or "LATENCY_IDLE" or 3 more` Specifies the metric to order the results by. - `"BANDWIDTH_DOWNLOAD"` - `"BANDWIDTH_UPLOAD"` - `"LATENCY_IDLE"` - `"LATENCY_LOADED"` - `"JITTER_IDLE"` - `"JITTER_LOADED"` - `reverse: optional boolean` Reverses the order of results. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { bandwidthDownload, bandwidthUpload, clientCountryAlpha2, 7 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `clientCountryAlpha2: string` - `clientCountryName: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `numTests: number` - `rankPower: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/quality/speed/top/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "bandwidthDownload": "295.886073", "bandwidthUpload": "158.85269", "clientCountryAlpha2": "IS", "clientCountryName": "Iceland", "jitterIdle": "9.640685", "jitterLoaded": "46.480023", "latencyIdle": "15.208124", "latencyLoaded": "114.758887", "numTests": 13123, "rankPower": 0.77 } ] }, "success": true } ``` ## Domain Types ### Top Ases Response - `TopAsesResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { bandwidthDownload, bandwidthUpload, clientASN, 7 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `clientASN: number` - `clientASName: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `numTests: number` - `rankPower: number` ### Top Locations Response - `TopLocationsResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { bandwidthDownload, bandwidthUpload, clientCountryAlpha2, 7 more }` - `bandwidthDownload: string` - `bandwidthUpload: string` - `clientCountryAlpha2: string` - `clientCountryName: string` - `jitterIdle: string` - `jitterLoaded: string` - `latencyIdle: string` - `latencyLoaded: string` - `numTests: number` - `rankPower: number` # Ranking ## Get domains rank time series **get** `/radar/ranking/timeseries_groups` Retrieves domains rank over time. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `domainCategory: optional array of string` Filters results by domain category. - `domains: optional array of string` Filters results by domain name. Specify a comma-separated list of domain names. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `name: optional array of string` Array of names used to label the series in the response. - `rankingType: optional "POPULAR" or "TRENDING_RISE" or "TRENDING_STEADY"` The ranking type. - `"POPULAR"` - `"TRENDING_RISE"` - `"TRENDING_STEADY"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/timeseries_groups \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get top or trending domains **get** `/radar/ranking/top` Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `domainCategory: optional array of string` Filters results by domain category. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 location codes. - `name: optional array of string` Array of names used to label the series in the response. - `rankingType: optional "POPULAR" or "TRENDING_RISE" or "TRENDING_STEADY"` The ranking type. - `"POPULAR"` - `"TRENDING_RISE"` - `"TRENDING_STEADY"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { categories, domain, rank, pctRankChange }` - `categories: array of object { id, name, superCategoryId }` - `id: number` - `name: string` - `superCategoryId: number` - `domain: string` - `rank: number` - `pctRankChange: optional number` Only available in TRENDING rankings. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/top \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "categories": [ { "id": 81, "name": "Content Servers", "superCategoryId": 26 } ], "domain": "google.com", "rank": 1, "pctRankChange": 10.8 } ] }, "success": true } ``` ## Domain Types ### Ranking Timeseries Groups Response - `RankingTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Ranking Top Response - `RankingTopResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { categories, domain, rank, pctRankChange }` - `categories: array of object { id, name, superCategoryId }` - `id: number` - `name: string` - `superCategoryId: number` - `domain: string` - `rank: number` - `pctRankChange: optional number` Only available in TRENDING rankings. # Domain ## Get domain rank details **get** `/radar/ranking/domain/{domain}` Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints. ### Path Parameters - `domain: string` Domain name. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `includeTopLocations: optional boolean` Includes top locations in the response. - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `rankingType: optional "POPULAR" or "TRENDING_RISE" or "TRENDING_STEADY"` The ranking type. - `"POPULAR"` - `"TRENDING_RISE"` - `"TRENDING_STEADY"` ### Returns - `result: object { details_0, meta }` - `details_0: object { categories, bucket, rank, top_locations }` - `categories: array of object { id, name, superCategoryId }` - `id: number` - `name: string` - `superCategoryId: number` - `bucket: optional string` Only available in POPULAR ranking for the most recent ranking. - `rank: optional number` - `top_locations: optional array of object { locationCode, locationName, rank }` - `locationCode: string` - `locationName: string` - `rank: number` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/domain/$DOMAIN \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "details_0": { "categories": [ { "id": 81, "name": "Content Servers", "superCategoryId": 26 } ], "bucket": "2000", "rank": 3, "top_locations": [ { "locationCode": "US", "locationName": "United States", "rank": 1 } ] }, "meta": { "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ] } }, "success": true } ``` ## Domain Types ### Domain Get Response - `DomainGetResponse = object { details_0, meta }` - `details_0: object { categories, bucket, rank, top_locations }` - `categories: array of object { id, name, superCategoryId }` - `id: number` - `name: string` - `superCategoryId: number` - `bucket: optional string` Only available in POPULAR ranking for the most recent ranking. - `rank: optional number` - `top_locations: optional array of object { locationCode, locationName, rank }` - `locationCode: string` - `locationName: string` - `rank: number` - `meta: object { dateRange }` - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. # Internet Services ## Get Internet services rank time series **get** `/radar/ranking/internet_services/timeseries_groups` Retrieves Internet Services rank update changes over time. ### Query Parameters - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `serviceCategory: optional array of string` Filters results by Internet service category. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/internet_services/timeseries_groups \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get top Internet services **get** `/radar/ranking/internet_services/top` Retrieves top Internet services based on their rank. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `serviceCategory: optional array of string` Filters results by Internet service category. ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, service }` - `rank: number` - `service: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/internet_services/top \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "rank": 1, "service": "Google" } ] }, "success": true } ``` ## List Internet services categories **get** `/radar/ranking/internet_services/categories` Retrieves the list of Internet services categories. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { categories_0 }` - `categories_0: array of object { name }` - `name: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/ranking/internet_services/categories \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "categories_0": [ { "name": "Generative AI" } ] }, "success": true } ``` ## Domain Types ### Internet Service Timeseries Groups Response - `InternetServiceTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` ### Internet Service Top Response - `InternetServiceTopResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { rank, service }` - `rank: number` - `service: string` ### Internet Service Categories Response - `InternetServiceCategoriesResponse = object { categories_0 }` - `categories_0: array of object { name }` - `name: string` # Traffic Anomalies ## Get latest Internet traffic anomalies **get** `/radar/traffic_anomalies` Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team. ### Query Parameters - `asn: optional number` Filters results by Autonomous System. Specify a single Autonomous System Number (ASN) as integer. - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional string` Filters results by location. Specify an alpha-2 location code. - `offset: optional number` Skips the specified number of objects before fetching the results. - `origin: optional string` Filters results by origin. - `status: optional "VERIFIED" or "UNVERIFIED"` - `"VERIFIED"` - `"UNVERIFIED"` - `type: optional array of "LOCATION" or "AS" or "ORIGIN"` Filters results by entity type (LOCATION, AS, or ORIGIN). - `"LOCATION"` - `"AS"` - `"ORIGIN"` ### Returns - `result: object { trafficAnomalies }` - `trafficAnomalies: array of object { startDate, status, type, 6 more }` - `startDate: string` - `status: string` - `type: string` - `uuid: string` - `asnDetails: optional object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `endDate: optional string` - `locationDetails: optional object { code, name }` - `code: string` - `name: string` - `originDetails: optional object { name, origin }` - `name: string` - `origin: string` - `visibleInDataSources: optional array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/traffic_anomalies \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "trafficAnomalies": [ { "startDate": "2023-08-02T23:15:00Z", "status": "UNVERIFIED", "type": "LOCATION", "uuid": "55a57f33-8bc0-4984-b4df-fdaff72df39d", "asnDetails": { "asn": "189", "name": "LUMEN-LEGACY-L3-PARTITION", "locations": { "code": "US", "name": "United States" } }, "endDate": "2019-12-27T18:11:19.117Z", "locationDetails": { "code": "US", "name": "United States" }, "originDetails": { "name": "us-east-1 Amazon Web Services", "origin": "amazon-us-east-1" }, "visibleInDataSources": [ "string" ] } ] }, "success": true } ``` ## Domain Types ### Traffic Anomaly Get Response - `TrafficAnomalyGetResponse = object { trafficAnomalies }` - `trafficAnomalies: array of object { startDate, status, type, 6 more }` - `startDate: string` - `status: string` - `type: string` - `uuid: string` - `asnDetails: optional object { asn, name, locations }` - `asn: string` - `name: string` - `locations: optional object { code, name }` - `code: string` - `name: string` - `endDate: optional string` - `locationDetails: optional object { code, name }` - `code: string` - `name: string` - `originDetails: optional object { name, origin }` - `name: string` - `origin: string` - `visibleInDataSources: optional array of string` # Locations ## Get top locations by total traffic anomalies **get** `/radar/traffic_anomalies/locations` Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team. ### Query Parameters - `dateEnd: optional string` End of the date range (inclusive). - `dateRange: optional string` Filters results by date range. - `dateStart: optional string` Start of the date range (inclusive). - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `status: optional "VERIFIED" or "UNVERIFIED"` - `"VERIFIED"` - `"UNVERIFIED"` ### Returns - `result: object { trafficAnomalies }` - `trafficAnomalies: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/traffic_anomalies/locations \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "trafficAnomalies": [ { "clientCountryAlpha2": "PT", "clientCountryName": "Portugal", "value": "10" } ] }, "success": true } ``` ## Domain Types ### Location Get Response - `LocationGetResponse = object { trafficAnomalies }` - `trafficAnomalies: array of object { clientCountryAlpha2, clientCountryName, value }` - `clientCountryAlpha2: string` - `clientCountryName: string` - `value: string` A numeric string. # TCP Resets Timeouts ## Get TCP resets and timeouts summary **get** `/radar/tcp_resets_timeouts/summary` Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { later_in_flow, no_match, post_ack, 2 more }` - `later_in_flow: string` Connection resets within the first 10 packets from the client, but after the server has received multiple data packets. - `no_match: string` All other connections. - `post_ack: string` Connection resets or timeouts after the server received both a SYN packet and an ACK packet, meaning the connection was successfully established. - `post_psh: string` Connection resets or timeouts after the server received a packet with PSH flag set, following connection establishment. - `post_syn: string` Connection resets or timeouts after the server received only a single SYN packet. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/tcp_resets_timeouts/summary \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "later_in_flow": "10", "no_match": "65", "post_ack": "5", "post_psh": "10", "post_syn": "10" } }, "success": true } ``` ## Get TCP resets and timeouts time series **get** `/radar/tcp_resets_timeouts/timeseries_groups` Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { later_in_flow, no_match, post_ack, 3 more }` - `later_in_flow: array of string` - `no_match: array of string` - `post_ack: array of string` - `post_psh: array of string` - `post_syn: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/tcp_resets_timeouts/timeseries_groups \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "later_in_flow": [ "10" ], "no_match": [ "65" ], "post_ack": [ "5" ], "post_psh": [ "10" ], "post_syn": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Domain Types ### TCP Resets Timeout Summary Response - `TCPResetsTimeoutSummaryResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { later_in_flow, no_match, post_ack, 2 more }` - `later_in_flow: string` Connection resets within the first 10 packets from the client, but after the server has received multiple data packets. - `no_match: string` All other connections. - `post_ack: string` Connection resets or timeouts after the server received both a SYN packet and an ACK packet, meaning the connection was successfully established. - `post_psh: string` Connection resets or timeouts after the server received a packet with PSH flag set, following connection establishment. - `post_syn: string` Connection resets or timeouts after the server received only a single SYN packet. ### TCP Resets Timeout Timeseries Groups Response - `TCPResetsTimeoutTimeseriesGroupsResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { later_in_flow, no_match, post_ack, 3 more }` - `later_in_flow: array of string` - `no_match: array of string` - `post_ack: array of string` - `post_psh: array of string` - `post_syn: array of string` - `timestamps: array of string` # TLDs ## List TLDs **get** `/radar/tlds` Retrieves a list of TLDs. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `offset: optional number` Skips the specified number of objects before fetching the results. - `tld: optional string` Filters results by top-level domain. Specify a comma-separated list of TLDs. - `tldManager: optional string` Filters results by TLD manager. - `tldType: optional "GENERIC" or "COUNTRY_CODE" or "GENERIC_RESTRICTED" or 2 more` Filters results by TLD type. - `"GENERIC"` - `"COUNTRY_CODE"` - `"GENERIC_RESTRICTED"` - `"INFRASTRUCTURE"` - `"SPONSORED"` ### Returns - `result: object { tlds }` - `tlds: array of object { manager, tld, type }` - `manager: string` The organization that manages the TLD. - `tld: string` The actual TLD. - `type: string` The type of TLD. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/tlds \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "tlds": [ { "manager": "VeriSign Global Registry Services", "tld": "com", "type": "GENERIC" } ] }, "success": true } ``` ## Get TLD details **get** `/radar/tlds/{tld}` Retrieves the requested TLD information. ### Path Parameters - `tld: string` Top-level domain. ### Query Parameters - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` ### Returns - `result: object { tld }` - `tld: object { manager, tld, type }` - `manager: string` The organization that manages the TLD. - `tld: string` The actual TLD. - `type: string` The type of TLD. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/tlds/$TLD \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "tld": { "manager": "VeriSign Global Registry Services", "tld": "com", "type": "GENERIC" } }, "success": true } ``` ## Domain Types ### TLD List Response - `TLDListResponse = object { tlds }` - `tlds: array of object { manager, tld, type }` - `manager: string` The organization that manages the TLD. - `tld: string` The actual TLD. - `type: string` The type of TLD. ### TLD Get Response - `TLDGetResponse = object { tld }` - `tld: object { manager, tld, type }` - `manager: string` The organization that manages the TLD. - `tld: string` The actual TLD. - `type: string` The type of TLD. # Robots TXT # Top ## Get top domain categories by robots.txt files parsed **get** `/radar/robots_txt/top/domain_categories` Retrieves the top domain categories by the number of robots.txt files parsed. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `userAgentCategory: optional "AI"` Filters results by user agent category. - `"AI"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/robots_txt/top/domain_categories \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "News & Media", "value": 273 } ] }, "success": true } ``` ## Domain Types ### Top Domain Categories Response - `TopDomainCategoriesResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value }` - `name: string` - `value: number` # User Agents ## Get top user agents on robots.txt files **get** `/radar/robots_txt/top/user_agents/directive` Retrieves the top user agents on robots.txt files. ### Query Parameters - `date: optional array of string` Filters results by the specified array of dates. - `directive: optional "ALLOW" or "DISALLOW"` Filters results by robots.txt directive. - `"ALLOW"` - `"DISALLOW"` - `domainCategory: optional array of string` Filters results by domain category. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `name: optional array of string` Array of names used to label the series in the response. - `userAgentCategory: optional "AI"` Filters results by user agent category. - `"AI"` ### Returns - `result: object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value, fully, partially }` - `name: string` - `value: number` - `fully: optional number` - `partially: optional number` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/robots_txt/top/user_agents/directive \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "GPTBot", "value": 273, "fully": 235, "partially": 38 } ] }, "success": true } ``` ## Domain Types ### User Agent Directive Response - `UserAgentDirectiveResponse = object { meta, top_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of object { name, value, fully, partially }` - `name: string` - `value: number` - `fully: optional number` - `partially: optional number` # Leaked Credentials ## Get HTTP authentication requests distribution by dimension **get** `/radar/leaked_credential_checks/summary/{dimension}` Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. ### Path Parameters - `dimension: "COMPROMISED" or "BOT_CLASS"` Specifies the attribute by which to group the results. - `"COMPROMISED"` - `"BOT_CLASS"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `compromised: optional array of "CLEAN" or "COMPROMISED"` Filters results by compromised credential status (clean vs. compromised). - `"CLEAN"` - `"COMPROMISED"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "CLEAN": "85.123456", "COMPROMISED": "14.876544" } }, "success": true } ``` ## Get time series distribution of HTTP authentication requests by dimension. **get** `/radar/leaked_credential_checks/timeseries_groups/{dimension}` Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. ### Path Parameters - `dimension: "COMPROMISED" or "BOT_CLASS"` Specifies the attribute by which to group the results. - `"COMPROMISED"` - `"BOT_CLASS"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `checkResult: optional array of "CLEAN" or "USERNAME_LEAKED" or "USERNAME_PASSWORD_SIMILAR" or 2 more` Filters results by leaked credential check result. - `"CLEAN"` - `"USERNAME_LEAKED"` - `"USERNAME_PASSWORD_SIMILAR"` - `"USERNAME_AND_PASSWORD_LEAKED"` - `"PASSWORD_LEAKED"` - `compromised: optional array of "CLEAN" or "COMPROMISED"` Filters results by compromised credential status (clean vs. compromised). - `"CLEAN"` - `"COMPROMISED"` - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Leaked Credential Summary V2 Response - `LeakedCredentialSummaryV2Response = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Leaked Credential Timeseries Groups V2 Response - `LeakedCredentialTimeseriesGroupsV2Response = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { timestamps }` - `timestamps: array of string` # Summary ## Get HTTP authentication requests by bot class summary **get** `/radar/leaked_credential_checks/summary/bot_class` Retrieves the distribution of HTTP authentication requests by bot class. ### Query Parameters - `compromised: optional array of "CLEAN" or "COMPROMISED"` Filters results by compromised credential status (clean vs. compromised). - `"CLEAN"` - `"COMPROMISED"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bot, human }` - `bot: string` A numeric string. - `human: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/summary/bot_class \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "bot": "10", "human": "10" } }, "success": true } ``` ## Get HTTP authentication requests by compromised credential status summary **get** `/radar/leaked_credential_checks/summary/compromised` Retrieves the distribution of HTTP authentication requests by compromised credential status. ### Query Parameters - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { CLEAN, COMPROMISED }` - `CLEAN: string` A numeric string. - `COMPROMISED: string` A numeric string. - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/summary/compromised \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "CLEAN": "10", "COMPROMISED": "10" } }, "success": true } ``` ## Domain Types ### Summary Bot Class Response - `SummaryBotClassResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { bot, human }` - `bot: string` A numeric string. - `human: string` A numeric string. ### Summary Compromised Response - `SummaryCompromisedResponse = object { meta, summary_0 }` - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: object { CLEAN, COMPROMISED }` - `CLEAN: string` A numeric string. - `COMPROMISED: string` A numeric string. # Timeseries Groups ## Get HTTP authentication requests by bot class time series **get** `/radar/leaked_credential_checks/timeseries_groups/bot_class` Retrieves the distribution of HTTP authentication requests by bot class over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `compromised: optional array of "CLEAN" or "COMPROMISED"` Filters results by compromised credential status (clean vs. compromised). - `"CLEAN"` - `"COMPROMISED"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { bot, human, timestamps }` - `bot: array of string` - `human: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/timeseries_groups/bot_class \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "bot": [ "10" ], "human": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get HTTP authentication requests by compromised credential status time series **get** `/radar/leaked_credential_checks/timeseries_groups/compromised` Retrieves the distribution of HTTP authentication requests by compromised credential status over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `botClass: optional array of "LIKELY_AUTOMATED" or "LIKELY_HUMAN"` Filters results by bot class. Refer to [Bot classes](https://developers.cloudflare.com/radar/concepts/bot-classes/). - `"LIKELY_AUTOMATED"` - `"LIKELY_HUMAN"` - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { CLEAN, COMPROMISED, timestamps }` - `CLEAN: array of string` - `COMPROMISED: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/leaked_credential_checks/timeseries_groups/compromised \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "CLEAN": [ "10" ], "COMPROMISED": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Bot Class Response - `TimeseriesGroupBotClassResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { bot, human, timestamps }` - `bot: array of string` - `human: array of string` - `timestamps: array of string` ### Timeseries Group Compromised Response - `TimeseriesGroupCompromisedResponse = object { meta, serie_0 }` - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: object { annotations, level }` - `annotations: array of object { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of object { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of object { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: object { CLEAN, COMPROMISED, timestamps }` - `CLEAN: array of string` - `COMPROMISED: array of string` - `timestamps: array of string`