GraphQL

This lists all of the available datasets and fields in Cloudflare's GraphQL API.

AccountAccessLoginRequestsAdaptiveGroups

Access login requests

FieldDescription
avg
count Number of access login API events processed
dimensions List of dimensions to group by

AccountAccessLoginRequestsAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountAccessLoginRequestsAdaptiveGroupsDimensions

FieldDescription
appId Access application ID
approvingPolicyId Policy ID that approved the user
cfRayId CF ray id
country Country tag
date The date the access login event was emitted
datetime The date and time the access login event was emitted
datetimeMinute The date and time the access login event was emitted truncated to the minute
deviceId Device ID
hasExistingJWT Has existing JWT (0 = false, 1 = true)
hasGatewayEnabled Has Gateway enabled (0 = false, 1 = true)
hasWarpEnabled Has WARP enabled (0 = false, 1 = true)
identityProvider Identity provider
ipAddress User IP address
isSuccessfulLogin If the login was successful (0 = false, 1 = true)
mtlsCertSerialId MTLS certificate serial ID
mtlsCommonName MTLS common name
mtlsStatus MTLS status (may show error message if status is not successful)
serviceTokenId Service token ID
userUuid User UUID

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced DNS Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
dnsQueryName The requested domain name in the DNS query
dnsQueryType The query type in the DNS query
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced TCP Protection

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountAiGatewayCacheAdaptiveGroups

AI Gateway Cache

FieldDescription
count Total number of requests for an account with caching enabled: including hits and misses
dimensions List of dimensions to group by

AccountAiGatewayCacheAdaptiveGroupsDimensions

FieldDescription
cacheOp Cache Hit or Miss: 1 = cache hit, 0 = cache miss
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which model was the request sent to
provider Which provider was the request sent to
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayErrorsAdaptiveGroups

AI Gateway Errors

FieldDescription
count Number of errors
dimensions List of dimensions to group by

AccountAiGatewayErrorsAdaptiveGroupsDimensions

FieldDescription
date The date when trigger was triggerd
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to

AccountAiGatewayRequestsAdaptiveGroups

AI Gateway Requests

FieldDescription
count Number of processed requests
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountAiGatewayRequestsAdaptiveGroupsDimensions

FieldDescription
cached Was the response served from cache?: 1 = cache hit, 0 = cache misss
date The date when trigger was triggered
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
error Was the response an error: 1 , 0 for no error
gateway Gateway name
model Which models was the request sent to
provider Which provider was the request sent to
rateLimited Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied
tokensIn Number of tokens in the request
tokensOut Number of tokens in the response

AccountAiGatewayRequestsAdaptiveGroupsSum

FieldDescription
cachedTokensIn Sum of cached tokens in
cachedTokensOut Sum of cached tokens out
uncachedTokensIn Sum of uncached tokens in
uncachedTokensOut Sum of uncached tokens out

AccountAiInferenceAdaptive

AI Inference logs with adaptive sampling

FieldDescription
costMetricName1 Name for cost metric 1
costMetricName2 Name for cost metric 2
costMetricValue1 Value for cost metric 1
costMetricValue2 Value for cost metric 2
datetime The date when inferance was triggered
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
modelIsBeta Model that was trigger to inference is Beta
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)
sampleInterval ABR sample interval

AccountAiInferenceAdaptiveGroups

Aggregated AI Inference logs with adaptive sampling

FieldDescription
count Total number of inferences for an account
dimensions List of dimensions to group by
sum

AccountAiInferenceAdaptiveGroupsDimensions

FieldDescription
costMetricName1 Name for cost metric 1
costMetricName2 Name for cost metric 2
costMetricValue1 Value for cost metric 1
costMetricValue2 Value for cost metric 2
date The date when starts the inference
datetimeFifteenMinutes The date and time truncated to fifteen minutes
datetimeFiveMinutes The date and time truncated to five minutes
datetimeHour The date and time truncated to the hour
datetimeMinute The date and time truncated to the minute
errorCode Error code
inferenceTimeMs Inference time ms
modelId ModelId that was trigger to inference
modelIsBeta Model that was trigger to inference is Beta
neurons Monetization unit
requestBytesIn Request size in bytes
requestBytesOut Request size out bytes
requestSource Source who triggered (worker binding, pages binding, rest api)

AccountAiInferenceAdaptiveGroupsSum

FieldDescription
totalCostMetricValue1 Total value for cost metric 1
totalCostMetricValue2 Total value for cost metric 2
totalInferenceTimeMs Total inference time ms
totalNeurons Total neurons
totalRequestBytesIn Total bytes in per request
totalRequestBytesOut Total bytes out per request

AccountBrowserRenderingEventsAdaptive

Browser Rendering events with adaptive sampling

FieldDescription
browserCloseReason Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted)
browserEndTime Browser session end time
browserStartTime Browser session start time
connectionEndTime When worker ended devtools connection to browser session
connectionId Worker connection ID, when available
connectionStartTime When worker started devtools connection to browser session
datetime The time of the event
sampleInterval ABR sample interval
scriptName Name of worker who initiated the request
sessionId Browser session ID

AccountBrowserRenderingEventsAdaptiveGroups

Aggregated Browser Rendering events with adaptive sampling

FieldDescription
count Total number of events for an account
dimensions List of dimensions to group by
max The maximum value for a metric per dimension
min The minimum value for a metric per dimension
uniq

AccountBrowserRenderingEventsAdaptiveGroupsDimensions

FieldDescription
browserCloseReason Browser session close code. Enum (-1, N/A) (0, Unknown) (1, NormalClosure) (2, BrowserIdle) (3, ClientClosedEarly) (4, ChromiumChrashed) (5, ClientAbnormalClosure) (6, ServerAbnormalClosure) (7, ClientError) (8, ServerError) (9, WorkerError) (10, ClientNeverConnected) (11, BrowserSessionEvicted)
connectionId Worker connection ID, when available
date The date of the event
datetimeFifteenMinutes The date and time of the event truncated to fifteen minutes
datetimeFiveMinutes The date and time of the event truncated to five minutes
datetimeHour The date and time of the event truncated to the hour
datetimeMinute The date and time of the event truncated to the minute
scriptName Name of worker who initiated the request
sessionId Browser session ID

AccountBrowserRenderingEventsAdaptiveGroupsMax

FieldDescription
finalBrowserCloseReason Browser close reason
latestBrowserEndTime Browser end time

AccountBrowserRenderingEventsAdaptiveGroupsMin

FieldDescription
earliestBrowserStartTime Browser start time

AccountBrowserRenderingEventsAdaptiveGroupsUniq

FieldDescription
connectionIdCount Unique worker connections
sessionIdCount Unique browser sessions

AccountCallsStatusAdaptive

(TESTING ONLY, NOT FOR PRODUCTION) Raw Calls events with adaptive sampling

FieldDescription
appId The appId that generated traffic
datetime The date and time the event was recorded
event The description of the event related to a session or a track
sessionId The generated string that identifies a PeerConnection
trackId The track identifier provided to us within a PeerConnection

AccountCallsTurnUsageAdaptiveGroups

Aggregated Calls TURN bandwidth usage with adaptive sampling"

FieldDescription
avg
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCallsTurnUsageAdaptiveGroupsAvg

FieldDescription
concurrentConnectionsFifteenMinutes Average concurrent connections when grouped by datetimeFifteenMinutes
concurrentConnectionsFiveMinutes Average concurrent connections when grouped by datetimeFiveMinutes
concurrentConnectionsHour Average concurrent connections when grouped by datetimeHour
concurrentConnectionsMinute Average concurrent connections when grouped by datetimeMinute

AccountCallsTurnUsageAdaptiveGroupsDimensions

FieldDescription
customIdentifier The customIdentifier (provided when credential was generated) that generated traffic
date Calls TURN bandwidth metrics date
datetimeFifteenMinutes Calls TURN bandwidth metrics timestamp, truncated to fifteen minutes
datetimeFiveMinutes Calls TURN bandwidth metrics timestamp, truncated to five minutes
datetimeHour Calls TURN bandwidth metrics timestamp, truncated to the hour
datetimeMinute Calls TURN bandwidth metrics timestamp, truncated to the minute
keyId The credentials created by this keyId that generated traffic
username The username from credential that generated traffic

AccountCallsTurnUsageAdaptiveGroupsSum

FieldDescription
egressBytes The total bytes sent by Calls TURN, observed over the queried time period
ingressBytes The total bytes received by Calls TURN, observed over the queried time period

AccountCallsUsageAdaptiveGroups

Beta. Aggregated Calls SFU bandwidth usage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCallsUsageAdaptiveGroupsDimensions

FieldDescription
appId The appId that generated traffic
date Calls bandwidth metrics date
datetimeFifteenMinutes Calls bandwidth metrics timestamp, truncated to fifteen minutes
datetimeFiveMinutes Calls bandwidth metrics timestamp, truncated to five minutes
datetimeHour Calls bandwidth metrics timestamp, truncated to the hour
datetimeMinute Calls bandwidth metrics timestamp, truncated to the minute
sessionId The generated string that identifies a PeerConnection
trackId The track identifier provided to us within a PeerConnection
trackType Describes if the track contains video, audio, or data

AccountCallsUsageAdaptiveGroupsSum

FieldDescription
egressBytes The total bytes sent by Calls, observed over the queried time period
ingressBytes The total bytes received by Calls, observed over the queried time period

AccountCdnNetworkAnalyticsAdaptiveGroups

Network analytics data for Cloudflare CDN traffic

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountCdnNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag Device tag associated with the destination IP of the packet
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationSystem Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome The action that was taken on the packet (possible values: pass, drop)
popName Cloudflare PoP that received the packet (unique site identifier)
prefixTag IP prefix tag associated with the packet
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag Device tag associated with the source IP of the packet
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet

AccountCdnNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountD1AnalyticsAdaptiveGroups

Beta. Aggregated D1 analytics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of requests to D1 processed
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountD1AnalyticsAdaptiveGroupsAvg

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata (average/mean).
queryBatchTimeMs Query batch response time in milliseconds (average/mean).
sampleInterval The average value used for sample interval

AccountD1AnalyticsAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date The date the D1 request was received
datetimeFifteenMinutes The date and time the D1 request was received truncated to fifteen minutes
datetimeFiveMinutes The date and time the D1 request was received truncated to five minutes
datetimeHour The date and time the D1 request was received truncated to the hour
datetimeMinute The date and time the D1 request was received truncated to the minute

AccountD1AnalyticsAdaptiveGroupsQuantiles

FieldDescription
queryBatchResponseBytesP50 The total number of bytes in the response, including all returned rows and metadata (50th percentile).
queryBatchResponseBytesP90 The total number of bytes in the response, including all returned rows and metadata (90th percentile).
queryBatchTimeMsP50 Query batch response time in milliseconds (50th percentile).
queryBatchTimeMsP90 Query batch response time in milliseconds (90th percentile).

AccountD1AnalyticsAdaptiveGroupsSum

FieldDescription
queryBatchResponseBytes The total number of bytes in the response, including all returned rows and metadata.
readQueries The number of read queries.
rowsRead The number of rows your queries read.
rowsWritten The number of rows your queries wrote.
writeQueries The number of write queries.

AccountD1QueriesAdaptiveGroups

Beta. D1 query metrics with adaptive sampling

FieldDescription
avg The average value for a metric per dimension
count Number of D1 queries processed
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountD1QueriesAdaptiveGroupsAvg

FieldDescription
queryDurationMs The average duration queries in D1 took, observed over the queried time period.
rowsRead The average number of rows scanned, observed over the queried time period.
rowsReturned The average number of rows returned, observed over the queried time period.
rowsWritten The average number of rows written, observed over the queried time period.
sampleInterval The average value used for sample interval

AccountD1QueriesAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 query sample timestamp
datetimeFifteenMinutes D1 query sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 query sample timestamp, truncated to five minutes
datetimeHour D1 query sample timestamp, truncated to the hour
datetimeMinute D1 query sample timestamp, truncated to the minute
query The SQL query that ran on a D1 database, with parameterized values replaced with placeholders.

AccountD1QueriesAdaptiveGroupsQuantiles

FieldDescription
queryDurationMsP50 50th percentile Query Duration (milliseconds)
queryDurationMsP95 95th percentile Query Duration (milliseconds)
queryDurationMsP99 99th percentile Query Duration (milliseconds)

AccountD1QueriesAdaptiveGroupsSum

FieldDescription
queryDurationMs The total duration queries in D1 took, observed over the queried time period.
rowsRead The total number of rows scanned, observed over the queried time period.
rowsReturned The total number of rows returned, observed over the queried time period.
rowsWritten The total number of rows written, observed over the queried time period.

AccountD1StorageAdaptiveGroups

Beta. D1 storage with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
max The max of values for a metric per dimension

AccountD1StorageAdaptiveGroupsDimensions

FieldDescription
databaseId The UUID of a D1 database
date D1 storage sample timestamp
datetimeFifteenMinutes D1 storage sample timestamp, truncated to fifteen minutes
datetimeFiveMinutes D1 storage sample timestamp, truncated to five minutes
datetimeHour D1 storage sample timestamp, truncated to the hour
datetimeMinute D1 storage sample timestamp, truncated to the minute

AccountD1StorageAdaptiveGroupsMax

FieldDescription
databaseSizeBytes The maximum size of the database (measured in bytes) observed over the queried time period.

AccountDosdAttackAnalyticsGroups

Attack analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountDosdNetworkAnalyticsAdaptiveGroups

Network analytics data for dosd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDosdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
attackId Unique identifier of the mitigation that matched the packet, if any
attackVector Attack vector of the rule that matched the packet, if any
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountDosdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountDurableObjectsInvocationsAdaptiveGroups

Durable Objects invocations with adaptive sampling

FieldDescription
avg The average value used for sample interval
dimensions List of dimensions to group by
max The max value for a metric
min The min value for a metric
quantiles Quantiles of a metric per dimension
sum The sum of values for a metric per dimension

AccountDurableObjectsInvocationsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountDurableObjectsInvocationsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script
status Status of the worker invocation

AccountDurableObjectsInvocationsAdaptiveGroupsMax

FieldDescription
responseBodySize Maximum response body size for one request - bytes
wallTime Maximum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsMin

FieldDescription
responseBodySize Minimum response body size for one request - bytes
wallTime Minimum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles

FieldDescription
responseBodySizeP25 Response body size 25th percentile - bytes
responseBodySizeP50 Response body size 50th percentile - bytes
responseBodySizeP75 Response body size 75th percentile - bytes
responseBodySizeP90 Response body size 90th percentile - bytes
responseBodySizeP99 Response body size 99th percentile - bytes
responseBodySizeP999 Response body size 99.9th percentile - bytes
wallTimeP25 Wall time 25th percentile - microseconds
wallTimeP50 Wall time 50th percentile - microseconds
wallTimeP75 Wall time 75th percentile - microseconds
wallTimeP90 Wall time 90th percentile - microseconds
wallTimeP99 Wall time 99th percentile - microseconds
wallTimeP999 Wall time 99.9th percentile - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsSum

FieldDescription
errors Sum of errors
requests Sum of requests
responseBodySize Sum of response body sizes
wallTime Sum of wall time

AccountDurableObjectsPeriodicGroups

Durable Objects periodic metrics

FieldDescription
dimensions List of dimensions to group by
max The max value for a metric
sum The sum of values for a metric per dimension

AccountDurableObjectsPeriodicGroupsDimensions

FieldDescription
date Datetime the metrics period started, truncated to start of a day
datetimeHour Datetime the metrics period started, truncated to start of an hour
datetimeMinute Datetime the metrics period started, truncated to start of a minute
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string

AccountDurableObjectsPeriodicGroupsMax

FieldDescription
activeWebsocketConnections Maximum active websocket connections in the time window

AccountDurableObjectsPeriodicGroupsSum

FieldDescription
activeTime Sum of active time - microseconds
cpuTime Sum of CPU time - microseconds
duration Sum of Duration - GB*s
exceededCpuErrors Sum of CPU exceeded errors
exceededMemoryErrors Sum of memory exceeded errors
fatalInternalErrors Sum of fatal internal server errors
inboundWebsocketMsgCount Sum of incoming websocket messages
outboundWebsocketMsgCount Sum of outbound websocket messages
rowsRead Sum of rows read (by sqlite backed DOs)
rowsWritten Sum of rows written (by sqlite backed DOs)
storageDeletes Sum of storage deletes (by non-sqlite backed DOs)
storageReadUnits Sum of storage reads - in 4KB units (by non-sqlite backed DOs)
storageWriteUnits Sum of storage writes - in 4KB units (by non-sqlite backed DOs)
subrequests Sum of subrequests

AccountDurableObjectsStorageGroups

Durable Objects storage metrics

FieldDescription
dimensions List of dimensions to group by
max The sum of values for a metric per dimension

AccountDurableObjectsStorageGroupsDimensions

FieldDescription
date Datetime that the storage usage was recorded, truncated to start of a day
datetimeHour Datetime that the storage usage was recorded, truncated to start of an hour

AccountDurableObjectsStorageGroupsMax

FieldDescription
storedBytes Max of stored bytes

AccountDurableObjectsSubrequestsAdaptiveGroups

Durable Objects subrequests with adaptive sampling

FieldDescription
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions

FieldDescription
date Request datetime, truncated to start of a day
datetime Request datetime
datetimeHour Request datetime, truncated to start of an hour
datetimeMinute Request datetime, truncated to start of a minute
environmentName The name of the script environment
namespaceId Durable Object namespace ID
objectId Durable Object ID as a hex string
scriptName The name of the script

AccountDurableObjectsSubrequestsAdaptiveGroupsSum

FieldDescription
requestBodySizeUncached Outgoing Durable Objects fetch request body size in bytes where the request was not cached

AccountFbmAttackAnalyticsGroups

FBM analytics metadata for attacks detected by dosd

FieldDescription
attackId Unique identifier of the mitigation that matched the packet, if any
attackType DEPRECATED (Use attackVector for a richer description of the attack): Type of attack traffic
attackVector Description of attack vector
bits Sum of bits received during the attack
commonTcpFlags Common TCP flags used by attack traffic, if any
commonTcpFlagsNames Names of common TCP flags used by attack traffic, if any
destinationIp Fixed destination IP used by attack traffic, if any
destinationPort Fixed destination port used by attack traffic, if any
droppedBits Sum of bits dropped during the attack
droppedPackets Sum of packets dropped during the attack
endDatetime Date and time that the attack ended; not available for ongoing attacks
ipProtocol Fixed protocol used by attack traffic, if any
ipProtocolName Fixed protocol used by attack traffic, if any
mitigationReason Type of mitigation applied to attack traffic
mitigationScope Whether mitigation was applied in only some locations or globally
mitigationType Type of mitigation applied to attack traffic
packets Sum of packets received during the attack
ruleId Unique identifier of the rule that matched the packet, if any
ruleName Human-readable name of the rule that matched the packet, if any
rulesetId Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp Fixed source IP used by attack traffic, if any
sourcePort Fixed source port used by attack traffic, if any
startDatetime Date and time that the attack started
tcpFlags Fixed TCP flags used by attack traffic, if any
tcpFlagsNames Names of fixed TCP flags used by attack traffic, if any

AccountFilter_InputObject

FieldDescription

AccountFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
kind The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult The distinct result of checking for leaked credentials
matchIndex Rules match index in the chain
metadata Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

FieldDescription
avg The average value used for sample interval
count The sum of sample interval values
dimensions List of dimensions to group by
sum

AccountFirewallEventsAdaptiveGroupsAvg

FieldDescription
sampleInterval

AccountFirewallEventsAdaptiveGroupsDimensions

FieldDescription
action The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botScore The final score originated from bot management detections.
botScoreSrcName Name of the source detection which generated the bot management score.
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientIP The visitor's IP address (IPv4 or IPv6)
clientIPClass The classification of the visitor's IP address, possible values are: unknown | clean | badHost | searchEngine | allowlist | greylist | monitoringService | securityScanner | noRecord | scan | backupService | mobilePlatform | tor
clientRefererHost The referer host
clientRefererPath The referer path requested by visitor
clientRefererQuery The referer query-string was requested by the visitor
clientRefererScheme The referer url scheme requested by the visitor
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName The HTTP method used by the visitor
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery The query-string was requested by the visitor
clientRequestScheme The url scheme requested by the visitor
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
description The description of the rule triggered by this request
edgeColoName The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus HTTP response status code returned to browser
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
kind The kind of event, currently only possible values are: firewall
matchIndex Rules match index in the chain
originResponseStatus HTTP origin response status code returned to browser
originatorRayName The RayId of the request that issued the challenge/jschallenge
rayName The RayId of the request
ref The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId The Cloudflare security product-specific RuleId triggered by this request
rulesetId The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval ABR sample interval
source The Cloudflare security product triggered by this request
userAgent visitor's user-agent string
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore DEPRECATED (Field is replaced with wafAttackScore): Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore DEPRECATED (Field is replaced with wafSqliAttackScore): Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore DEPRECATED (Field is replaced with wafXssAttackScore): Beta. WAF ML score for an XSS attack
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
zoneTag Associated zone
zoneVersion The version of a zone

AccountFirewallEventsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.

AccountFirewallEventsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

AccountFirewallEventsAdaptiveMetadataElem

FieldDescription
key The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

AccountFlowtrackdNetworkAnalyticsAdaptiveGroups

Network analytics data for flowtrackd

FieldDescription
avg The average of values for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg

FieldDescription
bitRate Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions

FieldDescription
applicationTag Application tag associated with the packet
coloCity City where the Cloudflare datacenter that received the packet is located
coloCode Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName Cloudflare datacenter that received the packet (unique site identifier)
date Date that the packet was received
datetime Date and time that the packet was received
datetimeFifteenMinutes Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName Name of ASN associated with the destination IP of the packet, if available
destinationCountry Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort Value of the Destination Port header field in the TCP or UDP packet
direction Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum Value of the Checkusm header field in the GRE packet
greEthertype Value of the Ethertype header field in the GRE packet
greHeaderLength Length of the GRE packet header, in bytes
greKey Value of the Key header field in the GRE packet
greSequenceNumber Value of the Sequence Number header field in the GRE packet
greVersion Value of the Version header field in the GRE packet
icmpChecksum Value of the Checkusm header field in the ICMP packet
icmpCode Value of the Code header field in the ICMP packet
icmpType Value of the Type header field in the ICMP packet
ipDestinationAddress Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum Value of the Checksum header field in the IPv4 packet
ipv4DontFragment Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification Value of the Identification header field in the IPv4 packet
ipv4Options List of Options numbers included in the IPv4 packet header
ipv6Dscp Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel Value of the Flow Label header field in the IPv6 packet
ipv6Identification Value of the Identification extension header field in the IPv6 packet
leaseTag IP lease tag associated with the packet
mitigationReason Reason for applying a mitigation to the packet, if any
mitigationScope Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome The action that was taken on the packet (possible values: pass, drop)
prefixTag IP prefix tag associated with the packet
protocolState State of the packet in the context of the protocol, if available
sampleInterval ABR sample interval
sourceAsn ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName Name of ASN associated with the source IP of the packet, if available
sourceCountry Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum Value of the Checkusm header field in the TCP packet
tcpDataOffset Value of the Data Offset header field in the TCP packet
tcpFlags Value of the Flags header field in the TCP packet
tcpFlagsString Human-readable string representation of the Flags header field in the TCP packet
tcpMss Value of the MSS option header field in the TCP packet
tcpOptions List of Options numbers included in the TCP packet header
tcpSackBlocks Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale Value of the Window Scale option header field in the TCP packet
tcpWindowSize Value of the Window Size header field in the TCP packet
udpChecksum Value of the Checkusm header field in the UDP packet
udpPayloadLength Value of the Payload Length header field in the UDP packet
verdict The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum

FieldDescription
bits Sum of bits received
packets Sum of packets received

AccountGatewayL4DownstreamSessionsAdaptiveGroups

Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close

FieldDescription
count The number of downstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
quicErrorCode QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
sessionId Identifier for this session
sourceIP IP address of the client making this session
tokenAuthStatus Client token authentication status. Possible values are success | failed with invalid token and upto date token key ID | failed with invalid token due to outdated/missing token key ID | failed due to reused token
tokenSigningRegion Broad location assigned to client in this session
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportHandshakeDurationUs Time taken for TCP/TLS or QUIC handshake in microsecond
transportStatus Transport Status. Possible values are unknown | success | failure

AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
tokenAuthDurationUsP50 Time taken for Client Token Authentication in microseconds
transportHandshakeDurationUsP50 Time taken for TCP/TLS or QUIC handshake in microseconds

AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
clientBytesRetransmitted Total bytes retransmitted by client in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
tokenAuthDurationUs Time taken for client token authentication in microseconds

AccountGatewayL4SessionsAdaptiveGroups

BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling

FieldDescription
count The number of Gateway L4 sessions
dimensions List of dimensions to group by

AccountGatewayL4SessionsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
applicationIds IDs of the applications that matched the session parameters
applicationNames Names of the applications that matched the session parameters
coloCode Colo Code of edge server
datetime Datetime that the session was started
datetimeHour Datetime that the session was started truncated to hours
datetimeMinute Datetime that the session was started truncated to minutes
destinationIp The destination IP address for the session
destinationPort The destination port for the session
detectedProtocol The detected protocol of network traffic
deviceId The device ID of the gateway user who initiated the session
dstIpContinent Continent code of the session destination IP address
dstIpCountry Country code of the session destination IP address
email The email address of the gateway user who initiated the session
proxyEndpoint The proxy endpoint used on this session
sessionId The network session unique identifier
sni The SNI pulled from the session tls handshake, if present
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
sourceIp The source IP address for the session
sourcePort The source port for the session
srcIpContinent Continent code of the session source IP address
srcIpCountry Country code of the session source IP address
transport DEPRECATED (Field is replaced with transportProtocol): The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp). Deprecated, please use transportProtocol
transportProtocol The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId The ID of the gateway user who initiated the session
virtualNetworkId The ID of the virtual nework the device was connected to
virtualNetworkName The name of the virtual nework the device was connected to

AccountGatewayL4UpstreamSessionsAdaptiveGroups

Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close

FieldDescription
count The number of upstream sessions
dimensions List of dimensions to group by
quantiles
sum

AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions

FieldDescription
coloCode IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date Start timestamp of this session, truncated to date
datetimeFifteenMinutes Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour Start timestamp of this session, truncated to the hour
datetimeMinute Start timestamp of this session, truncated to the minute
destinationIP IP address of the origin server
domainName SNI domain name for this session
downstreamSessionId Downstream session identifier of this session
httpConnectReqStatus Client HTTP CONNECT request status. Possible values are unknown | success | failure
quicErrorCode QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs Last Round Trip Time estimation for this session in microseconds
tokenSigningRegion Broad location assigned to client in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
transport Transport protocol used for this session. Possible values are tcp | quic | udp
transportStatus Transport status. Possible values are unknown | success | failure

AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles

FieldDescription
connectReqHandlingDurationUsP50 Time taken for CONNECT request handling in microseconds
totalTunnelSetupDurationUsP50 Total time taken for tunnel setup in microseconds
tunnelSetupDurationUsP50 Time taken to setup the tunnel in microseconds

AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum

FieldDescription
bytesRecvd Total bytes received in this session
bytesSent Total bytes sent in this session
connectReqHandlingDurationUs Time taken for CONNECT request handling in microseconds
originBytesRetransmitted Total bytes retransmitted by origin in this session
packetsRecvd Total number of packets received in this session
packetsSent Total number of packets sent in this session
totalTunnelSetupDurationUs Total time taken for tunnel setup in microseconds
tunnelSetupDurationUs Time taken for tunnel setup in microseconds

AccountGatewayL7RequestsAdaptiveGroups

BETA - Aggregate counts of Gateway L7 requests with adaptive sampling

FieldDescription
count The number of Gateway L7 requests
dimensions List of dimensions to group by

AccountGatewayL7RequestsAdaptiveGroupsDimensions

FieldDescription
action action taken by gateway
applicationIds IDs of the applications that matched the request parameters
applicationNames Names of the applications that matched the request parameters
categoryIds IDs of the categories that matched the request parameters
categoryNames Names of the categories that matched the request parameters
coloCode Colo Code of edge server
datetime Datetime that the request happened
datetimeHour Datetime that the request happened truncated to hours
datetimeMinute Datetime that the request happened truncated to minutes
deviceId The device ID of the gateway user who made the request
dstIpContinent Continent code of the request destination IP address
dstIpCountry Country code of the request destination IP address
email The email address of the gateway user who made the request
httpHost The destination host for the request
httpStatusCode HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected)
isIsolated Indicates whether this request was made through an isolated link
privateAppAUD Access private app AUD
proxyEndpoint The proxy endpoint used on this request
quarantined Indicates if the request content was quarantined
requestId The request unique identifier
sourceInternalIp Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
srcIpContinent Continent code of the request source IP address
srcIpCountry Country code of the request source IP address
untrustedCertificateAction Action taken when an untrusted origin certificate error occurs
url The request URL
userId The ID of the gateway user who made the request
virtualNetworkId The ID of the virtual nework the device was connected to
virtualNetworkName The name of the virtual nework the device was connected to

AccountGatewayResolverByCategoryAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverByCategoryAdaptiveGroupsDimensions

FieldDescription
authoritativeNameserverIps List of IPs of the authoritative nameservers that provided the answers, if any
categoryId ID of the category that was assigned to the domain
cnames List of resolved intermediate cname domains
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
dohSubdomain The destination DoH subdomain the DNS query was made to
dotSubdomain The destination DoT subdomain the DNS query was made to
edeErrors List of returned Extended DNS Error Codes
locationId The uuid identifying the customer Location used when resolving
matchedApplicationId ID of the application the domain belongs to
matchedApplicationName Name of the application the domain belongs to
policyId ID of the policy/rule that was applied, if any
policyName Name of the policy that was applied, if any
resolvedIpContinents Continent code of each resolved IP, if any
resolvedIpCountries Country code of each resolved IP, if any
resolvedIps List of resolved IPs in the response, if any
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
resourceRecordClasses Resource records' classes
resourceRecordNames Resource records' names
resourceRecordRDatas Resource records' rdata values
resourceRecordTTLs Resource records' TTL values
resourceRecordTypes Resource records' types
srcIpContinent Continent code of the source IP address making the DNS query
srcIpCountry Country code of the source IP address making the DNS query

AccountGatewayResolverByCustomResolverGroups

Stats on dns custom resolvers

FieldDescription
avg The average value for a metric
count The number of Gateway Resolver queries
dimensions List of dimensions to group by
max Maximum response time

AccountGatewayResolverByCustomResolverGroupsAvg

FieldDescription
customResolverTimeInMs Average latency
sampleInterval Average sample interval

AccountGatewayResolverByCustomResolverGroupsDimensions

FieldDescription
cacheStatus whether the response was cached or not
customResolverAddress address at which custom resolver query was resolved at
customResolverResponseCode Response code recieved from the custom resolver 0 => unknown 27 => dnsFirewallSuccess 29 => dnsFirewallCustomerRatelimit 31 => dnsFirewallUpstreamFailure 32 => dnsFirewallUpstreamServfail
customResolverTimeInMs time took for custom resolver to respond
datetime The date and time the DNS query was resolved
locationId The uuid identifying the customer Location used when resolving
queryName Name of the query, e.g. one.dash.cloudflare.com
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)

AccountGatewayResolverByCustomResolverGroupsMax

FieldDescription
customResolverTimeInMs Maximum response time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups

Total time spent on executing firewall rules at the edge

FieldDescription
avg The average value for a metric per dimension
count The number of Gateway Resolver queries
dimensions List of dimensions to group by
max Maximum execution time
quantiles Quantiles of a rule execution performance

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg

FieldDescription
sampleInterval Average sample interval

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions

FieldDescription
datetime Request timestamp
datetimeMonth Request timestamp month

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax

FieldDescription
executionTime Maximum execution time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles

FieldDescription
executionTimeMsP25 Execution time performance of 25th percentile in milliseconds
executionTimeMsP50 Execution time performance of 50th percentile in milliseconds
executionTimeMsP75 Execution time performance of 75th percentile in milliseconds
executionTimeMsP90 Execution time performance of 90th percentile in milliseconds
executionTimeMsP95 Execution time performance of 95th percentile in milliseconds
executionTimeMsP98 Execution time performance of 98th percentile in milliseconds
executionTimeMsP99 Execution time performance of 99th percentile in milliseconds

AccountGatewayResolverQueriesAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling

FieldDescription
count The number of Gateway Resolver queries
dimensions List of dimensions to group by

AccountGatewayResolverQueriesAdaptiveGroupsDimensions

FieldDescription
authoritativeNameserverIps List of IPs of the authoritative nameservers that provided the answers, if any
categoryIds Json array of categories for this query
categoryNames List of matching categories names for this query
cnames List of resolved intermediate cname domains
datetime The date and time the DNS query was resolved
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to minutes
dohSubdomain The destination DoH subdomain the DNS query was made to
dotSubdomain The destination DoT subdomain the DNS query was made to
edeErrors List of returned Extended DNS Error Codes
locationId The uuid identifying the customer Location used when resolving
locationName The name identifying the customer Location used when resolving
matchedApplicationId ID of the application the domain belongs to
matchedApplicationName Name of the application the domain belongs to
matchedIndicatorFeedIds Json array of indicator feed IDs for this query that matched rule
matchedIndicatorFeedNames List of indicator feed names for this query
policyId ID of the policy/rule that was applied, if any
policyName Name of the policy that was applied, if any
queryName Name of the query, e.g. one.dash.cloudflare.com
queryNameReversed Name of the query in reverse order, e.g. com.cloudflare.dash.one
resolvedIpContinents Continent code of each resolved IP, if any
resolvedIpCountries Country code of each resolved IP, if any
resolvedIps List of resolved IPs in the response, if any
resolverDecision Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
resourceRecordClasses Resource records' classes
resourceRecordNames Resource records' names
resourceRecordRDatas Resource records' rdata values
resourceRecordTTLs Resource records' TTL values
resourceRecordTypes Resource records' types
scheduleInfo Json object of schedule releated information
srcIpContinent Continent code of the source IP address making the DNS query
srcIpCountry Country code of the source IP address making the DNS query

AccountHttpRequests1dGroups

Daily rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1dGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1dGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1dGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1dGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1dGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1dGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1dGroupsDimensions

FieldDescription
date Request date

AccountHttpRequests1dGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1dGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1dGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1dGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1dGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1hGroups

Hourly rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1hGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1hGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1hGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1hGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1hGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1hGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1hGroupsDimensions

FieldDescription
date Request date
datetime Request datetime truncated to the hour

AccountHttpRequests1hGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1hGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1hGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1hGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1hGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequests1mGroups

Minutely rollups of request data

FieldDescription
avg The average value for a metric per dimension
dimensions List of dimensions to group by
sum The sum of values for a metric per dimension
uniq The number of unique values for a metric per dimension

AccountHttpRequests1mGroupsAvg

FieldDescription
bytes
sampleInterval Average sample interval

AccountHttpRequests1mGroupsBrowserMapElem

FieldDescription
pageViews Successful requests for HTML content
uaBrowserFamily Browser type

AccountHttpRequests1mGroupsClientHTTPVersionMapElem

FieldDescription
clientHTTPProtocol HTTP version
requests

AccountHttpRequests1mGroupsClientSSLMapElem

FieldDescription
clientSSLProtocol Protocol version
requests

AccountHttpRequests1mGroupsContentTypeMapElem

FieldDescription
bytes Bytes returned to client
edgeResponseContentTypeName Content type returned to client
requests

AccountHttpRequests1mGroupsCountryMapElem

FieldDescription
bytes Bytes returned to client
clientCountryName Country from which request originated
requests
threats Requests classified as threats

AccountHttpRequests1mGroupsDimensions

FieldDescription
date Request date
datetime Request datetime, truncated to the minute
datetimeDay Request datetime truncated to the day
datetimeFifteenMinutes Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour Request datetime truncated to multiple of 30 minutes
datetimeHour Request datetime truncated to the hour
datetimeMinute DEPRECATED (Field is replaced with datetime): Request datetime truncated to the minute

AccountHttpRequests1mGroupsIpClassMapElem

FieldDescription
ipType IP class
requests

AccountHttpRequests1mGroupsResponseStatusMapElem

FieldDescription
edgeResponseStatus HTTP response status code returned to client
requests

AccountHttpRequests1mGroupsSum

FieldDescription
browserMap
bytes Bytes returned to client
cachedBytes Bytes returned to client from cache
cachedRequests Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes Bytes returned to client using SSL/TLS protocol
encryptedRequests Requests served using SSL/TLS protocol
ipClassMap
pageViews Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats Requests classified as threats

AccountHttpRequests1mGroupsThreatPathingMapElem

FieldDescription
requests
threatPathingName Threat type

AccountHttpRequests1mGroupsUniq

FieldDescription
uniques A number of unique IPs

AccountHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus Cache status
clientASNDescription The ASN of the visitor as string
clientAsn The ASN number of the visitor
clientCountryName Country from which request originated
clientDeviceType
clientIP The visitor's IP address (IPv4 or IPv6)
clientRefererHost The referrer host
clientRequestHTTPHost The HTTP hostname requested by the visitor
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol The version of HTTP protocol requested by the visitor
clientRequestPath The path requested by visitor
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme The url scheme requested by the visitor
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus HTTP response status code returned to browser
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
ja4Signals Inter-request statistics computed for this JA4 across Cloudflare's entire global edge network
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP origin response status code returned to browser
rayName The RayId of the request
requestSource
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent visitor's user-agent string
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

FieldDescription
avg The average value used for sample interval
confidence ALPHA - DO NOT USE
count The number of values for a metric per dimension
dimensions List of dimensions to group by
quantiles Quantiles of a metric per dimension
ratio The ratio of a range of status codes, between 0 and 1
sum The sum of values for a metric per dimension

AccountHttpRequestsAdaptiveGroupsAvg

FieldDescription
crossZoneSubrequests The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

AccountHttpRequestsAdaptiveGroupsConfidence

FieldDescription
count The number of values for a metric per dimension, with confidence intervals
level Confidence level that was requested
sum The sum of values for a metric per dimension, with confidence intervals

AccountHttpRequestsAdaptiveGroupsDimensions

FieldDescription
apiGatewayMatchedEndpoint API Gateway endpoint matched at the edge
apiGatewayMatchedHost API Gateway host matched at the edge
botDetectionIds Array of detections ids that matched this request
botDetectionTags Array of detections tags that matched this request
botManagementDecision Judgement of the bot management system
botScore The final score originated from bot management detections.
botScoreBucketBy10 Range of the bot management score
botScoreSrcName Name of the source detection which generated the bot management score.
cacheReserveUsed Used Cache Reserve to serve the response
cacheStatus
clientASNDescription The ASN of the visitor as string
clientAsn
clientCountryName Country from which request originated
clientDeviceType
clientIP
clientRefererHost The referrer host
clientRequestHTTPHost Host requested by the client
clientRequestHTTPMethodName HTTP method of client request
clientRequestHTTPProtocol HTTP protocol version
clientRequestPath Path of client request
clientRequestQuery Query parameters of client request
clientRequestReferer HTTP request referrer
clientRequestScheme HTTP request URI scheme (http/https)
clientSSLProtocol SSL protocol version
coloCode
contentScanHasFailed 1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj Number of scannable content objects that are malicious
contentScanNumObj Number of scannable content objects
contentScanObjResults Array of scan results in order of detection
contentScanObjSizes Array of scan sizes in order of detection
contentScanObjTypes Array of content types in order of detection
date The date the event occurred at the edge
datetime The date and time the event occurred at the edge
datetimeFifteenMinutes The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour The date and time the event occurred at the edge truncated to hours
datetimeMinute The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion DEPRECATED (Field is replaced with zoneVersion): Version associated with HTTP Application
isCrossZoneSubrequest '1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash MD5 hash of the JA3 TLS fingerprint
ja4 JA4 TLS fingerprint
leakedCredentialCheckResult The distinct result of checking for leaked credentials
originASN
originASNDescription ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus HTTP response status code returned by the origin
requestSource
sampleInterval ABR sample interval
securityAction The code of the first-class action the Cloudflare Firewall took on this request
securitySource The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser Browser parsed from the user agent
userAgentOS OS parsed from the user agent
wafAttackScore Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore Beta. WAF score for a RCE attack
wafSqliAttackScore Beta. WAF score for a SQLi attack
wafXssAttackScore Beta. WAF score for a XSS attack
xRequestedWith The X-Requested-With header of the client request
zoneTag Associated zone
zoneVersion The version of a zone

AccountHttpRequestsAdaptiveGroupsQuantiles

FieldDescription
edgeDnsResponseTimeMsP50 50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95 95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99 99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50 50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95 95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99 99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50 50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95 95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99 99th percentile Origin Response Duration (milliseconds)

AccountHttpRequestsAdaptiveGroupsRatio

FieldDescription
status4xx
status5xx

AccountHttpRequestsAdaptiveGroupsSum

FieldDescription
botDetectionIdArray Array of bot management detection ids
botDetectionIdCountArray Count array of bot management detection ids. Elements in this array correspond to elements in botDetectionIdArray by index.
botDetectionTagArray Array of bot management detection tags
botDetectionTagCountArray Count array of bot management detection tags. Elements in this array correspond to elements in botDetectionTagArray by index.
crossZoneSubrequests The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHttpRequestsAdaptiveGroupsSumConfidence

FieldDescription
edgeResponseBytes Confidence interval for the corresponding point estimate

AccountHttpRequestsAdaptiveJa4SignalsElem

FieldDescription
signalName Signal name
signalValue Signal value

AccountHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

FieldDescription
avg The average value for a metric per dimension