DNSFilter Traffic Reports API
The Traffic Reports API from DNSFilter — 53 operation(s) for traffic reports.
The Traffic Reports API from DNSFilter — 53 operation(s) for traffic reports.
openapi: 3.0.0
info:
title: DNSFilter Agent Local User Bulk Deletes Traffic Reports API
description: "\n**Note:** If you are a distributor integrating with DNSFilter, please check\n out our [Distributors Development Guide](/docs/distributors).\n\n### Authentication\n\n- Authentication is required for most, but not all, endpoints.\n\n- Authentication is done by setting the `Authorization` request header.\n The header value is the API key itself.\n For example: `Authorization: eyJ...`\n\n- An API key can be obtained through the DNSFilter dashboard under\n Account Settings. For additional information see\n [this KB article](https://help.dnsfilter.com/hc/en-us/articles/21169189058323-API-Tokens).\n\n### Rate Limiting\n\n- All endpoints are rate limited.\n\n- The limits may vary by endpoint, but are generally consistent.\n\n- When the rate limit is exceeded the API will return the standard `429` HTTP status.\n\n- The following headers will also be provided in the response:\n `Retry-After`, `RateLimit-Policy`, `RateLimit`, `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`.\n For details on the values of these headers, see the following articles\n [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After),\n [here](https://www.ietf.org/archive/id/draft-ietf-httpapi-ratelimit-headers-08.html),\n and [here](https://www.ietf.org/archive/id/draft-polli-ratelimit-headers-05.html).\n\n- For additional information see [this KB article](https://help.dnsfilter.com/hc/en-us/articles/38202811088403-API-Rate-Limits).\n\n### Error Handling\n\n- The API uses standard HTTP status codes to indicate success or failure.\n\n- For _V1_ endpoints the response format is:\n ```json\n { \"error\": \"string\", \"type\": \"string(optional)\" }\n ```\n- For _V2_ endpoints the response format is:\n ```json\n { \"error\": { \"message\": \"string\", \"type\": \"string(optional)\" } }\n ```\n\n### Pagination\n\nFor the _V1_ endpoints, the pagination parameters are nested. That is to say,\nif passed as JSON they look like this: `{\"page[number]\": 1, \"page[size]\": 10}`.\n\nTo pass this information in the URL query string, it would be formatted like\nthis: `...?page%5Bnumber%5D=1&page%5Bsize%5D=10`.\n\nIn this guide, the UI will indicate that `page` is an `object` and if you\nwant to set values when trying the request, you must enter it as if it was\nthe JSON above.\n\n### A Quick Example\n\nThe following will return information about the currently\nauthenticated user.\n\n```bash\n% curl -H 'Authorization: ***' https://api.dnsfilter.com/v1/users/self\n\n{ \"data\": {\n \"id\": \"12345\",\n \"type\": \"users\",\n \"attributes\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\",\n ...additional fields...\n}}}\n```\n"
version: '2026-07-13'
servers:
- url: https://api.dnsfilter.com
description: Production
tags:
- name: Traffic Reports
description: ''
paths:
/v1/traffic_reports/total_requests:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If report from/to range is less than 24 hours (ex.: \"Today\" and \"Yesterday\"), bucket size is fifteen minutes\n If report from/to range is greater than 24 hours (ex.: \"Last 7 days\" and \"Last 14 days\"), bucket size is one day"
required: false
in: query
schema:
type: string
- name: collection_ids
description: Comma separated list of collection IDs, defaults to all
required: false
in: query
schema:
type: string
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: mac_addresses
description: Comma separated list of MAC addresses (without colons) or filter values, defaults to all
required: false
in: query
schema:
type: string
- name: msp_id
description: MSP ID
required: false
in: query
schema:
type: integer
- name: nat_ips
description: Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106)
required: false
in: query
schema:
type: string
- name: network_ids
description: Comma separated list of networks IDs, defaults to all
required: false
in: query
schema:
type: string
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: private_ip
description: Private LAN IP
required: false
in: query
schema:
type: string
- name: private_ip_from
description: Private LAN IP range, lower limit
required: false
in: query
schema:
type: string
- name: private_ip_to
description: Private LAN IP range, upper limit
required: false
in: query
schema:
type: string
- name: security_report
description: Threats report true/false, *both* (threats and non-threats) if it is empty or not sent
required: false
in: query
schema:
type: boolean
- name: show_individual_networks
description: Group report result by network id, defaults to false
required: false
in: query
schema:
type: boolean
- name: source
description: Comma separated list of desired traffic source (networks, user agents, proxies), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- networks
- agents
- proxies
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
- name: type
description: Type of report (all, allowed, blocked), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- allowed
- blocked
- name: user_ids
description: Comma separated list of local user IDs, defaults to all
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequests'
description: Gets the total number of requests for sites in a period of time.
summary: Total requests/time
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests
/v1/traffic_reports/total_requests_geo:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests_geo
parameters:
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: limit
description: Limit the size of the response
required: true
in: query
schema:
type: integer
- name: msp_id
description: MSP ID
required: false
in: query
schema:
type: integer
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequestsGeo'
description: 'Gets the total number of requests for organizations in a period of time
for the heatmap on overview.'
summary: Total requests geo
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests_geo
/v1/traffic_reports/total_requests_organizations:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests_organizations
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If report from/to range is less than 24 hours (ex.: \"Today\" and \"Yesterday\"), bucket size is fifteen minutes\n If report from/to range is greater than 24 hours (ex.: \"Last 7 days\" and \"Last 14 days\"), bucket size is one day"
required: false
in: query
schema:
type: string
- name: collection_ids
description: Comma separated list of collection IDs, defaults to all
required: false
in: query
schema:
type: string
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: mac_addresses
description: Comma separated list of MAC addresses (without colons) or filter values, defaults to all
required: false
in: query
schema:
type: string
- name: msp_id
description: MSP ID
required: false
in: query
schema:
type: integer
- name: nat_ips
description: Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106)
required: false
in: query
schema:
type: string
- name: network_ids
description: Comma separated list of networks IDs, defaults to all
required: false
in: query
schema:
type: string
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: private_ip
description: Private LAN IP
required: false
in: query
schema:
type: string
- name: private_ip_from
description: Private LAN IP range, lower limit
required: false
in: query
schema:
type: string
- name: private_ip_to
description: Private LAN IP range, upper limit
required: false
in: query
schema:
type: string
- name: security_report
description: Threats report true/false, *both* (threats and non-threats) if it is empty or not sent
required: false
in: query
schema:
type: boolean
- name: show_individual_organizations
description: Group report result by organization id, defaults to false
required: false
in: query
schema:
type: boolean
- name: source
description: Comma separated list of desired traffic source (networks, user agents, proxies), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- networks
- agents
- proxies
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
- name: type
description: Type of report (all, allowed, blocked), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- allowed
- blocked
- name: user_ids
description: Comma separated list of local user IDs, defaults to all
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequestsOrganizations'
description: Gets the total number of requests for organizations in a period of time.
summary: Total requests/organizations
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests_organizations
/v1/traffic_reports/total_requests_agents:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests_agents
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If report from/to range is less than 24 hours (ex.: \"Today\" and \"Yesterday\"), bucket size is fifteen minutes\n If report from/to range is greater than 24 hours (ex.: \"Last 7 days\" and \"Last 14 days\"), bucket size is one day"
required: false
in: query
schema:
type: string
- name: collection_ids
description: Comma separated list of collection IDs, defaults to all
required: false
in: query
schema:
type: string
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: mac_addresses
description: Comma separated list of MAC addresses (without colons) or filter values, defaults to all
required: false
in: query
schema:
type: string
- name: msp_id
description: MSP ID
required: false
in: query
schema:
type: integer
- name: nat_ips
description: Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106)
required: false
in: query
schema:
type: string
- name: network_ids
description: Comma separated list of networks IDs, defaults to all
required: false
in: query
schema:
type: string
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: private_ip
description: Private LAN IP
required: false
in: query
schema:
type: string
- name: private_ip_from
description: Private LAN IP range, lower limit
required: false
in: query
schema:
type: string
- name: private_ip_to
description: Private LAN IP range, upper limit
required: false
in: query
schema:
type: string
- name: security_report
description: Threats report true/false, *both* (threats and non-threats) if it is empty or not sent
required: false
in: query
schema:
type: boolean
- name: show_individual_agents
description: Group report result by agent id, defaults to false
required: false
in: query
schema:
type: boolean
- name: source
description: Comma separated list of desired traffic source (networks, user agents, proxies), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- networks
- agents
- proxies
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
- name: type
description: Type of report (all, allowed, blocked), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- allowed
- blocked
- name: user_ids
description: Comma separated list of local user IDs, defaults to all
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequestsAgents'
description: Gets the total number of requests for roaming clients in a period of time.
summary: Total requests clients
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests_agents
/v1/traffic_reports/total_requests_users:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests_users
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If report from/to range is less than 24 hours (ex.: \"Today\" and \"Yesterday\"), bucket size is fifteen minutes\n If report from/to range is greater than 24 hours (ex.: \"Last 7 days\" and \"Last 14 days\"), bucket size is one day"
required: false
in: query
schema:
type: string
- name: collection_ids
description: Comma separated list of collection IDs, defaults to all
required: false
in: query
schema:
type: string
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: mac_addresses
description: Comma separated list of MAC addresses (without colons) or filter values, defaults to all
required: false
in: query
schema:
type: string
- name: msp_id
description: MSP ID
required: false
in: query
schema:
type: integer
- name: nat_ips
description: Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106)
required: false
in: query
schema:
type: string
- name: network_ids
description: Comma separated list of networks IDs, defaults to all
required: false
in: query
schema:
type: string
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: private_ip
description: Private LAN IP
required: false
in: query
schema:
type: string
- name: private_ip_from
description: Private LAN IP range, lower limit
required: false
in: query
schema:
type: string
- name: private_ip_to
description: Private LAN IP range, upper limit
required: false
in: query
schema:
type: string
- name: security_report
description: Threats report true/false, *both* (threats and non-threats) if it is empty or not sent
required: false
in: query
schema:
type: boolean
- name: show_individual_users
description: Group report result by user id, defaults to false
required: false
in: query
schema:
type: boolean
- name: source
description: Comma separated list of desired traffic source (networks, user agents, proxies), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- networks
- agents
- proxies
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
- name: type
description: Type of report (all, allowed, blocked), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- allowed
- blocked
- name: user_ids
description: Comma separated list of local user IDs, defaults to all
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequestsUsers'
description: Gets the total number of requests for users in a period of time.
summary: Total requests users
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests_users
/v1/traffic_reports/total_requests_collections:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_requests_collections
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If report from/to range is less than 24 hours (ex.: \"Today\" and \"Yesterday\"), bucket size is fifteen minutes\n If report from/to range is greater than 24 hours (ex.: \"Last 7 days\" and \"Last 14 days\"), bucket size is one day"
required: false
in: query
schema:
type: string
- name: collection_ids
description: Comma separated list of collection IDs, defaults to all
required: false
in: query
schema:
type: string
- name: from
description: Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized
required: false
in: query
schema:
type: string
- name: mac_addresses
description: Comma separated list of MAC addresses (without colons) or filter values, defaults to all
required: false
in: query
schema:
type: string
- name: nat_ips
description: Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106)
required: false
in: query
schema:
type: string
- name: network_ids
description: Comma separated list of networks IDs, defaults to all
required: false
in: query
schema:
type: string
- name: organization_ids
description: Comma separated list of organization IDs, defaults to user organization ID
required: false
in: query
schema:
type: string
- name: private_ip
description: Private LAN IP
required: false
in: query
schema:
type: string
- name: private_ip_from
description: Private LAN IP range, lower limit
required: false
in: query
schema:
type: string
- name: private_ip_to
description: Private LAN IP range, upper limit
required: false
in: query
schema:
type: string
- name: security_report
description: Threats report true/false, *both* (threats and non-threats) if it is empty or not sent
required: false
in: query
schema:
type: boolean
- name: show_individual_collections
description: Group report result by collection id, defaults to false
required: false
in: query
schema:
type: boolean
- name: source
description: Comma separated list of desired traffic source (networks, user agents, proxies), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- networks
- agents
- proxies
- name: to
description: Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized
required: false
in: query
schema:
type: string
- name: type
description: Type of report (all, allowed, blocked), defaults to all
required: false
in: query
schema:
type: string
enum:
- all
- allowed
- blocked
- name: user_ids
description: Comma separated list of local user IDs, defaults to all
required: false
in: query
schema:
type: string
responses:
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'200':
description: Report result
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/TrafficReportsTotalRequestsCollectionsResult'
description: Gets the total number of requests for collections in a period of time.
summary: Total requests collections
security:
- header_authorization: []
x-controller: v1/traffic_reports
x-action: total_requests_collections
/v1/traffic_reports/total_threats:
get:
tags:
- Traffic Reports
operationId: V1_Traffic_Reports-total_threats
parameters:
- name: agent_ids
description: Comma separated list of user agent UUIDs, defaults to all
required: false
in: query
schema:
type: string
- name: agent_types
description: Comma separated list of user agent types, defaults to all
required: false
in: query
schema:
type: string
- name: application_ids
description: Comma separated list of application IDs, defaults to all
required: false
in: query
schema:
type: string
- name: bucket_size
description: "Desired bucket size, possible values: *auto*, *15min*, *1day*, defaults to *auto*\n*Auto*:\n If re
# --- truncated at 32 KB (355 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/dnsfilter/refs/heads/main/openapi/dnsfilter-traffic-reports-api-openapi.yml