Retrieves the collection of traffic-log resources.
Retrieves the collection of traffic-log resources.
Authorizations
Long-lived API token created via POST /api/api-tokens (returned once in plaintext). A token created with readOnly may only perform safe requests (GET, HEAD, OPTIONS); write requests are rejected on every endpoint.
JWT access token obtained via POST /api/auth/login. Send as: Authorization: Bearer
Parameters
Path Parameters
Organization identifier
Query Parameters
The collection page number
1The number of items per page
300100Window start, unix seconds (default: 15 minutes before "to").
Window end, unix seconds (default: now).
Restrict to these zones (must belong to the organization). Omit for all the org's zones.
Sort by event_time (default desc). Any field is sortable via order[
"asc""desc"Filter by status_code (also status_code[neq]/[nin]/[gte]/[lt]/…; [nin] takes a comma-separated list). Any raw field is filterable.
Filter by host (host[like]=… for substring, host[neq]=… to exclude).
Filter by client IP address (client_ip[like]=… for substring, client_ip[nin]=… to exclude a comma-separated list).
Filter by cache status, e.g. HIT, MISS or BYPASS (cache_status[nin]=… to exclude a comma-separated list).
Filter by HTTP method, e.g. GET, POST or HEAD (method[nin]=… to exclude a comma-separated list).
Filter by client country as a two-letter ISO code, e.g. DE (geo_country[nin]=… to exclude a comma-separated list).
Filter by User-Agent (user_agent[like]=… for a case-sensitive substring, e.g. user_agent[like]=bot).
Filter by WAF rule verdict: block, challenge, throttle, skip, log or shadow.
Case-insensitive substring search on host/uri/client_ip/request_id.
Responses
traffic-log collection