Cisco Meraki Reports API
The Reports API from Cisco Meraki — 9 operation(s) for reports.
OpenAPI Specification
openapi: 3.0.0
info:
title: Meraki Integrated API for Secure Connect — Reports
description: "The Cisco Meraki Integrated API for Secure Connect is a modern REST API based on the OpenAPI specification.\n\
\ ---\n\n [API Documentation](https://meraki.io/api)\n\n [Meraki Homepage](https://www.meraki.com)\n"
version: 1.8.0
contact:
name: Meraki Developer Community
url: https://meraki.io/community
x-provenance:
method: harvested
authored_by: Cisco Meraki
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
derived_view: Per-first-tag view of the source document, tag 'Reports'. Operations and schemas are the provider's, unmodified.
x-evidence:
- type: source
url: https://github.com/meraki/secure-connect-openapi/blob/main/secure_connect_oas_beta.json
- type: raw
url: https://raw.githubusercontent.com/meraki/secure-connect-openapi/main/secure_connect_oas_beta.json
servers:
- url: https://api.meraki.com/{basePath}
variables:
basePath:
default: api/secureConnect/v1
security:
- meraki_api_key: []
- bearerAuth: []
tags:
- name: Reports
paths:
/organizations/{organizationId}/reports/activity:
get:
tags:
- Reports
- Activity
- Umbrella
summary: Get Activities (All)
description: 'List all activities (dns/proxy/firewall/intrusion) within the timeframe.
**Note:** The IP activity report is not available.
**Access Scope:** Reports > Granular Events > Read-Only'
operationId: getActivities
security:
- meraki_api_key: []
parameters:
- name: organizationId
in: path
description: Organization ID associated with this resource.
required: true
schema:
type: integer
- name: from
in: query
description: 'A timestamp or relative time string (for example: ''-1days'').
Filter for data that appears after this time.'
required: true
schema:
type: string
example: '1639146300000'
- name: to
in: query
description: 'A timestamp or relative time string (for example: ''now'').
Filter for data that appears before this time.'
required: true
schema:
type: string
example: '1640010300000'
- name: offset
in: query
description: A number that represents an index in the collection.
schema:
type: number
default: 0
example: 0
- name: limit
in: query
description: The maximum number of records to return from the collection.
required: true
schema:
type: number
default: 100
example: 100
- name: domains
in: query
description: A domain name or comma-delimited list of domain name.
schema:
type: string
example: cisco.com,nasa.gov
- name: urls
in: query
description: A URL or comma-delimited list of URL.
schema:
type: string
example: https://google.com,facebook.com/help
- name: categories
in: query
description: A category ID or comma-delimited list of category ID.
schema:
type: string
example: 148,151,66
- name: policycategories
in: query
description: 'A category ID or comma-delimited list of category ID.
Filter the request by the categories that trigger a policy.'
schema:
type: string
example: 67,69
- name: ip
in: query
description: An IP address.
schema:
type: string
example: 10.10.10.10
- name: ports
in: query
description: A port number or comma-delimited list of port numbers.
schema:
type: string
example: 7351,80
- name: identityids
in: query
description: An identity ID or comma-delimited list of identity IDs.
schema:
type: string
example: 1,2,3
- name: identitytypes
in: query
description: An identity type or comma-delimited list of identity types.
schema:
type: string
example: network,roaming
- name: applicationid
in: query
description: The ID of the application.
schema:
type: string
example: '1'
- name: verdict
in: query
description: A string or comma-delimited string that describes whether the traffic can reach the destination.
schema:
type: string
example: allowed,blocked,proxied
- name: ruleid
in: query
description: The firewall policy rule ID.
schema:
type: number
example: 1
- name: filename
in: query
description: 'A string that identifies a filename. Filter the request by the filename.
Supports globbing or use of the wildcard character (''*''). The asterisk (*) matches
zero or more occurrences of any character.'
schema:
type: string
example: myfilename_*
- name: securityoverridden
in: query
description: Specify whether to filter on requests that override security.
schema:
type: boolean
example: true
- name: bundleid
in: query
description: A proxy bundle ID.
schema:
type: number
example: 1
- name: threats
in: query
description: A threat name or comma-delimited list of threat names.
schema:
type: string
- name: threattypes
in: query
description: A threat type or comma-delimited list of threat types.
schema:
type: string
- name: ampdisposition
in: query
description: An AMP disposition string or a comma-delimited list of AMP disposition strings.
schema:
type: string
example: clean,malicious,unknown
- name: antivirusthreats
in: query
description: A threat name or comma-delimited list of threat names.
schema:
type: string
example: Trojan.Linux.Generic.144075
- name: x-traffic-type
in: header
description: 'A string or comma-delimited list of strings that describes the type of traffic.
If the header is not set, the default value is `all`. Valid values are: `dns`, `proxy`, `firewall`, and `ip`.'
schema:
type: string
example: dns,proxy,firewall,ip
- name: isolatedstate
in: query
description: A string that describes the remote browser isolation (RBI) isolation type.
schema:
type: string
enum:
- isolated
- not-isolated
example: isolated
- name: isolatedFileAction
in: query
description: A string that describes the remote browser isolation (RBI) file action type.
schema:
type: string
enum:
- viewed
- downloaded-original-file
- downloaded-safe-pdf
example: downloaded-safe-pdf
- name: datalosspreventionstate
in: query
description: 'A string that describes the status of a destination.
Filter for requests that are blocked by the DLP layer security.'
schema:
type: string
enum:
- blocked
example: blocked
- name: filternoisydomains
in: query
description: Filter out domains that generate a lot of insignificant traffic (noise).
schema:
type: boolean
example: true
- name: httperrors
in: query
description: Filter data for requests that resulted in a TLS error or a certificate error.
schema:
type: string
enum:
- certificateerror
- tlserror
example: certificateerror
- name: exists
in: query
description: 'Specify an attribute or comma-separated list of attributes to filter the data.
Valid values are: `categories`, `policycategories`, `applicationid`,
`nbarapplicationid`, `nbarapplicationtypeids`, `privateapplicationid`, `applicationgroupids`,
`sha256`, `filename`, `threats`, `threattypes`, `antivirusthreats`, `destinationlistids`, and `httperrors`.'
schema:
type: string
example: destinationlistids,threattypes
- name: timezone
in: query
description: 'Display the timestamp of the traffic events in the specified timezone.
For the timezone, provide a continent and city separated by an url-encoded forward slash (''/''), for example: timezone=''ASIA%2fCALCUTTA''.'
schema:
type: string
example: ASIA%2fCALCUTTA
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
anyOf:
- type: object
description: The information about the DNS activity.
properties:
externalip:
type: string
description: The external IP for the entry.
internalip:
type: string
description: The internal IP for the entry.
policycategories:
type: array
description: The list of the policy categories.
items:
type: object
description: The properties of the category.
properties:
id:
type: number
description: The ID of the category.
label:
type: string
description: The descriptive label for the category.
type:
type: string
description: The type of the category.
integration:
type: boolean
description: Specifies whether the category is an integration.
example: true
deprecated:
type: boolean
description: Specifies whether the category is a legacy category.
example: true
categories:
type: array
description: The list of categories.
items:
type: object
description: The properties of the category.
properties:
id:
type: number
description: The ID of the category.
label:
type: string
description: The descriptive label for the category.
type:
type: string
description: The type of the category.
integration:
type: boolean
description: Specifies whether the category is an integration.
example: true
deprecated:
type: boolean
description: Specifies whether the category is a legacy category.
example: true
verdict:
type: string
description: The verdict for the entry.
enum:
- allowed
- blocked
example: allowed
domain:
type: string
description: The domain name for the entry.
timestamp:
type: number
description: The timestamp represented in milliseconds.
example: 1594557263000
identities:
type: array
description: The list of identities for the entry.
items:
type: object
description: The information about the identity.
properties:
id:
type: number
description: The ID of the identity.
label:
type: string
description: The descriptive label for the identity.
type:
type: object
description: The information about the identity including the type.
properties:
id:
type: number
description: The ID of the origin type for the identity.
label:
type: string
description: The label of the origin type for the identity.
type:
type: string
description: The name of the origin type for the identity.
deleted:
type: boolean
description: Indicates whether the identity was deleted.
example: true
required:
- id
- label
- type
- deleted
example:
id: 1
label: Catch Rate Testing System
type:
id: 21
label: Sites
type: site
deleted: false
allapplications:
type: array
description: The list of all applications for the entry.
items:
type: object
description: The information about the application.
properties:
id:
type: number
description: The ID of the application.
label:
type: string
description: The descriptive label for the application.
type:
type: string
description: 'The type of the application: NBAR or AVC.'
enum:
- NBAR
- AVC
example: AVC
category:
type: object
description: The category of the application.
properties:
id:
type: number
description: The ID of the application category.
label:
type: string
description: The label of the application category.
example:
id: 1
label: malware
type: AVC
category:
id: 2
label: Education
threats:
type: array
description: The list of threats for the entry.
items:
type: object
description: The information about the threat.
properties:
label:
type: string
description: The descriptive label for the threat name.
type:
type: string
description: The type of the threat.
type:
type: string
description: The type of the request. A DNS request always has the type dns.
enum:
- dns
example: dns
querytype:
type: string
description: 'The type of DNS request that was made. For more information,
see Common DNS Request Types.'
date:
type: string
description: The date from the timestamp based on the timezone parameter.
example: '2020-07-12'
time:
type: string
description: The time in 24-hour format based on the timezone parameter.
example: '12:34'
returncode:
type: number
description: 'The DNS return code for this request.
For more information, see Common DNS return codes for any
DNS service (and Umbrella).'
allowedapplications:
type: array
description: The list of allowed applications.
items:
type: object
description: The information about the application.
properties:
id:
type: number
description: The ID of the application.
label:
type: string
description: The descriptive label for the application.
type:
type: string
description: 'The type of the application: NBAR or AVC.'
enum:
- NBAR
- AVC
example: AVC
category:
type: object
description: The category of the application.
properties:
id:
type: number
description: The ID of the application category.
label:
type: string
description: The label of the application category.
example:
id: 1
label: malware
type: AVC
category:
id: 2
label: Education
blockedapplications:
type: array
description: The list of blocked applications.
items:
type: object
description: The information about the application.
properties:
id:
type: number
description: The ID of the application.
label:
type: string
description: The descriptive label for the application.
type:
type: string
description: 'The type of the application: NBAR or AVC.'
enum:
- NBAR
- AVC
example: AVC
category:
type: object
description: The category of the application.
properties:
id:
type: number
description: The ID of the application category.
label:
type: string
description: The label of the application category.
example:
id: 1
label: malware
type: AVC
category:
id: 2
label: Education
required:
- allapplications
- allowedapplications
- blockedapplications
- categories
- date
- domain
- externalip
- identities
- internalip
- policycategories
- querytype
- returncode
- threats
- time
- timestamp
- type
- verdict
example:
externalip: 52.8.160.247
internalip: 52.8.160.247
policycategories:
- id: 66
label: Malware
type: security
integration: true
categories:
- id: 66
label: Malware
type: security
integration: true
verdict: allowed
domain: google.com
timestamp: 1548311506000
time: 06:31:46
date: '2019-01-24'
identities:
- id: 1
label: Catch Rate Testing System
type:
id: 21
label: Sites
type: site
deleted: true
threats:
- label: Wannacry
type: Ransomware
allapplications:
- id: 1
label: label
type: NBAR
category:
id: 1
label: category
allowedapplications:
- id: 1
label: label
type: NBAR
category:
id: 1
label: category
querytype: MX
returncode: 2
blockedapplications: []
type: dns
- type: object
description: The information about the firewall activity.
properties:
date:
type: string
description: The date from the timestamp based on the timezone parameter.
example: '2020-07-12'
destinationip:
type: string
description: The destination IP for the entry.
example: 12.10.10.10
sourceip:
type: string
description: The source IP for the entry.
example: 10.11.10.10
sourceport:
type: number
description: The source port for the entry.
example: 3000
destinationport:
type: number
description: The destination port for entry.
example: 89
categories:
type: array
description: The list of categories.
items:
type: object
description: The properties of the category.
properties:
id:
type: number
description: The ID of the category.
label:
type: string
description: The descriptive label for the category.
type:
type: string
description: The type of the category.
integration:
type: boolean
description: Specifies whether the category is an integration.
example: true
deprecated:
type: boolean
description: Specifies whether the category is a legacy category.
example: true
verdict:
type: string
description: The verdict for the entry.
enum:
- allowed
- blocked
example: allowed
time:
type: string
description: The time in 24-hour format based on the timezone parameter.
example: '12:34'
timestamp:
type: number
description: The timestamp represented in milliseconds.
example: 1594557263000
identities:
type: array
description: The list of identities for the entry.
items:
type: object
description: The information about the identity.
properties:
id:
type: number
description: The ID of the identity.
label:
type: string
description: The descriptive label for the identity.
type:
type: object
description: The information about the identity including the type.
properties:
id:
type: number
description: The ID of the origin type for the identity.
label:
type: string
description: The label of the origin type for the identity.
type:
type: string
description: The name of the origin type for the identity.
deleted:
type: boolean
description: Indicates whether the identity was deleted.
example: true
required:
- id
- label
- type
- deleted
example:
id: 1
label: Catch Rate Testing System
type:
id: 21
label: Sites
type: site
deleted: false
protocol:
type: object
description: The properties of the protocol.
properties:
id:
type: number
description: The ID of protocol.
label:
type: string
description: The name of the protocol.
required:
- id
- label
rule:
type: object
description: The properties of the firewall rule.
properties:
id:
type: number
description: The ID of the rule.
label:
type: string
description: The name of the rule.
privateapplicationgroup:
type: object
description: The private application group.
properties:
id:
nullable: true
type: number
description: The ID of application group.
label:
nullable: true
type: string
# --- truncated at 32 KB (195 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-meraki/refs/heads/main/openapi/cisco-meraki-secure-connect-reports-api-openapi.yml