API Reference

Spectrum

Analytics

Events

Bytimes

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Get analytics by time

GET/zones/{zone_id}/spectrum/analytics/events/bytime

Retrieves a list of aggregate metrics grouped by time interval.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Analytics Read

Path ParametersExpand Collapse

zone_id: string

Identifier.

maxLength32

Query ParametersExpand Collapse

time_delta: "year" or "quarter" or "month" or 5 more

Used to select time series resolution.

One of the following:

"year"

"quarter"

"month"

"week"

"day"

"hour"

"dekaminute"

"minute"

dimensions: optional array of Dimension

Can be used to break down the data by given attributes. Options are:

Dimension	Name	Example
event	Connection Event	connect, progress, disconnect, originError, clientFiltered
appID	Application ID	40d67c87c6cd4b889a4fd57805225e85
coloName	Colo Name	SFO
ipVersion	IP version used by the client	4, 6.

One of the following:

"event"

"appID"

"coloName"

"ipVersion"

filters: optional string

Used to filter rows by one or more dimensions. Filters can be combined using OR and AND boolean logic. AND takes precedence over OR in all the expressions. The OR operator is defined using a comma (,) or OR keyword surrounded by whitespace. The AND operator is defined using a semicolon (;) or AND keyword surrounded by whitespace. Note that the semicolon is a reserved character in URLs (rfc1738) and needs to be percent-encoded as %3B. Comparison options are:

Operator	Name	URL Encoded
==	Equals	%3D%3D
!=	Does not equals	!%3D
>	Greater Than	%3E
<	Less Than	%3C
>=	Greater than or equal to	%3E%3D
<=	Less than or equal to	%3C%3D

metrics: optional array of "count" or "bytesIngress" or "bytesEgress" or 4 more

One or more metrics to compute. Options are:

Metric	Name	Example	Unit
count	Count of total events	1000	Count
bytesIngress	Sum of ingress bytes	1000	Sum
bytesEgress	Sum of egress bytes	1000	Sum
durationAvg	Average connection duration	1.0	Time in milliseconds
durationMedian	Median connection duration	1.0	Time in milliseconds
duration90th	90th percentile connection duration	1.0	Time in milliseconds
duration99th	99th percentile connection duration	1.0	Time in milliseconds.

One of the following:

"count"

"bytesIngress"

"bytesEgress"

"durationAvg"

"durationMedian"

"duration90th"

"duration99th"

since: optional string

Start of time interval to query, defaults to until - 6 hours. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

sort: optional array of string

The sort order for the result set; sort fields must be included in metrics or dimensions.

until: optional string

End of time interval to query, defaults to current time. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

ReturnsExpand Collapse

errors: array of { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional { pointer }

pointer: optional string

messages: array of { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional { pointer }

pointer: optional string

success: true

Whether the API call was successful.

result: optional { data, data_lag, max, 5 more }

data: array of { dimensions, metrics }

List of columns returned by the analytics query.

dimensions: optional array of string

metrics: optional array of number or array of array of number

One of the following:

array of number

array of array of number

data_lag: number

Number of seconds between current time and last processed event, i.e. how many seconds of data could be missing.

minimum0

max: map[number]

Maximum result for each selected metrics across all data.

min: map[number]

Minimum result for each selected metrics across all data.

query: { dimensions, filters, limit, 4 more }

dimensions: optional array of Dimension

Can be used to break down the data by given attributes. Options are:

Dimension	Name	Example
event	Connection Event	connect, progress, disconnect, originError, clientFiltered
appID	Application ID	40d67c87c6cd4b889a4fd57805225e85
coloName	Colo Name	SFO
ipVersion	IP version used by the client	4, 6.

One of the following:

"event"

"appID"

"coloName"

"ipVersion"

filters: optional string

Used to filter rows by one or more dimensions. Filters can be combined using OR and AND boolean logic. AND takes precedence over OR in all the expressions. The OR operator is defined using a comma (,) or OR keyword surrounded by whitespace. The AND operator is defined using a semicolon (;) or AND keyword surrounded by whitespace. Note that the semicolon is a reserved character in URLs (rfc1738) and needs to be percent-encoded as %3B. Comparison options are:

Operator	Name	URL Encoded
==	Equals	%3D%3D
!=	Does not equals	!%3D
>	Greater Than	%3E
<	Less Than	%3C
>=	Greater than or equal to	%3E%3D
<=	Less than or equal to	%3C%3D

limit: optional number

Limit number of returned metrics.

metrics: optional array of "count" or "bytesIngress" or "bytesEgress" or 4 more

One or more metrics to compute. Options are:

Metric	Name	Example	Unit
count	Count of total events	1000	Count
bytesIngress	Sum of ingress bytes	1000	Sum
bytesEgress	Sum of egress bytes	1000	Sum
durationAvg	Average connection duration	1.0	Time in milliseconds
durationMedian	Median connection duration	1.0	Time in milliseconds
duration90th	90th percentile connection duration	1.0	Time in milliseconds
duration99th	99th percentile connection duration	1.0	Time in milliseconds.

One of the following:

"count"

"bytesIngress"

"bytesEgress"

"durationAvg"

"durationMedian"

"duration90th"

"duration99th"

since: optional string

Start of time interval to query, defaults to until - 6 hours. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

sort: optional array of string

The sort order for the result set; sort fields must be included in metrics or dimensions.

until: optional string

End of time interval to query, defaults to current time. Timestamp must be in RFC3339 format and uses UTC unless otherwise specified.

formatdate-time

rows: number

Total number of rows in the result.

minimum0

totals: map[number]

Total result for each selected metrics across all data.

time_intervals: optional array of array of string

List of time interval buckets: [start, end]

Get analytics by time

HTTP

HTTP

TypeScript

Python

Go

Terraform

curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/spectrum/analytics/events/bytime \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

200 example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "data": [
      {
        "dimensions": [
          "string"
        ],
        "metrics": [
          0
        ]
      }
    ],
    "data_lag": 3,
    "max": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "min": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "query": {
      "dimensions": [
        "event",
        "appID"
      ],
      "filters": "event==disconnect%20AND%20coloName!=SFO",
      "limit": 0,
      "metrics": [
        "count",
        "bytesIngress"
      ],
      "since": "2014-01-01T05:20:00.12345Z",
      "sort": [
        "+count",
        "-bytesIngress"
      ],
      "until": "2014-01-01T05:20:00.12345Z"
    },
    "rows": 5,
    "totals": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "time_intervals": [
      [
        "2014-01-01T05:20:00.12345Z"
      ]
    ]
  }
}

Returns Examples

200 example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "data": [
      {
        "dimensions": [
          "string"
        ],
        "metrics": [
          0
        ]
      }
    ],
    "data_lag": 3,
    "max": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "min": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "query": {
      "dimensions": [
        "event",
        "appID"
      ],
      "filters": "event==disconnect%20AND%20coloName!=SFO",
      "limit": 0,
      "metrics": [
        "count",
        "bytesIngress"
      ],
      "since": "2014-01-01T05:20:00.12345Z",
      "sort": [
        "+count",
        "-bytesIngress"
      ],
      "until": "2014-01-01T05:20:00.12345Z"
    },
    "rows": 5,
    "totals": {
      "bytesEgress": 100,
      "bytesIngress": 50
    },
    "time_intervals": [
      [
        "2014-01-01T05:20:00.12345Z"
      ]
    ]
  }
}