# Layer7 ## Get layer 7 attacks summary by dimension **get** `/radar/attacks/layer7/summary/{dimension}` Retrieves the distribution of layer 7 attacks by the specified dimension. ### Path Parameters - `dimension: "HTTP_METHOD" or "HTTP_VERSION" or "IP_VERSION" or 4 more` Specifies the attribute by which to group the results. - `"HTTP_METHOD"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"MANAGED_RULES"` - `"MITIGATION_PRODUCT"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "GET": "50.168733", "POST": "25.084366" } }, "success": true } ``` ## Get layer 7 attacks time series **get** `/radar/attacks/layer7/timeseries` Retrieves layer 7 attacks over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE_CHANGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE_CHANGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps, values }` - `timestamps: array of string` - `values: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2019-12-27T18:11:19.117Z" ], "values": [ "10" ] } }, "success": true } ``` ## Get layer 7 attacks time series grouped by dimension **get** `/radar/attacks/layer7/timeseries_groups/{dimension}` Retrieves the distribution of layer 7 attacks grouped by dimension over time. ### Path Parameters - `dimension: "HTTP_METHOD" or "HTTP_VERSION" or "IP_VERSION" or 4 more` Specifies the attribute by which to group the results. - `"HTTP_METHOD"` - `"HTTP_VERSION"` - `"IP_VERSION"` - `"MANAGED_RULES"` - `"MITIGATION_PRODUCT"` - `"VERTICAL"` - `"INDUSTRY"` ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/$DIMENSION \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Layer7 Summary V2 Response - `Layer7SummaryV2Response { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Layer7 Timeseries Response - `Layer7TimeseriesResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps, values }` - `timestamps: array of string` - `values: array of string` ### Layer7 Timeseries Groups V2 Response - `Layer7TimeseriesGroupsV2Response { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` # Summary ## Get layer 7 attacks by IP version summary **get** `/radar/attacks/layer7/summary/ip_version` Retrieves the distribution of layer 7 attacks by IP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: { IPv4, IPv6 }` - `IPv4: string` - `IPv6: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "IPv4": "99.935733", "IPv6": "0.064267" } }, "success": true } ``` ## Get layer 7 attacks by HTTP method summary **get** `/radar/attacks/layer7/summary/http_method` Retrieves the distribution of layer 7 attacks by HTTP method. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/http_method \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "GET": "99.100257", "POST": "0.899743" } }, "success": true } ``` ## Get layer 7 attacks by HTTP version summary **get** `/radar/attacks/layer7/summary/http_version` Retrieves the distribution of layer 7 attacks by HTTP version. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` - `"HTTP/2": string` - `"HTTP/3": string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP/1.x": "21.722365", "HTTP/2": "77.056555", "HTTP/3": "1.22108" } }, "success": true } ``` ## Get layer 7 attacks by managed rules summary **get** `/radar/attacks/layer7/summary/managed_rules` Retrieves the distribution of layer 7 attacks by managed rules. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/managed_rules \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "HTTP Anomaly": "85.714286", "XSS": "10.274394" } }, "success": true } ``` ## Get layer 7 attacks by mitigation product summary **get** `/radar/attacks/layer7/summary/mitigation_product` Retrieves the distribution of layer 7 attacks by mitigation product. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/mitigation_product \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "DDOS": "24.421594", "WAF": "53.213368" } }, "success": true } ``` ## Get layer 7 attacks by targeted industry summary **get** `/radar/attacks/layer7/summary/industry` Retrieves the distribution of layer 7 attacks by targeted industry. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Computer Software": "65" } }, "success": true } ``` ## Get layer 7 attacks by targeted vertical summary **get** `/radar/attacks/layer7/summary/vertical` Retrieves the distribution of layer 7 attacks by targeted vertical. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/summary/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "summary_0": { "Internet and Telecom": "5.519081" } }, "success": true } ``` ## Domain Types ### Summary IP Version Response - `SummaryIPVersionResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: { IPv4, IPv6 }` - `IPv4: string` - `IPv6: string` ### Summary HTTP Method Response - `SummaryHTTPMethodResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary HTTP Version Response - `SummaryHTTPVersionResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: { "HTTP/1.x", "HTTP/2", "HTTP/3" }` - `"HTTP/1.x": string` - `"HTTP/2": string` - `"HTTP/3": string` ### Summary Managed Rules Response - `SummaryManagedRulesResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Mitigation Product Response - `SummaryMitigationProductResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Industry Response - `SummaryIndustryResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` ### Summary Vertical Response - `SummaryVerticalResponse { meta, summary_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `summary_0: map[string]` # Timeseries Groups ## Get layer 7 attacks by target industries time series **get** `/radar/attacks/layer7/timeseries_groups/industry` Retrieves the distribution of layer 7 attacks by targeted industry over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by IP version time series **get** `/radar/attacks/layer7/timeseries_groups/ip_version` Retrieves the distribution of layer 7 attacks by IP version used over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/ip_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "IPv4": [ "10" ], "IPv6": [ "10" ], "timestamps": [ "2019-12-27T18:11:19.117Z" ] } }, "success": true } ``` ## Get layer 7 attacks by vertical time series **get** `/radar/attacks/layer7/timeseries_groups/vertical` Retrieves the distribution of layer 7 attacks by targeted vertical over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by HTTP method time series **get** `/radar/attacks/layer7/timeseries_groups/http_method` Retrieves the distribution of layer 7 attacks by HTTP method over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/http_method \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by HTTP version time series **get** `/radar/attacks/layer7/timeseries_groups/http_version` Retrieves the distribution of layer 7 attacks by HTTP version over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/http_version \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "HTTP/1.x": [ "50.338734" ], "HTTP/2": [ "48.661266" ], "HTTP/3": [ "1.22108" ], "timestamps": [ "2023-10-01T00:00:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by managed rules time series **get** `/radar/attacks/layer7/timeseries_groups/managed_rules` Retrieves the distribution of layer 7 attacks by managed rules over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/managed_rules \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Get layer 7 attacks by mitigation product time series **get** `/radar/attacks/layer7/timeseries_groups/mitigation_product` Retrieves the distribution of layer 7 attacks by mitigation product over time. ### Query Parameters - `aggInterval: optional "15m" or "1h" or "1d" or "1w"` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"15m"` - `"1h"` - `"1d"` - `"1w"` - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limitPerGroup: optional number` Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN0_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` ### Returns - `result: { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/timeseries_groups/mitigation_product \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ## Domain Types ### Timeseries Group Industry Response - `TimeseriesGroupIndustryResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` ### Timeseries Group IP Version Response - `TimeseriesGroupIPVersionResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { IPv4, IPv6, timestamps }` - `IPv4: array of string` - `IPv6: array of string` - `timestamps: array of string` ### Timeseries Group Vertical Response - `TimeseriesGroupVerticalResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` ### Timeseries Group HTTP Method Response - `TimeseriesGroupHTTPMethodResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` ### Timeseries Group HTTP Version Response - `TimeseriesGroupHTTPVersionResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { "HTTP/1.x", "HTTP/2", "HTTP/3", timestamps }` - `"HTTP/1.x": array of string` - `"HTTP/2": array of string` - `"HTTP/3": array of string` - `timestamps: array of string` ### Timeseries Group Managed Rules Response - `TimeseriesGroupManagedRulesResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` ### Timeseries Group Mitigation Product Response - `TimeseriesGroupMitigationProductResponse { meta, serie_0 }` - `meta: { aggInterval, confidenceInfo, dateRange, 3 more }` Metadata for the results. - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more` Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://developers.cloudflare.com/radar/concepts/aggregation-intervals/). - `"FIFTEEN_MINUTES"` - `"ONE_HOUR"` - `"ONE_DAY"` - `"ONE_WEEK"` - `"ONE_MONTH"` - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `serie_0: { timestamps }` - `timestamps: array of string` # Top ## Get top layer 7 attack pairs (origin and target locations) **get** `/radar/attacks/layer7/top/attacks` Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `limitDirection: optional "ORIGIN" or "TARGET"` Specifies whether the `limitPerLocation` applies to the source or target location. - `"ORIGIN"` - `"TARGET"` - `limitPerLocation: optional number` Limits the number of attacks per origin/target (refer to `limitDirection` parameter) location. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. - `normalization: optional "PERCENTAGE" or "MIN_MAX"` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN_MAX"` ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originCountryAlpha2, originCountryName, targetCountryAlpha2, 2 more }` - `originCountryAlpha2: string` - `originCountryName: string` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/attacks \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "US", "originCountryName": "United States", "targetCountryAlpha2": "FR", "targetCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Get top industries targeted by layer 7 attacks **get** `/radar/attacks/layer7/top/industry` This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/industry \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Computer Software", "value": "65" } ] }, "success": true } ``` ## Get top verticals targeted by layer 7 attacks **get** `/radar/attacks/layer7/top/vertical` This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { name, value }` - `name: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/vertical \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "name": "Internet and Telecom", "value": "65" } ] }, "success": true } ``` ## Domain Types ### Top Attacks Response - `TopAttacksResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originCountryAlpha2, originCountryName, targetCountryAlpha2, 2 more }` - `originCountryAlpha2: string` - `originCountryName: string` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` ### Top Industry Response - `TopIndustryResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { name, value }` - `name: string` - `value: string` ### Top Vertical Response - `TopVerticalResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { name, value }` - `name: string` - `value: string` # Locations ## Get top origin locations of layer 7 attacks **get** `/radar/attacks/layer7/top/locations/origin` Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. ### Query Parameters - `asn: optional array of string` Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356. - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/locations/origin \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originCountryAlpha2": "FR", "originCountryName": "France", "rank": 1, "value": "4.323214" } ] }, "success": true } ``` ## Get top target locations of layer 7 attacks **get** `/radar/attacks/layer7/top/locations/target` Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `limit: optional number` Limits the number of objects returned in the response. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/locations/target \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "rank": 1, "targetCountryAlpha2": "FR", "targetCountryName": "France", "value": "4.323214" } ] }, "success": true } ``` ## Domain Types ### Location Origin Response - `LocationOriginResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originCountryAlpha2, originCountryName, rank, value }` - `originCountryAlpha2: string` - `originCountryName: string` - `rank: number` - `value: string` ### Location Target Response - `LocationTargetResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { rank, targetCountryAlpha2, targetCountryName, value }` - `rank: number` - `targetCountryAlpha2: string` - `targetCountryName: string` - `value: string` # Ases ## Get top origin ASes of layer 7 attacks **get** `/radar/attacks/layer7/top/ases/origin` Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. ### Query Parameters - `continent: optional array of string` Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA. - `dateEnd: optional array of string` End of the date range (inclusive). - `dateRange: optional array of string` Filters results by date range. For example, use `7d` and `7dcontrol` to compare this week with the previous week. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters). - `dateStart: optional array of string` Start of the date range. - `format: optional "JSON" or "CSV"` Format in which results will be returned. - `"JSON"` - `"CSV"` - `httpMethod: optional array of "GET" or "POST" or "DELETE" or 43 more` Filters results by HTTP method. - `"GET"` - `"POST"` - `"DELETE"` - `"PUT"` - `"HEAD"` - `"PURGE"` - `"OPTIONS"` - `"PROPFIND"` - `"MKCOL"` - `"PATCH"` - `"ACL"` - `"BCOPY"` - `"BDELETE"` - `"BMOVE"` - `"BPROPFIND"` - `"BPROPPATCH"` - `"CHECKIN"` - `"CHECKOUT"` - `"CONNECT"` - `"COPY"` - `"LABEL"` - `"LOCK"` - `"MERGE"` - `"MKACTIVITY"` - `"MKWORKSPACE"` - `"MOVE"` - `"NOTIFY"` - `"ORDERPATCH"` - `"POLL"` - `"PROPPATCH"` - `"REPORT"` - `"SEARCH"` - `"SUBSCRIBE"` - `"TRACE"` - `"UNCHECKOUT"` - `"UNLOCK"` - `"UNSUBSCRIBE"` - `"UPDATE"` - `"VERSIONCONTROL"` - `"BASELINECONTROL"` - `"XMSENUMATTS"` - `"RPC_OUT_DATA"` - `"RPC_IN_DATA"` - `"JSON"` - `"COOK"` - `"TRACK"` - `httpVersion: optional array of "HTTPv1" or "HTTPv2" or "HTTPv3"` Filters results by HTTP version. - `"HTTPv1"` - `"HTTPv2"` - `"HTTPv3"` - `ipVersion: optional array of "IPv4" or "IPv6"` Filters results by IP version (Ipv4 vs. IPv6). - `"IPv4"` - `"IPv6"` - `limit: optional number` Limits the number of objects returned in the response. - `location: optional array of string` Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT. - `mitigationProduct: optional array of "DDOS" or "WAF" or "BOT_MANAGEMENT" or 4 more` Filters the results by layer 7 mitigation product. - `"DDOS"` - `"WAF"` - `"BOT_MANAGEMENT"` - `"ACCESS_RULES"` - `"IP_REPUTATION"` - `"API_SHIELD"` - `"DATA_LOSS_PREVENTION"` - `name: optional array of string` Array of names used to label the series in the response. ### Returns - `result: { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originAsn, originAsnName, rank, value }` - `originAsn: string` - `originAsnName: string` - `rank: number` - `value: string` - `success: boolean` ### Example ```http curl https://api.cloudflare.com/client/v4/radar/attacks/layer7/top/ases/origin \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Response ```json { "result": { "meta": { "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "EVENT", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z" } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "top_0": [ { "originAsn": "55836", "originAsnName": "RELIANCEJIO-IN Reliance Jio Infocomm Limited", "rank": 1, "value": "4.323214" } ] }, "success": true } ``` ## Domain Types ### Ase Origin Response - `AseOriginResponse { meta, top_0 }` - `meta: { confidenceInfo, dateRange, lastUpdated, 2 more }` Metadata for the results. - `confidenceInfo: { annotations, level }` - `annotations: array of { dataSource, description, endDate, 4 more }` - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more` Data source for annotations. - `"ALL"` - `"AI_BOTS"` - `"AI_GATEWAY"` - `"BGP"` - `"BOTS"` - `"CONNECTION_ANOMALY"` - `"CT"` - `"DNS"` - `"DNS_MAGNITUDE"` - `"DNS_AS112"` - `"DOS"` - `"EMAIL_ROUTING"` - `"EMAIL_SECURITY"` - `"FW"` - `"FW_PG"` - `"HTTP"` - `"HTTP_CONTROL"` - `"HTTP_CRAWLER_REFERER"` - `"HTTP_ORIGINS"` - `"IQI"` - `"LEAKED_CREDENTIALS"` - `"NET"` - `"ROBOTS_TXT"` - `"SPEED"` - `"WORKERS_AI"` - `description: string` - `endDate: string` - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more` Event type for annotations. - `"EVENT"` - `"GENERAL"` - `"OUTAGE"` - `"PARTIAL_PROJECTION"` - `"PIPELINE"` - `"TRAFFIC_ANOMALY"` - `isInstantaneous: boolean` Whether event is a single point in time or a time range. - `linkedUrl: string` - `startDate: string` - `level: number` Provides an indication of how much confidence Cloudflare has in the data. - `dateRange: array of { endTime, startTime }` - `endTime: string` Adjusted end of date range. - `startTime: string` Adjusted start of date range. - `lastUpdated: string` Timestamp of the last dataset update. - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more` Normalization method applied to the results. Refer to [Normalization methods](https://developers.cloudflare.com/radar/concepts/normalization/). - `"PERCENTAGE"` - `"MIN0_MAX"` - `"MIN_MAX"` - `"RAW_VALUES"` - `"PERCENTAGE_CHANGE"` - `"ROLLING_AVERAGE"` - `"OVERLAPPED_PERCENTAGE"` - `"RATIO"` - `units: array of { name, value }` Measurement units for the results. - `name: string` - `value: string` - `top_0: array of { originAsn, originAsnName, rank, value }` - `originAsn: string` - `originAsnName: string` - `rank: number` - `value: string`