Version 2.1.1792967583 · latest Download OpenAPI Markdown

Reports

Real-time curves, rankings and usage for sites and TCP/UDP forwarding, node monitoring curves and rankings, unconfigured-domain Top, temporary whitelist and access logs; tenants see only their own data.

reportsReportsAuthentication: User (some parameters admin only)44 endpoints

Get today's access log download quota

GET/api/v2/reports/access-log-export-quota

Authentication: User

List access log download requests

GET/api/v2/reports/access-log-exports

Authentication: User

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`

Request an access log download

POST/api/v2/reports/access-log-exports

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
host	string	—	Exact match on request Host (case-insensitive).
server_port	integer	—	Filter by access port.
ip	string	—	Exact match on client address.
uri	string	—	Filter by request URI prefix (must start with /).
referer	string	—	Exact, case-sensitive match on the Referer request header; an empty value (referer=) selects direct visits that sent no Referer.
http_ver	string	—	Filter by HTTP protocol version (same spelling as http_ver in the response). Values `["1.0","1.1","2","3"]`
method	string	—	Filter by request method (upper case, such as GET or POST).
status	integer	—	Filter by status code.
node_id	integer	—	Filter by node.
cache_status	string	—	Filter by cache status. Values `["NONE","HIT","MISS","EXPIRED","STALE","UPDATING","REVALIDATED","BYPASS"]`
country	string	—	Filter by client country (ISO 3166-1 alpha-2, e.g. CN).
prov	string	—	Filter by client province (first two digits of GB/T 2260, e.g. 44).
isp	string	—	Filter by client ISP (telecom, unicom, mobile, cbn, edu, cloud, other).
blocked	boolean	—	true = only blocked requests (action = block).
block_reason	string	—	Filter by block reason, same meaning as block_reason on a log row: region = blocked by region limit, region_log = region limit log-only hit (not blocked), acl = blocked by ACL, other = blocked by other protection. Values `["region","region_log","acl","other"]`
status_class	string	—	Filter by status class: 1xx / 2xx / 3xx / 4xx / 5xx; error = failed requests (status ≥ 400 and not a blocked request). Intersected with status when both are given. Values `["1xx","2xx","3xx","4xx","5xx","error"]`
slow_ms	integer	—	Only slow requests, i.e. request time (request_time_ms) greater than this many milliseconds.
cache_status_not	string	—	Exclude this cache status (negation of cache_status); the miss count in facets equals cache_status_not=HIT. Intersected with cache_status when both are given. Values `["NONE","HIT","MISS","EXPIRED","STALE","UPDATING","REVALIDATED","BYPASS"]`
q	string	—	Contains search: a hit on any of status code (exactly three digits matches the status; 1xx to 5xx matches the class), client IP (contains), URL (contains) or host (contains, case-insensitive) counts; intersected with the other filters.

Get an access log download request

GET/api/v2/reports/access-log-exports/{id}

Authentication: User

Download the access log file

GET/api/v2/reports/access-log-exports/{id}/file

Authentication: User

List access logs

GET/api/v2/reports/access-logs

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
sort	string	—	Sort fields, comma-separated; prefix `-` for descending, e.g. `-created_at,id`
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
cursor	string	—	Time cursor; pass back next_cursor of the previous page (same sort and filters). page is ignored when set.
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
host	string	—	Exact match on request Host (case-insensitive).
server_port	integer	—	Filter by access port.
ip	string	—	Exact match on client address.
uri	string	—	Filter by request URI prefix (must start with /).
referer	string	—	Exact, case-sensitive match on the Referer request header; an empty value (referer=) selects direct visits that sent no Referer.
http_ver	string	—	Filter by HTTP protocol version (same spelling as http_ver in the response). Values `["1.0","1.1","2","3"]`
method	string	—	Filter by request method (upper case, such as GET or POST).
status	integer	—	Filter by status code.
node_id	integer	—	Filter by node.
cache_status	string	—	Filter by cache status. Values `["NONE","HIT","MISS","EXPIRED","STALE","UPDATING","REVALIDATED","BYPASS"]`
country	string	—	Filter by client country (ISO 3166-1 alpha-2, e.g. CN).
prov	string	—	Filter by client province (first two digits of GB/T 2260, e.g. 44).
isp	string	—	Filter by client ISP (telecom, unicom, mobile, cbn, edu, cloud, other).
blocked	boolean	—	true = only blocked requests (action = block).
block_reason	string	—	Filter by block reason, same meaning as block_reason on a log row: region = blocked by region limit, region_log = region limit log-only hit (not blocked), acl = blocked by ACL, other = blocked by other protection. Values `["region","region_log","acl","other"]`
status_class	string	—	Filter by status class: 1xx / 2xx / 3xx / 4xx / 5xx; error = failed requests (status ≥ 400 and not a blocked request). Intersected with status when both are given. Values `["1xx","2xx","3xx","4xx","5xx","error"]`
slow_ms	integer	—	Only slow requests, i.e. request time (request_time_ms) greater than this many milliseconds.
cache_status_not	string	—	Exclude this cache status (negation of cache_status); the miss count in facets equals cache_status_not=HIT. Intersected with cache_status when both are given. Values `["NONE","HIT","MISS","EXPIRED","STALE","UPDATING","REVALIDATED","BYPASS"]`
q	string	—	Contains search: a hit on any of status code (exactly three digits matches the status; 1xx to 5xx matches the class), client IP (contains), URL (contains) or host (contains, case-insensitive) counts; intersected with the other filters.
facets	boolean	—	true / 1 = include facets (counts for each quick filter) in the response. Counted under all filters except the quick ones (status_class, slow_ms, cache_status_not, blocked, block_reason), so they do not move with the quick filter.
total	boolean	—	false / 0 = skip counting the total (the response omits total, saving one full count); defaults to true.

Site checkup overview

GET/api/v2/reports/checkup

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
q	string	—	Search by site name or domain (substring match).
sort	string	—	Sort: score ascending (worst first, default) or name. Values `["score","name"]`
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`

Checkup score history

GET/api/v2/reports/checkup/history

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
site_id	integer	—	Filter by site.

Checkup ignores

GET/api/v2/reports/checkup/ignores

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
site_id	integer	—	Filter by site.

Add or remove checkup ignores in bulk

POST/api/v2/reports/checkup/ignores/batch

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
keys	string[]	Required	Check keys.
op	string	Required	add puts keys on the ignore list (existing ones are untouched); remove takes them off. Values `["add","remove"]`
site_ids	integer[]	Required	Sites to process, at most 500.

Checkup problems grouped by check

GET/api/v2/reports/checkup/issues

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
q	string	—	Search by site name or domain (substring match); only matching sites are counted.

Sites affected by a checkup problem

GET/api/v2/reports/checkup/issues/{key}/sites

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
q	string	—	Search by site name or domain (substring match).
sort	string	—	Sort order: score is lowest checkup score first (default); attacks is most attacks in the last 7 days first (WAF and default-CC problems carry the count, other checks count as 0; ties fall back to score). Values `["score","attacks"]`
type	string	—	rec_type only - filter by site type; undecided lists sites whose type could not be determined (the checkup only noted them and did not count them as problems; this is the only place they are listed). 422 when key is not rec_type. Values `["corporate","shop","content","api","admin","download","undecided"]`
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`

Run the checkup again

POST/api/v2/reports/checkup/recheck

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
site_ids	integer[]	—	Sites to process, at most 500.

The checkup batch in progress

GET/api/v2/reports/checkup/runs/active

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Checkup batch progress

GET/api/v2/reports/checkup/runs/{id}

Authentication: User (some parameters admin only)

Get checkup settings

GET/api/v2/reports/checkup/settings

Authentication: User (some parameters admin only)

Save checkup settings

PUT/api/v2/reports/checkup/settings

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
frequency	string	Required	Frequency: daily at 03:00, weekly on Monday at 03:00, or manual only. Values `["daily","weekly","manual"]`
notify_critical	boolean	Required	Raise an alert when a critical problem appears (uses the channels in alert settings).

Site checkup report

GET/api/v2/reports/checkup/sites/{id}

Authentication: User (some parameters admin only)

Override a site's detected application

PUT/api/v2/reports/checkup/sites/{id}/app

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
name	string	—	Site name.
reset	boolean	—	true clears the override and returns to automatic detection (name and version are ignored).
version	string	—	Application version; may be left empty.

Set a site's checkup ignores

PUT/api/v2/reports/checkup/sites/{id}/ignores

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
keys	string[]	Required	Check keys.

Unconfigured domain Top

GET/api/v2/reports/host-not-found/top

Authentication: Admin only

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
node_id	integer	—	Only entries reported by this node.
domain	string	—	Filter by host substring (case-insensitive, literal match).
kind	HostNotFoundKind	—	Only this kind (kinds are judged by the master, not stored; the top 500 domains by count are judged and filtered before paging, total counts the filtered rows). Values `["site","pointed_here","not_pointed","typo","scanner","unknown"]`
order	string	—	Sort direction by count, default desc. Values `["desc","asc"]`

First and last time a visitor IP was seen

GET/api/v2/reports/ip-seen

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
ip	string	Required	Client address to look up (IPv4 or IPv6).

Node real-time curves

GET/api/v2/reports/nodes/realtime

Authentication: Admin only

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
node_id	integer	Required	Node. A sub-IP id returns the curves of the main node it belongs to (metrics are collected per main node).
metric	string	Required	Node metric (same as node_metrics.metric). tls_hs_reject is the number of TLS handshakes rejected by handshake-flood protection; worker_drain_killed is the number of draining old nginx workers force-terminated (SIGTERM). Values `["nic_in_bps","nic_out_bps","cpu_pct","mem_pct","load1","disk_space_pct","disk_inode_pct","tcp_conn","nginx_active","nginx_reading","nginx_writing","nginx_waiting","log_dropped","tls_hs_reject","worker_drain_killed"]`
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`

Node real-time curves (several metrics in one call)

GET/api/v2/reports/nodes/realtime-batch

Authentication: Admin only

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
node_id	integer	Required	Node. A sub-IP id returns the curves of the main node it belongs to (metrics are collected per main node).
metrics	string	Required	Node metrics, comma-separated.
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`

Node ranking table

GET/api/v2/reports/nodes/summary

Authentication: Admin only

Query parameters

Field	Type	Required	Description
window	integer	—	Averaging window in minutes; 5 by default. Values `[1,5,30,60]`

Node ranking

GET/api/v2/reports/nodes/top

Authentication: Admin only

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
metric	string	Required	Node metric (same as node_metrics.metric). tls_hs_reject is the number of TLS handshakes rejected by handshake-flood protection; worker_drain_killed is the number of draining old nginx workers force-terminated (SIGTERM). Values `["nic_in_bps","nic_out_bps","cpu_pct","mem_pct","load1","disk_space_pct","disk_inode_pct","tcp_conn","nginx_active","nginx_reading","nginx_writing","nginx_waiting","log_dropped","tls_hs_reject","worker_drain_killed"]`

Visitor round-trip time by node

GET/api/v2/reports/nodes/visitor-rtt

Authentication: Admin only

Security overview

GET/api/v2/reports/security/overview

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_id	integer	—	Filter by site.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Security big-screen aggregate

GET/api/v2/reports/security/screen

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_id	integer	—	Filter by site.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Visitor location statistics

GET/api/v2/reports/sites/geo

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
ip	string	—	Exact match on client address.

Site traffic overview

GET/api/v2/reports/sites/overview

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`
include_noconfig	boolean	—	Admin only: also include unconfigured traffic (site_id = 0).
compare	string	—	prev = also return the previous period of the same length (the compare field); omitted by default. Values `["prev"]`

Site protocol configuration distribution

GET/api/v2/reports/sites/protocol-config

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Site real-time curves

GET/api/v2/reports/sites/realtime

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
metric	string	Required	Metric. Values `["bandwidth","bandwidth_in","traffic","traffic_in","backend_bandwidth","backend_traffic","req","qps","req_hit_ratio","byte_hit_ratio","status_4xx","status_5xx","backend_resp_time","backend_timeout","blocked","challenged"]`
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`
include_noconfig	boolean	—	Admin only: when no site scope (site_ids / group_id) is given, also include unconfigured traffic (site_id = 0).

Site real-time curves (several metrics in one call)

GET/api/v2/reports/sites/realtime-batch

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
metrics	string	Required	Metrics, comma-separated.
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`
include_noconfig	boolean	—	Admin only: when no site scope (site_ids / group_id) is given, also include unconfigured traffic (site_id = 0).

Site ranking

GET/api/v2/reports/sites/top

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
dim	string	—	Ranking dimension; use either dim or dims. Values `["ip","prefix","url","referer","site","status","http_ver","scheme","cache_status","ctype","country","prov","isp","port","block_reason"]`
dims	string	—	Fetch the top limit rows of several dimensions at once, comma-separated dimension names (values as for dim, at most 12); use either dim or dims.
limit	integer	—	Rows per dimension; defaults to and capped by the reports.top_size system setting.
metric	string	—	Which item to sort by and use as value, default count. Values `["count","bytes"]`
action	string	—	Only count requests with this action (pass = allowed, challenge = challenged, block = blocked). Values `["pass","challenge","block"]`
server_port	integer	—	Only count requests to this listening port; not supported for the prefix dimension (422).

TCP/UDP forwarding real-time curves

GET/api/v2/reports/streams/realtime

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
port	integer	—	Filter by stream listen port.
metric	string	Required	Metric. Values `["bandwidth","bandwidth_in","traffic","traffic_in","req","conn_peak"]`
interval	string	—	Bucket width; chosen automatically from the time span by default. Values `["1m","2m","5m","10m","30m","1h"]`

TCP/UDP forwarding ranking

GET/api/v2/reports/streams/top

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
dim	string	—	Ranking dimension, default port. Values `["port","ip"]`
metric	string	—	Which item to sort by and use as value, default count. Values `["count","bytes"]`

List node temporary whitelist records

GET/api/v2/reports/tmp-whitelist

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
site_id	integer	—	Filter by site.
ip	string	—	Exact match on client address (IPv6 as /64 prefix address).
active	boolean	—	true = only entries not yet expired.

Usage curves

GET/api/v2/reports/usage

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339
site_ids	string	—	Only these sites: comma-separated positive integers, at most 200 after deduplication (more returns 422); for more than 200 sites send a filter (group_id / upid / tenant_ids) instead. Intersected with group_id, upid and tenant_ids; sites a tenant cannot see have no data.
group_id	integer	—	Only sites in this site group (expanded to a site set on the server and intersected with the other scope filters; a tenant only expands its own sites).
upid	integer	—	Only sites under this user package.
tenant_ids	string	—	Admin only: only these tenants, comma-separated positive integers, at most 200 after deduplication (more returns 422); tenant credentials sending it get 403.
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
kind	string	—	site (default) = sites; stream = TCP/UDP forwarding. Values `["site","stream"]`
metric	string	Required	Metric. Values `["bandwidth","traffic","req","qps","req_hit_ratio","status_5xx_ratio","status_4xx_ratio","backend_bandwidth","backend_traffic","backend_resp_time","blocked"]`
interval	string	—	auto (default), 5m or 1h. Values `["auto","5m","1h"]`
port	integer	—	Filter by stream listen port.
include_noconfig	boolean	—	Admin only: when no site scope (site_ids / group_id) is given, also include unconfigured traffic (site_id = 0).

List WAF events

GET/api/v2/reports/waf-events

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
start	string	—	Start time (inclusive), RFC 3339; no lower bound when omitted (events are kept for 7 days).
end	string	—	End time (exclusive), RFC 3339; no upper bound when omitted.
site_id	integer	—	Filter by site.
ip	string	—	Filter by client address: a single IPv4/IPv6 address matches exactly; a CIDR range (IPv4-mapped notation accepted) matches by address interval. Prefixes shorter than /8 (IPv4) or /32 (IPv6) are rejected with 422.
url	string	—	URL contains (case-sensitive substring of the masked path and query string).
ja4	string	—	Exact match on the client TLS fingerprint JA4 (events without a fingerprint never match).
rule_id	integer	—	Filter by the matched rule id.
action	string	—	Filter by action: block, log, challenge, mask or replace. Values `["block","log","challenge","mask","replace"]`
type	string[]	—	Filter by event type; repeat to select several, omit for all.
country	string	—	Filter by country name as recorded by the node geo database (exact match).
province	string	—	Filter by province (exact match).
node_id	integer	—	Filter by reporting node; tenants cannot see node ids, so the parameter is ignored for them (no error).
observe	boolean	—	true = only events recorded in observe mode; false or omitted = no such filter.
blocked	boolean	—	true = only blocks in block mode (action = block, not observe); false = only the rest.
disposition	string	—	other = only events outside blocked / challenge / observe-only (not observe mode and action is neither block nor challenge, i.e. log, mask, replace); omitted = no such filter. Values `["other"]`

Export WAF events as CSV

GET/api/v2/reports/waf-events/export

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
start	string	—	Start time (inclusive), RFC 3339; no lower bound when omitted (events are kept for 7 days).
end	string	—	End time (exclusive), RFC 3339; no upper bound when omitted.
site_id	integer	—	Filter by site.
ip	string	—	Filter by client address: a single IPv4/IPv6 address matches exactly; a CIDR range (IPv4-mapped notation accepted) matches by address interval. Prefixes shorter than /8 (IPv4) or /32 (IPv6) are rejected with 422.
url	string	—	URL contains (case-sensitive substring of the masked path and query string).
ja4	string	—	Exact match on the client TLS fingerprint JA4 (events without a fingerprint never match).
rule_id	integer	—	Filter by the matched rule id.
action	string	—	Filter by action: block, log, challenge, mask or replace. Values `["block","log","challenge","mask","replace"]`
type	string[]	—	Filter by event type; repeat to select several, omit for all.
country	string	—	Filter by country name as recorded by the node geo database (exact match).
province	string	—	Filter by province (exact match).
node_id	integer	—	Filter by reporting node; tenants cannot see node ids, so the parameter is ignored for them (no error).
observe	boolean	—	true = only events recorded in observe mode; false or omitted = no such filter.
blocked	boolean	—	true = only blocks in block mode (action = block, not observe); false = only the rest.
disposition	string	—	other = only events outside blocked / challenge / observe-only (not observe mode and action is neither block nor challenge, i.e. log, mask, replace); omitted = no such filter. Values `["other"]`

Summarize WAF events

GET/api/v2/reports/waf-events/summary

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
start	string	Required	Start of the time window (inclusive), RFC 3339.
end	string	Required	End of the time window (exclusive), RFC 3339; must be after start, at most 31 days apart.
site_id	integer	—	Filter by site.
ip	string	—	Filter by client address: a single IPv4/IPv6 address matches exactly; a CIDR range (IPv4-mapped notation accepted) matches by address interval. Prefixes shorter than /8 (IPv4) or /32 (IPv6) are rejected with 422.
url	string	—	URL contains (case-sensitive substring of the masked path and query string).
ja4	string	—	Exact match on the client TLS fingerprint JA4 (events without a fingerprint never match).
rule_id	integer	—	Filter by the matched rule id.
action	string	—	Filter by action: block, log, challenge, mask or replace. Values `["block","log","challenge","mask","replace"]`
type	string[]	—	Filter by event type; repeat to select several, omit for all.
country	string	—	Filter by country name as recorded by the node geo database (exact match).
province	string	—	Filter by province (exact match).
node_id	integer	—	Filter by reporting node; tenants cannot see node ids, so the parameter is ignored for them (no error).
observe	boolean	—	true = only events recorded in observe mode; false or omitted = no such filter.
blocked	boolean	—	true = only blocks in block mode (action = block, not observe); false = only the rest.
disposition	string	—	other = only events outside blocked / challenge / observe-only (not observe mode and action is neither block nor challenge, i.e. log, mask, replace); omitted = no such filter. Values `["other"]`

Get a WAF event

GET/api/v2/reports/waf-events/{event_id}

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Allow-list a WAF event

POST/api/v2/reports/waf-events/{event_id}/allow

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Request body application/json

Field	Type	Required	Description
param	string	—	Name of the matched parameter, header or cookie; empty for unnamed locations.
path	string	—	Limit to this path prefix; must equal the event URL path or be a prefix ending in / (e.g. /api/); a bare / must be combined with a rule or parameter. Omit for any path.
rule	boolean	—	Skip only the matched rule (rule_ids); not allowed for non-rule events (rule id 0) or semantic events. Default `false`

Reports object

Field	Type	Required	Description
action	string	—	Protection action: pass, challenge or block.
advice	integer	—	Number of suggestions.
app	string	—	Detected application; empty when none was recognised.
app_manual	boolean	—	The application was overridden by hand.
app_version	string	—	Application version; empty when it could not be read.
approx	boolean	—	The ranking comes from each node's per-minute top K (ip, prefix, url, referer); nodes report only their own top K, so totals are approximate. False when read from access logs (action or server_port given).
at	string	—	Time it happened (the last hit inside the window).
attack_types	WafEventCount[]	—	Attack type distribution (sqli, xss, scanner, rce, traversal, other and semantic, bot, upload, tamper, leak), by rows descending; adds up to total.
attacked_sites	integer	—	Distinct attacked sites.
ban_hits	integer	—	Revisits stopped by banned IPs - the sum of the auto_ban and status_ban items of blocked_by_feature. Always 0 until nodes tag ban blocks.
block	integer	—	Blocks in block mode (action = block, not observe).
block_reason	string	—	Block reason: region = blocked by region limit, region_log = region limit log-only hit (not blocked), acl = blocked by ACL, other = blocked by other protection; omitted when neither blocked nor a region-limit hit. Values `["region","region_log","acl","other"]`
blocked	integer	—	Blocked requests (action = block).
blocked_acl	integer	—	Requests blocked by ACLs (including ACLs without location conditions).
blocked_by_feature	SecurityFeatureCount[]	—	Blocked requests per protection feature (blocked requests scaled by sampling weight, challenges excluded). Always 12 items (genuine blocks only; leak and tamper protection replace the response body and are not listed here, see handled_by_feature), descending by count then in a fixed order; the counts add up to summary.blocked for the same window and site scope. A feature is derived from the rule_ref the node writes into the access log; blocks from nodes that do not tag them are counted under waf_rule.
blocked_region	integer	—	Requests blocked by the region limit.
body_trunc	boolean	—	The request body exceeded the inspection limit and only the head was checked.
bot_score	integer	—	Bot behaviour score 0–100; only on Bot events (type = bot), absent for other types (score is the WAF anomaly score and means something else).
bytes_sent	integer	—	Raw downstream bytes.
cache_status	string	—	Cache status, such as HIT, MISS or BYPASS.
category	string	—	Rule category (sqli, xss, scanner, rce, php, nodejs, java, lfi, rfi, protocol, ...); empty when unknown.
challenge	integer	—	Challenges outside observe mode (action = challenge).
checked_at	string	—	Time of the checkup.
checkup	object	—	Site checkup feed; the protection score (site checkup scores weighted by traffic) and the to-do suggestions. Follows site_id but not the time window.
client_ip	string	—	Client IP; IPv4 as is.
combo	object	—	Distribution of HTTP/2 and HTTP/3 combinations (number of sites).
compare	SitesOverviewCompare	—	The previous period (compare=prev) with its window [start, end), per-bucket points and totals; points align one-to-one with the current period. h3_ratio, backend_resp_time_p95 and noconfig_req are always null.
content_encoding	string	—	Response Content-Encoding.
count	integer	—	530 count within the time window (sum across nodes).
countries	SecurityCountryCount[]	—	Attack source countries (blocked and challenged requests scaled by sampling weight), descending; an empty country means unknown.
country	string	—	Client country (ISO 3166-1 alpha-2); omitted when unknown.
covered	integer	—	Known vulnerabilities of the recognised program already covered by built-in rules, from the protection list; 0 when no program is recognised or the list has no such product.
created_at	string	—	Created at
critical	integer	—	Number of critical problems (ignored and locked ones excluded).
ctype	string	—	Response Content-Type (parameters removed, lowercase).
current_site_id	integer	—	Id of the site whose result is being saved; only present in stage 5 (stages 1-4 run on the whole batch and have no single current site), omitted otherwise.
cves	SecurityCve[]	—	CVEs hit in the last 7 days (matched against the rule pack meta section), descending by hits, at most 50; empty when no rule pack is connected.
dims	object	—	Result of a dims request, mapping each dimension name to its ranking (which has no dims of its own); absent for a single-dimension request.
domain	string	—	First domain.
done_rows	integer	—	Rows written to the file so far.
done_site_ids	integer[]	—	Ids of the sites whose checkup results this batch has saved (ascending); sites not listed are not finished yet (or failed). Cleared when the batch is retried.
done_sites	integer	—	Number of sites with saved results; below total_sites after completion means some sites failed.
error	string	—	Reason of the latest failure (kept while retrying, cleared once the export succeeds; the final reason when failed).
exception	WafEventAllowException	—	The site exception written by this allow-list action (or already present on the site).
expires_at	string	—	When the file is removed (completion time plus the retention hours).
extra	integer	—	Known vulnerabilities on the same basis that can additionally be covered once WAF rule updates are enabled.
facets	object	—	Facet counts for the filter buttons.
file_bytes	integer	—	Compressed file size in bytes (set once done).
file_count	integer	—	Number of uploaded files scanned in this request.
file_ctype	string	—	Content-Type of the uploaded file as given by the client.
file_field	string	—	Form field name of the uploaded file.
file_magic	string	—	Type recognised from the file header; empty when unknown.
file_name	string	—	Uploaded file name as given by the client; only on upload events (type = upload).
file_sha256	string	—	SHA-256 of the uploaded file; empty when not computed.
file_size	integer	—	Uploaded file size in bytes; only on upload events (type = upload).
filter	AccessLogExportFilter	—	Filters given with the request (same as the list query parameters).
findings	CheckupFinding[]	—	Checks with problems (passed checks are not listed), in check order.
finished_at	string	—	Completion time.
first_seen	string	—	When this problem began in its current run; omitted for the first checkup and for results saved before this was recorded.
first_seen_at	string	—	Time of the earliest access log in the retention period; absent when there is none.
flows	SecurityFlow[]	—	Attack flows top 50 (source country to the country and city of the node that took the traffic, blocked and challenged requests scaled by sampling weight), descending; the rest and nodes at unknown locations are merged into one trailing row with an empty node_country (not drawn); the total equals the total of countries. Part of WAF Enhanced, an empty array when it is off; only data written after the flow table was created is counted, so older windows are empty.
foreign	integer	—	Requests from outside mainland China (known country other than CN); excluded from the ISP breakdown.
frequency	string	—	Frequency: daily at 03:00, weekly on Monday at 03:00, or manual only. Values `["daily","weekly","manual"]`
geo_summary	TopGeoSummary	—	Summary for the region dimensions (country, prov, isp) over the whole time window and the same filters, not limited by the number of ranked rows.
handled_by_feature	SecurityHandledCount[]	—	Requests handled by replacing content - leak and tamper protection rewrite the response body, keep the status code and are recorded as pass, so they are not blocks and are in neither blocked_by_feature nor summary.blocked, and should not enter block percentages. Only features with a count above 0 are listed, descending by count then leak before tamper; an empty array when there is no data (including before nodes tag body replacement), which the UI uses to hide it. Scaled by sampling weight and follows the time window and site scope.
headers	string[]	—	First 20 request headers as "lowercase-name: value", values cut to 256 bytes; Cookie and Authorization values are masked.
history	CheckupHistoryPoint[]	—	Scores of this site over the last 8 weeks.
hit_layer	string	—	Upload scan layer that matched; empty when nothing matched.
host	string	—	Requested Host.
http2	ProtocolSwitch	—	Number of sites by switch state of a protocol (on, off, unset).
http3	ProtocolSwitch	—	Number of sites by switch state of a protocol (on, off, unset).
http_ver	string	—	HTTP protocol version (HTTP/x.y normalized to 1.0, 1.1, 2, 3).
https_off	integer	—	Number of sites with HTTPS disabled.
https_on	integer	—	Number of sites with HTTPS enabled.
id	integer	—	Record ID
intel_hit	boolean	—	Whether the IP is currently in the platform high-risk IP library (looked up against the current library); null = the library is not being served, not judged.
interval	integer	—	Bucket width in seconds.
invalid	integer	—	Number of sites whose configuration cannot be parsed or whose switch value is not a boolean.
ip	string	—	The address looked up (canonical form).
isp	string	—	Client ISP code; omitted when unknown.
isps	GeoCount[]	—	Requests per ISP in mainland China, descending (empty key = ISP unknown).
items	CheckupHistoryPoint[]	—	Items on this page
ja4	string	—	Client TLS fingerprint JA4 (computed by the node during the TLS handshake, same for all requests on a connection); omitted for plain HTTP or when unavailable.
keys	string[]	Required	Check keys.
kind	string	—	Site kind: domain (domain site) or ip (IP site); they have different edit pages. Values `["domain","ip"]`
last_seen	string	—	Most recent minute it appeared.
last_seen_at	string	—	Time of the latest access log in the retention period; absent when there is none.
level	string	—	Protection level of the site at the time: basic, standard or strict.
limit	integer	—	Requests allowed per day (reports.access_log_export_daily; 0 = downloads not allowed).
max	number	—	bandwidth, backend_bandwidth: peak 5-minute bandwidth in the time window.
medium	integer	—	Number of medium problems.
message	string	—	Legacy note (action and score) kept for older clients; build texts from type, action and category instead.
method	string	—	HTTP request method.
metrics	NodeRealtimeMetric[]	—	Curves of each metric, in request order.
name	string	—	Site name.
next_retry_at	string	—	When the next retry starts (only for pending requests waiting to retry after a failure).
node_city	string	—	City of the node that reported it; empty when only the country is known or the location is unknown.
node_id	integer	—	ID of the node that served the request.
node_ids	integer[]	—	Nodes that reported it (up to 50, ascending).
node_ips	string[]	—	Public addresses of the nodes in the site's own line groups (deduplicated and sorted, at most 500; private or management egress addresses are never listed); allow-listing them on the origin firewall restricts access to the CDN. Returned only when the origin-direct problem exists, otherwise an empty array.
node_lat	number	—	Latitude of the node's landing point, as for node_lon.
node_lon	number	—	Longitude of the node's landing point (the city, or the country centroid when there is no city); absent when the location is unknown.
node_names	string[]	—	Node names in the same order as node_ids; "#<id>" if a node has no name or was deleted.
node_spots	SecurityNodeSpot[]	—	Node landing points (country and city to the number of nodes in use), administrators only and always an empty array for tenants; same basis as the flows landing points (enabled primary nodes, nodes at unknown locations are not counted); independent of whether WAF Enhanced is on, the time window and site_id; descending by node count, then by country and city.
node_unknown	integer	—	Number of nodes in use whose location is unknown (enabled primary nodes whose country cannot be determined, not counted in node_spots); administrators only, the field is absent from tenant responses; independent of whether WAF Enhanced is on, the time window and site_id.
nodes	integer	—	Number of nodes that reported it.
notify_critical	boolean	—	Raise an alert when a critical problem appears (uses the channels in alert settings).
observe	boolean	—	The site was in observe mode at the time (record only).
observe_rule	boolean	—	true = the hit was a new rule still in its observation period, recorded only and not blocked (observe is then also true); emergency rules have no observation period, so always false.
op	string	Required	add puts keys on the ignore list (existing ones are untouched); remove takes them off. Values `["add","remove"]`
open_url	string	—	Clickable address of this request (the log's own scheme + host + non-default port + path and query); only http/https with a valid domain or IP and shorter than 2048 characters, otherwise omitted.
other	integer	—	The rest: log, mask or replace outside observe mode.
p95	number	—	bandwidth, backend_bandwidth: 95th percentile (5-minute samples for interval=5m, hourly peaks otherwise; only samples with data; the (n×5/100+1)-th largest, equal to the peak when n=1).
param	string	—	Name of the matched parameter, header or cookie; empty for unnamed locations.
params	object	—	Numbers and names for display, same as params of this check in the checkup result (including open_url).
path	string	—	Limit to this path prefix; must equal the event URL path or be a prefix ending in / (e.g. /api/); a bare / must be combined with a rule or parameter. Omit for any path.
points	SecurityPoint[]	—	Attack trend; the bucket width follows the time span (about 288 points at most) and empty buckets are zero.
prefix_len	integer	—	32 (IPv4) or 64 (IPv6).
prev_score	integer	—	Score of the previous checkup; null for the first checkup.
previous	object	—	Comparison with the previous window of the same length.
probes	CheckupProbeExtra[]	—	Rows of the last 7 days of probing that do not come from WAF events (CC cut, origin 404); blocked / logged rows are aggregated by the panel from WAF events.
progress	integer	—	Progress percentage (rows written / total rows).
protocol	string	—	HTTP version, e.g. HTTP/2.0.
prov	string	—	Client province (first two digits of GB/T 2260, mainland China only); omitted when unknown.
province	string	—	Province; empty when unknown.
provinces	SecurityProvinceCount[]	—	Attack source provinces in mainland China (blocked and challenged requests scaled by sampling weight), descending; requests with an unknown province are left out.
provs	GeoCount[]	—	Requests per mainland China province, descending (empty key = province unknown).
publish_seq	integer	—	Publish sequence number triggered (when result = added).
reason_args	object	—	Parameters of the basis text (id site/cert id, at deletion time, domain the similar site domain, n differing characters, names node names, cname, ip, nodes, count).
reason_code	string	—	Basis of the kind (message code; the panel renders the text per language): site_unsynced the site still Values `["site_unsynced","site_disabled","site_deleted","cert_cover","bare_ip","bad_domain","typo","not_resolved","dns_error","nxdomain","nxdomain_random","pointed_a","pointed_cname","elsewhere_ip","elsewhere_cname","no_a","unavailable"]`
recent	WafEventRecent	—	Events from the same IP in the past hour (total, rule breakdown, latest items).
referer	string	—	Request Referer header.
referer_open_url	string	—	Clickable address of the Referer; omitted when it is not an http/https page (such as javascript: or android-app://), is malformed, or is 2048 characters or longer.
region_logged	integer	—	Requests matching a log-only region limit (not blocked).
remaining	integer	—	Requests still available today.
request_id	string	—	Request ID.
request_length	integer	—	Request length in bytes.
request_time_ms	integer	—	Request processing time in milliseconds.
reset	boolean	—	true clears the override and returns to automatic detection (name and version are ignored).
result	string	—	added; exists = the site already has the same exception, nothing added; full = the exception list is full, nothing added. Values `["added","exists","full"]`
retries	integer	—	Number of failed attempts; when pending or running and above 0 the request is on retry N.
rule	boolean	—	Skip only the matched rule (rule_ids); not allowed for non-rule events (rule id 0) or semantic events. Default `false`
rule_id	integer	—	ID of the rule that matched.
rule_name	string	—	Short rule name.
rules_ver	string	—	Rule pack version; empty means the built-in rules.
run	object	—	The batch in progress; omitted when there is none.
sample_factor	integer	—	Sampling factor N (the largest sample_weight in the access logs read); 1 when not sampled.
sample_weight	integer	—	Sampling weight (1 means not sampled).
sampled	boolean	—	The access logs read contain sampled rows (sample_weight > 1); counts are scaled by weight and incomplete.
saved_bytes	integer	—	Origin traffic saved (bytes) - bytes sent to clients by requests served from cache and not blocked in the window, scaled by sampling weight.
scan_status	string	—	Upload scan result (type = upload); empty for other types.
scan_steps	string[]	—	Upload scan steps in order, one "layer:result" per layer.
scheme	string	—	Request scheme (http or https).
score	integer	—	Checkup score (100 at most).
series	LabeledLine[]	—	Time series grouped by sub-object.
server_port	integer	—	Port the request arrived on.
severity	string	—	Severity of this problem on this site. Values `["critical","medium","advice"]`
site_deleted	boolean	—	true when the site this log belongs to has been deleted; omitted when the site still exists (or there is none).
site_id	integer	—	Site ID
site_ids	integer[]	Required	Sites to process, at most 500.
site_name	string	—	Name of the site it belongs to (primary domain, or the site name when it has none); for a deleted site the domain recorded when it was deleted, else the most common host in the last 7 days of access logs, omitted when none is found.
snippet	string	—	Matched snippet (masked on the node; the value of the matched parameter or header). The list cuts it to the first 200 characters and the detail returns it whole. It carries no match offset, so it cannot be used to locate a highlight. For Bot events it is the triggering signal names.
source_ips	integer	—	Distinct source addresses.
stage	integer	—	Current stage: 0 queued, 1 reading configuration, 2 counting logs, 3 direct probe, 4 per-check evaluation, 5 saving and alerting. With more than 200 sites the stage restarts for every batch of 200; evaluation is instantaneous on the server.
started_at	string	—	Time the batch was created.
state	string	—	State: pending, running, done, or failed after retries are exhausted. Values `["pending","running","done","failed"]`
status	string	—	Status: pending, running, done (downloadable), failed, or expired (file removed after the retention period). Values `["pending","running","done","failed","expired"]`
step	integer	—	Bucket width of series, in seconds.
summary	CheckupRunSummary	—	Per-stage volume summary; a stage's key is absent until it is reached. Multi-batch tasks add up across batches.
target	string	—	Where it matched: uri, query_string, args, args_names, cookies, headers, body, ...
tenant_id	integer	—	Owner tenant (user) ID of the site.
top_rules	SecurityRuleCount[]	—	Top 10 matched rules (by hits, descending).
top_sites	SecuritySiteCount[]	—	Top 10 attacked sites (by blocked and challenged requests, descending).
total	integer	—	Requests in the time window (scaled by sampling weight).
total_rows	integer	—	Total matching rows (counted when the export starts).
total_sites	integer	—	Number of sites in this batch; may still be 0 while queued.
totals	SitesOverviewTotals	—	Totals over the time window.
traffic_month	integer	—	Month-to-date outbound bytes, from the 1st of the month containing end (Asia/Shanghai) up to end; sealed hours come from the 5-minute summary, later ones from live data.
traffic_today	integer	—	Today's outbound bytes, from midnight (Asia/Shanghai) of the day containing end up to end; same scope as totals.traffic.
ts	string	—	Request time.
type	string	—	Event type: rule, semantic, bot, upload scan, tamper protection or leak protection. Values `["waf","semantic","bot","upload","tamper","leak"]`
types	SecurityTypeCount[]	—	Attack type distribution (WAF event hits by type), descending by count.
unavailable	string[]	—	Supplementary items that could not be loaded this time (only present when the rule store or ClickHouse failed briefly; everything else is returned as usual and the missing items come back empty). coverage = covered / extra, probes = probes, node_ips = node_ips. Absent when everything loaded.
unknown	integer	—	Requests whose country is unknown (no database, private address or not in the database).
unlimited	boolean	—	true = no daily cap (administrators); limit and remaining are then absent.
upid	integer	—	Origin (upstream) ID the request went to.
upstream_addr	string	—	Origin address:port actually used; comma-separated hops when retried on another origin; empty when not fetched from origin.
upstream_bytes	integer	—	Bytes received from the origin.
upstream_status	string	—	Status code returned by each origin hop, matching upstream_addr; empty when not fetched from origin.
upstream_time_ms	integer	—	Origin response time in milliseconds; null when not fetched from origin.
uri	string	—	Request URI including the query string.
url	string	—	Request path and query string (masked).
used	integer	—	Requests created today.
user_agent	string	—	Request User-Agent header.
version	string	—	Application version; may be left empty.
window_min	integer	—	Averaging window used, in minutes.
window_s	integer	—	Window length in seconds.

curl

# Get today's access log download quota
curl "https://panel.example.com/api/v2/reports/access-log-export-quota" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List access log download requests
curl "https://panel.example.com/api/v2/reports/access-log-exports" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Request an access log download
curl -X POST "https://panel.example.com/api/v2/reports/access-log-exports" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Get an access log download request
curl "https://panel.example.com/api/v2/reports/access-log-exports/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Download the access log file
curl "https://panel.example.com/api/v2/reports/access-log-exports/{id}/file" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List access logs
curl "https://panel.example.com/api/v2/reports/access-logs" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site checkup overview
curl "https://panel.example.com/api/v2/reports/checkup" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Checkup score history
curl "https://panel.example.com/api/v2/reports/checkup/history" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Checkup ignores
curl "https://panel.example.com/api/v2/reports/checkup/ignores" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Add or remove checkup ignores in bulk
curl -X POST "https://panel.example.com/api/v2/reports/checkup/ignores/batch" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Checkup problems grouped by check
curl "https://panel.example.com/api/v2/reports/checkup/issues" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Sites affected by a checkup problem
curl "https://panel.example.com/api/v2/reports/checkup/issues/{key}/sites" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Run the checkup again
curl -X POST "https://panel.example.com/api/v2/reports/checkup/recheck" \
  -H "X-API-Key: $GOCDN_API_KEY"

# The checkup batch in progress
curl "https://panel.example.com/api/v2/reports/checkup/runs/active" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Checkup batch progress
curl "https://panel.example.com/api/v2/reports/checkup/runs/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Get checkup settings
curl "https://panel.example.com/api/v2/reports/checkup/settings" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Save checkup settings
curl -X PUT "https://panel.example.com/api/v2/reports/checkup/settings" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site checkup report
curl "https://panel.example.com/api/v2/reports/checkup/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Override a site's detected application
curl -X PUT "https://panel.example.com/api/v2/reports/checkup/sites/{id}/app" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Set a site's checkup ignores
curl -X PUT "https://panel.example.com/api/v2/reports/checkup/sites/{id}/ignores" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Unconfigured domain Top
curl "https://panel.example.com/api/v2/reports/host-not-found/top" \
  -H "X-API-Key: $GOCDN_API_KEY"

# First and last time a visitor IP was seen
curl "https://panel.example.com/api/v2/reports/ip-seen" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Node real-time curves
curl "https://panel.example.com/api/v2/reports/nodes/realtime" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Node real-time curves (several metrics in one call)
curl "https://panel.example.com/api/v2/reports/nodes/realtime-batch" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Node ranking table
curl "https://panel.example.com/api/v2/reports/nodes/summary" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Node ranking
curl "https://panel.example.com/api/v2/reports/nodes/top" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Visitor round-trip time by node
curl "https://panel.example.com/api/v2/reports/nodes/visitor-rtt" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Security overview
curl "https://panel.example.com/api/v2/reports/security/overview" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Security big-screen aggregate
curl "https://panel.example.com/api/v2/reports/security/screen" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Visitor location statistics
curl "https://panel.example.com/api/v2/reports/sites/geo" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site traffic overview
curl "https://panel.example.com/api/v2/reports/sites/overview" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site protocol configuration distribution
curl "https://panel.example.com/api/v2/reports/sites/protocol-config" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site real-time curves
curl "https://panel.example.com/api/v2/reports/sites/realtime" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site real-time curves (several metrics in one call)
curl "https://panel.example.com/api/v2/reports/sites/realtime-batch" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site ranking
curl "https://panel.example.com/api/v2/reports/sites/top" \
  -H "X-API-Key: $GOCDN_API_KEY"

# TCP/UDP forwarding real-time curves
curl "https://panel.example.com/api/v2/reports/streams/realtime" \
  -H "X-API-Key: $GOCDN_API_KEY"

# TCP/UDP forwarding ranking
curl "https://panel.example.com/api/v2/reports/streams/top" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List node temporary whitelist records
curl "https://panel.example.com/api/v2/reports/tmp-whitelist" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Usage curves
curl "https://panel.example.com/api/v2/reports/usage" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List WAF events
curl "https://panel.example.com/api/v2/reports/waf-events" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Export WAF events as CSV
curl "https://panel.example.com/api/v2/reports/waf-events/export" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Summarize WAF events
curl "https://panel.example.com/api/v2/reports/waf-events/summary" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Get a WAF event
curl "https://panel.example.com/api/v2/reports/waf-events/{event_id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Allow-list a WAF event
curl -X POST "https://panel.example.com/api/v2/reports/waf-events/{event_id}/allow" \
  -H "X-API-Key: $GOCDN_API_KEY"