GraphQL

This lists all of the available datasets and fields in Cloudflare's GraphQL API.

AccountAccessLoginRequestsAdaptiveGroups

Access login requests

Field	Description
avg
count	Number of access login API events processed
dimensions	List of dimensions to group by

AccountAccessLoginRequestsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountAccessLoginRequestsAdaptiveGroupsDimensions

Field	Description
appId	Access application ID
approvingPolicyId	Policy ID that approved the user
cfRayId	CF ray id
country	Country tag
date	The date the access login event was emitted
datetime	The date and time the access login event was emitted
datetimeMinute	The date and time the access login event was emitted truncated to the minute
deviceId	Device ID
hasExistingJWT	Has existing JWT (0 = false, 1 = true)
hasGatewayEnabled	Has Gateway enabled (0 = false, 1 = true)
hasWarpEnabled	Has WARP enabled (0 = false, 1 = true)
identityProvider	Identity provider
ipAddress	User IP address
isSuccessfulLogin	If the login was successful (0 = false, 1 = true)
mtlsCertSerialId	MTLS certificate serial ID
mtlsCommonName	MTLS common name
mtlsStatus	MTLS status (may show error message if status is not successful)
serviceTokenId	Service token ID
userUuid	User UUID

AccountAccessLoginRequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountAccessLoginRequestsAdaptiveGroupsOrderBy

Field	Description

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced DNS Protection

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
dnsQueryName	The requested domain name in the DNS query
dnsQueryType	The query type in the DNS query
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationReason	Reason for applying a mitigation to the packet, if any
mitigationScope	Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountAdvancedDnsProtectionNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroups

Network analytics data for Advanced TCP Protection

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationReason	Reason for applying a mitigation to the packet, if any
mitigationScope	Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
protocolState	State of the packet in the context of the protocol, if available
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountAdvancedTcpProtectionNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountAiGatewayCacheAdaptiveGroups

AI Gateway Cache

Field	Description
count	Total number of requests for an account with caching enabled: including hits and misses
dimensions	List of dimensions to group by

AccountAiGatewayCacheAdaptiveGroupsDimensions

Field	Description
cacheOp	Cache Hit or Miss: 1 = cache hit, 0 = cache miss
date	The date when trigger was triggerd
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
gateway	Gateway name
model	Which model was the request sent to
provider	Which provider was the request sent to
tokensIn	Number of tokens in the request
tokensOut	Number of tokens in the response

AccountAiGatewayCacheAdaptiveGroupsFilter_InputObject

Field	Description

AccountAiGatewayCacheAdaptiveGroupsOrderBy

Field	Description

AccountAiGatewayErrorsAdaptiveGroups

AI Gateway Errors

Field	Description
count	Number of errors
dimensions	List of dimensions to group by

AccountAiGatewayErrorsAdaptiveGroupsDimensions

Field	Description
date	The date when trigger was triggerd
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
gateway	Gateway name
model	Which models was the request sent to
provider	Which provider was the request sent to

AccountAiGatewayErrorsAdaptiveGroupsFilter_InputObject

Field	Description

AccountAiGatewayErrorsAdaptiveGroupsOrderBy

Field	Description

AccountAiGatewayRequestsAdaptiveGroups

AI Gateway Requests

Field	Description
count	Number of processed requests
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountAiGatewayRequestsAdaptiveGroupsDimensions

Field	Description
cached	Was the response served from cache?: 1 = cache hit, 0 = cache misss
date	The date when trigger was triggered
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
gateway	Gateway name
model	Which models was the request sent to
provider	Which provider was the request sent to
rateLimited	Was the request rate limited?: 1 = rate limit applied, 0 = rate limit not applied
tokensIn	Number of tokens in the request
tokensOut	Number of tokens in the response

AccountAiGatewayRequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountAiGatewayRequestsAdaptiveGroupsOrderBy

Field	Description

AccountAiGatewayRequestsAdaptiveGroupsSum

Field	Description
cachedTokensIn	Sum of cached tokens in
cachedTokensOut	Sum of cached tokens out
uncachedTokensIn	Sum of uncached tokens in
uncachedTokensOut	Sum of uncached tokens out

AccountAiInferenceAdaptive

AI Inference logs with adaptive sampling

Field	Description
datetime	The date when inferance was triggered
errorCode	Error code
inferenceTimeMs	Inference time ms
modelId	ModelId that was trigger to inference
neurons	Monetization unit
requestBytesIn	Request size in bytes
requestBytesOut	Request size out bytes
requestSource	Source who triggered (worker binding, pages binding, rest api)
sampleInterval	ABR sample interval

AccountAiInferenceAdaptiveFilter_InputObject

Field	Description

AccountAiInferenceAdaptiveGroups

Aggregated AI Inference logs with adaptive sampling

Field	Description
count	Total number of inferences for an account
dimensions	List of dimensions to group by
sum

AccountAiInferenceAdaptiveGroupsDimensions

Field	Description
date	The date when starts the inference
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
errorCode	Error code
inferenceTimeMs	Inference time ms
modelId	ModelId that was trigger to inference
neurons	Monetization unit
requestBytesIn	Request size in bytes
requestBytesOut	Request size out bytes
requestSource	Source who triggered (worker binding, pages binding, rest api)

AccountAiInferenceAdaptiveGroupsFilter_InputObject

Field	Description

AccountAiInferenceAdaptiveGroupsOrderBy

Field	Description

AccountAiInferenceAdaptiveGroupsSum

Field	Description
totalInferenceTimeMs	Total inference time ms
totalNeurons	Total neurons
totalRequestBytesIn	Total bytes in per request
totalRequestBytesOut	Total bytes out per request

AccountAiInferenceAdaptiveOrderBy

Field	Description

AccountCdnNetworkAnalyticsAdaptiveGroups

Network analytics data for Cloudflare CDN traffic

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountCdnNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountCdnNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag	Device tag associated with the destination IP of the packet
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationSystem	Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag	Device tag associated with the source IP of the packet
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet

AccountCdnNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountCdnNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountCdnNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountD1AnalyticsAdaptiveGroups

Beta. Aggregated D1 analytics with adaptive sampling

Field	Description
avg	The average value for a metric per dimension
count	Number of requests to D1 processed (approximation when sampleInterval > 1)
dimensions	List of dimensions to group by
quantiles	Quantiles of a metric per dimension
sum	The sum of values for a metric per dimension

AccountD1AnalyticsAdaptiveGroupsAvg

Field	Description
queryBatchResponseBytes	The total number of bytes in the response, including all returned rows and metadata (average/mean).
queryBatchTimeMs	Query batch response time in milliseconds (average/mean).
sampleInterval	The average value used for sample interval

AccountD1AnalyticsAdaptiveGroupsDimensions

Field	Description
databaseId	The UUID of a D1 database
date	The date the D1 request was received
datetimeFifteenMinutes	The date and time the D1 request was received truncated to fifteen minutes
datetimeFiveMinutes	The date and time the D1 request was received truncated to five minutes
datetimeHour	The date and time the D1 request was received truncated to the hour
datetimeMinute	The date and time the D1 request was received truncated to the minute

AccountD1AnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountD1AnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountD1AnalyticsAdaptiveGroupsQuantiles

Field	Description
queryBatchResponseBytesP50	The total number of bytes in the response, including all returned rows and metadata (50th percentile).
queryBatchResponseBytesP90	The total number of bytes in the response, including all returned rows and metadata (90th percentile).
queryBatchTimeMsP50	Query batch response time in milliseconds (50th percentile).
queryBatchTimeMsP90	Query batch response time in milliseconds (90th percentile).

AccountD1AnalyticsAdaptiveGroupsSum

Field	Description
queryBatchResponseBytes	The total number of bytes in the response, including all returned rows and metadata.
readQueries	The number of read queries.
rowsRead	The number of rows your queries read.
rowsWritten	The number of rows your queries wrote.
writeQueries	The number of write queries.

AccountDosdAttackAnalyticsGroups

Attack analytics metadata for attacks detected by dosd

Field	Description
attackId	Unique identifier of the mitigation that matched the packet, if any
attackType	Type of attack traffic
attackVector	Description of attack vector
bits	Sum of bits received during the attack
commonTcpFlags	Common TCP flags used by attack traffic, if any
commonTcpFlagsNames	Names of common TCP flags used by attack traffic, if any
destinationIp	Fixed destination IP used by attack traffic, if any
destinationPort	Fixed destination port used by attack traffic, if any
droppedBits	Sum of bits dropped during the attack
droppedPackets	Sum of packets dropped during the attack
endDatetime	Date and time that the attack ended; not available for ongoing attacks
ipProtocol	Fixed protocol used by attack traffic, if any
ipProtocolName	Fixed protocol used by attack traffic, if any
mitigationReason	Type of mitigation applied to attack traffic
mitigationScope	Whether mitigation was applied in only some locations or globally
mitigationType	Type of mitigation applied to attack traffic
packets	Sum of packets received during the attack
ruleId	Unique identifier of the rule that matched the packet, if any
ruleName	Human-readable name of the rule that matched the packet, if any
rulesetId	Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId	Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp	Fixed source IP used by attack traffic, if any
sourcePort	Fixed source port used by attack traffic, if any
startDatetime	Date and time that the attack started
tcpFlags	Fixed TCP flags used by attack traffic, if any
tcpFlagsNames	Names of fixed TCP flags used by attack traffic, if any

AccountDosdAttackAnalyticsGroupsFilter_InputObject

Field	Description

AccountDosdAttackAnalyticsGroupsOrderBy

Field	Description

AccountDosdNetworkAnalyticsAdaptiveGroups

Network analytics data for dosd

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountDosdNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountDosdNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
attackId	Unique identifier of the mitigation that matched the packet, if any
attackVector	Attack vector of the rule that matched the packet, if any
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationReason	Reason for applying a mitigation to the packet, if any
mitigationScope	Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
protocolState	State of the packet in the context of the protocol, if available
ruleId	Unique identifier of the rule that matched the packet, if any
ruleName	Human-readable name of the rule that matched the packet, if any
rulesetId	Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId	Unique identifier of the ruleset override containing the rule that matched the packet, if any
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountDosdNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountDosdNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountDosdNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountDurableObjectsInvocationsAdaptiveGroups

Durable Objects invocations with adaptive sampling

Field	Description
avg	The average value used for sample interval
dimensions	List of dimensions to group by
max	The max value for a metric
min	The min value for a metric
quantiles	Quantiles of a metric per dimension
sum	The sum of values for a metric per dimension

AccountDurableObjectsInvocationsAdaptiveGroupsAvg

Field	Description
sampleInterval

AccountDurableObjectsInvocationsAdaptiveGroupsDimensions

Field	Description
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of a minute
environmentName	The name of the script environment
namespaceId	Durable Object namespace ID
objectId	Durable Object ID as a hex string
scriptName	The name of the script
status	Status of the worker invocation

AccountDurableObjectsInvocationsAdaptiveGroupsFilter_InputObject

Field	Description

AccountDurableObjectsInvocationsAdaptiveGroupsMax

Field	Description
responseBodySize	Maximum response body size for one request - bytes
wallTime	Maximum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsMin

Field	Description
responseBodySize	Minimum response body size for one request - bytes
wallTime	Minimum wall time for one request - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsOrderBy

Field	Description

AccountDurableObjectsInvocationsAdaptiveGroupsQuantiles

Field	Description
responseBodySizeP25	Response body size 25th percentile - bytes
responseBodySizeP50	Response body size 50th percentile - bytes
responseBodySizeP75	Response body size 75th percentile - bytes
responseBodySizeP90	Response body size 90th percentile - bytes
responseBodySizeP99	Response body size 99th percentile - bytes
responseBodySizeP999	Response body size 99.9th percentile - bytes
wallTimeP25	Wall time 25th percentile - microseconds
wallTimeP50	Wall time 50th percentile - microseconds
wallTimeP75	Wall time 75th percentile - microseconds
wallTimeP90	Wall time 90th percentile - microseconds
wallTimeP99	Wall time 99th percentile - microseconds
wallTimeP999	Wall time 99.9th percentile - microseconds

AccountDurableObjectsInvocationsAdaptiveGroupsSum

Field	Description
errors	Sum of errors
requests	Sum of requests
responseBodySize	Sum of response body sizes
wallTime	Sum of wall time

AccountDurableObjectsPeriodicGroups

Durable Objects periodic metrics

Field	Description
dimensions	List of dimensions to group by
max	The max value for a metric
sum	The sum of values for a metric per dimension

AccountDurableObjectsPeriodicGroupsDimensions

Field	Description
date	Datetime the metrics period started, truncated to start of a day
datetimeHour	Datetime the metrics period started, truncated to start of an hour
datetimeMinute	Datetime the metrics period started, truncated to start of a minute
namespaceId	Durable Object namespace ID
objectId	Durable Object ID as a hex string

AccountDurableObjectsPeriodicGroupsFilter_InputObject

Field	Description

AccountDurableObjectsPeriodicGroupsMax

Field	Description
activeWebsocketConnections	Maximum active websocket connections in the time window

AccountDurableObjectsPeriodicGroupsOrderBy

Field	Description

AccountDurableObjectsPeriodicGroupsSum

Field	Description
activeTime	Sum of active time - microseconds
cpuTime	Sum of CPU time - microseconds
duration	Sum of Duration - GB*s
exceededCpuErrors	Sum of CPU exceeded errors
exceededMemoryErrors	Sum of memory exceeded errors
fatalInternalErrors	Sum of fatal internal server errors
inboundWebsocketMsgCount	Sum of incoming websocket messages
outboundWebsocketMsgCount	Sum of outbound websocket messages
storageDeletes	Sum of storage deletes
storageReadUnits	Sum of storage reads - in 4KB units
storageWriteUnits	Sum of storage writes - in 4KB units
subrequests	Sum of subrequests

AccountDurableObjectsStorageGroups

Durable Objects storage metrics

Field	Description
dimensions	List of dimensions to group by
max	The sum of values for a metric per dimension

AccountDurableObjectsStorageGroupsDimensions

Field	Description
date	Datetime that the storage usage was recorded, truncated to start of a day
datetimeHour	Datetime that the storage usage was recorded, truncated to start of an hour

AccountDurableObjectsStorageGroupsFilter_InputObject

Field	Description

AccountDurableObjectsStorageGroupsMax

Field	Description
storedBytes	Max of stored bytes

AccountDurableObjectsStorageGroupsOrderBy

Field	Description

AccountDurableObjectsSubrequestsAdaptiveGroups

Durable Objects subrequests with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountDurableObjectsSubrequestsAdaptiveGroupsDimensions

Field	Description
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of a minute
environmentName	The name of the script environment
namespaceId	Durable Object namespace ID
objectId	Durable Object ID as a hex string
scriptName	The name of the script

AccountDurableObjectsSubrequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountDurableObjectsSubrequestsAdaptiveGroupsOrderBy

Field	Description

AccountDurableObjectsSubrequestsAdaptiveGroupsSum

Field	Description
requestBodySizeUncached	Outgoing Durable Objects fetch request body size in bytes where the request was not cached

AccountFbmAttackAnalyticsGroups

FBM analytics metadata for attacks detected by dosd

Field	Description
attackId	Unique identifier of the mitigation that matched the packet, if any
attackType	Type of attack traffic
attackVector	Description of attack vector
bits	Sum of bits received during the attack
commonTcpFlags	Common TCP flags used by attack traffic, if any
commonTcpFlagsNames	Names of common TCP flags used by attack traffic, if any
destinationIp	Fixed destination IP used by attack traffic, if any
destinationPort	Fixed destination port used by attack traffic, if any
droppedBits	Sum of bits dropped during the attack
droppedPackets	Sum of packets dropped during the attack
endDatetime	Date and time that the attack ended; not available for ongoing attacks
ipProtocol	Fixed protocol used by attack traffic, if any
ipProtocolName	Fixed protocol used by attack traffic, if any
mitigationReason	Type of mitigation applied to attack traffic
mitigationScope	Whether mitigation was applied in only some locations or globally
mitigationType	Type of mitigation applied to attack traffic
packets	Sum of packets received during the attack
ruleId	Unique identifier of the rule that matched the packet, if any
ruleName	Human-readable name of the rule that matched the packet, if any
rulesetId	Unique identifier of the ruleset containing the rule that matched the packet, if any
rulesetOverrideId	Unique identifier of the ruleset override containing the rule that matched the packet, if any
sourceIp	Fixed source IP used by attack traffic, if any
sourcePort	Fixed source port used by attack traffic, if any
startDatetime	Date and time that the attack started
tcpFlags	Fixed TCP flags used by attack traffic, if any
tcpFlagsNames	Names of fixed TCP flags used by attack traffic, if any

AccountFbmAttackAnalyticsGroupsFilter_InputObject

Field	Description

AccountFbmAttackAnalyticsGroupsOrderBy

Field	Description

AccountFilter_InputObject

Field	Description

AccountFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

Field	Description
action	The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botScore	The final score originated from bot management detections.
botScoreSrcName	Name of the source detection which generated the bot management score.
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientIP	The visitor's IP address (IPv4 or IPv6)
clientIPClass	The classification of the visitor's IP address, possible values are: unknown \| clean \| badHost \| searchEngine \| allowlist \| greylist \| monitoringService \| securityScanner \| noRecord \| scan \| backupService \| mobilePlatform \| tor
clientRefererHost	The referer host
clientRefererPath	The referer path requested by visitor
clientRefererQuery	The referer query-string was requested by the visitor
clientRefererScheme	The referer url scheme requested by the visitor
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	The HTTP method used by the visitor
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	The query-string was requested by the visitor
clientRequestScheme	The url scheme requested by the visitor
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
contentScanObjResults	Array of scan results in order of detection
contentScanObjTypes	Array of content types in order of detection
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
description	The description of the rule triggered by this request
edgeColoName	The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus	HTTP response status code returned to browser
httpApplicationVersion	Version associated with HTTP Application
ja3Hash	MD5 hash of the JA3 TLS fingerprint
kind	The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
matchIndex	Rules match index in the chain
metadata	Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus	HTTP origin response status code returned to browser
originatorRayName	The RayId of the request that issued the challenge/jschallenge
rayName	The RayId of the request
ref	The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId	The Cloudflare security product-specific RuleId triggered by this request
rulesetId	The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval	ABR sample interval
source	The Cloudflare security product triggered by this request
userAgent	visitor's user-agent string
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore	Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore	Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore	Beta. WAF ML score for an XSS attack
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
zoneTag	Associated zone
zoneVersion	The version of a zone

AccountFirewallEventsAdaptiveFilter_InputObject

Field	Description

AccountFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

Field	Description
avg	The average value used for sample interval
count	The sum of sample interval values
dimensions	List of dimensions to group by

AccountFirewallEventsAdaptiveGroupsAvg

Field	Description
sampleInterval

AccountFirewallEventsAdaptiveGroupsDimensions

Field	Description
action	The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botScore	The final score originated from bot management detections.
botScoreSrcName	Name of the source detection which generated the bot management score.
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientIP	The visitor's IP address (IPv4 or IPv6)
clientIPClass	The classification of the visitor's IP address, possible values are: unknown \| clean \| badHost \| searchEngine \| allowlist \| greylist \| monitoringService \| securityScanner \| noRecord \| scan \| backupService \| mobilePlatform \| tor
clientRefererHost	The referer host
clientRefererPath	The referer path requested by visitor
clientRefererQuery	The referer query-string was requested by the visitor
clientRefererScheme	The referer url scheme requested by the visitor
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	The HTTP method used by the visitor
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	The query-string was requested by the visitor
clientRequestScheme	The url scheme requested by the visitor
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
description	The description of the rule triggered by this request
edgeColoName	The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus	HTTP response status code returned to browser
httpApplicationVersion	Version associated with HTTP Application
ja3Hash	MD5 hash of the JA3 TLS fingerprint
kind	The kind of event, currently only possible values are: firewall
matchIndex	Rules match index in the chain
originResponseStatus	HTTP origin response status code returned to browser
originatorRayName	The RayId of the request that issued the challenge/jschallenge
rayName	The RayId of the request
ref	The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId	The Cloudflare security product-specific RuleId triggered by this request
rulesetId	The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval	ABR sample interval
source	The Cloudflare security product triggered by this request
userAgent	visitor's user-agent string
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore	Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore	Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore	Beta. WAF ML score for an XSS attack
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
zoneTag	Associated zone
zoneVersion	The version of a zone

AccountFirewallEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountFirewallEventsAdaptiveGroupsOrderBy

Field	Description

AccountFirewallEventsAdaptiveMetadataElem

Field	Description
key	The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value	The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

AccountFirewallEventsAdaptiveOrderBy

Field	Description

AccountFlowtrackdNetworkAnalyticsAdaptiveGroups

Network analytics data for flowtrackd

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationReason	Reason for applying a mitigation to the packet, if any
mitigationScope	Whether the packet matched a local or global mitigation, if any (possible values: local, global)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
protocolState	State of the packet in the context of the protocol, if available
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountFlowtrackdNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountGatewayL4DownstreamSessionsAdaptiveGroups

Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close

Field	Description
count	The number of downstream sessions
dimensions	List of dimensions to group by
quantiles
sum

AccountGatewayL4DownstreamSessionsAdaptiveGroupsDimensions

Field	Description
coloCode	IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry	ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date	Start timestamp of this session, truncated to date
datetimeFifteenMinutes	Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes	Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour	Start timestamp of this session, truncated to the hour
datetimeMinute	Start timestamp of this session, truncated to the minute
quicErrorCode	QUIC specific error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs	Last Round Trip Time estimation for this session in microseconds
sessionId	Identifier for this session
sourceIP	IP address of the client making this session
tokenAuthStatus	Client token authentication status. Possible values are success \| failed with invalid token and upto date token key ID \| failed with invalid token due to outdated/missing token key ID \| failed due to reused token
tokenSigningRegion	Broad location assigned to client in this session
transport	Transport protocol used for this session. Possible values are tcp \| quic \| udp
transportHandshakeDurationUs	Time taken for TCP/TLS or QUIC handshake in microsecond
transportStatus	Transport Status. Possible values are unknown \| success \| failure

AccountGatewayL4DownstreamSessionsAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayL4DownstreamSessionsAdaptiveGroupsOrderBy

Field	Description

AccountGatewayL4DownstreamSessionsAdaptiveGroupsQuantiles

Field	Description
tokenAuthDurationUsP50	Time taken for Client Token Authentication in microseconds
transportHandshakeDurationUsP50	Time taken for TCP/TLS or QUIC handshake in microseconds

AccountGatewayL4DownstreamSessionsAdaptiveGroupsSum

Field	Description
bytesRecvd	Total bytes received in this session
bytesSent	Total bytes sent in this session
clientBytesRetransmitted	Total bytes retransmitted by client in this session
packetsRecvd	Total number of packets received in this session
packetsSent	Total number of packets sent in this session
tokenAuthDurationUs	Time taken for client token authentication in microseconds

AccountGatewayL4SessionsAdaptiveGroups

BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling

Field	Description
count	The number of Gateway L4 sessions
dimensions	List of dimensions to group by

AccountGatewayL4SessionsAdaptiveGroupsDimensions

Field	Description
action	action taken by gateway
coloCode	Colo Code of edge server
datetime	Datetime that the session was started
datetimeHour	Datetime that the session was started truncated to hours
datetimeMinute	Datetime that the session was started truncated to minutes
destinationIp	The destination IP address for the session
destinationPort	The destination port for the session
detectedProtocol	The detected protocol of network traffic
deviceId	The device ID of the gateway user who initiated the session
email	The email address of the gateway user who initiated the session
sni	The SNI pulled from the session tls handshake, if present
sourceInternalIp	Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
sourceIp	The source IP address for the session
sourcePort	The source port for the session
transport	The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId	The ID of the gateway user who initiated the session

AccountGatewayL4SessionsAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayL4SessionsAdaptiveGroupsOrderBy

Field	Description

AccountGatewayL4UpstreamSessionsAdaptiveGroups

Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close

Field	Description
count	The number of upstream sessions
dimensions	List of dimensions to group by
quantiles
sum

AccountGatewayL4UpstreamSessionsAdaptiveGroupsDimensions

Field	Description
coloCode	IATA Airport code that represents the city in which a Cloudflare data center (colo) is located
coloCountry	ISO 3166-1 alpha-2 code that represents the country in which a Cloudflare data center (colo) is located
date	Start timestamp of this session, truncated to date
datetimeFifteenMinutes	Start timestamp of this session, truncated to multiple of 15 minutes
datetimeFiveMinutes	Start timestamp of this session, truncated to multiple of 5 minutes
datetimeHour	Start timestamp of this session, truncated to the hour
datetimeMinute	Start timestamp of this session, truncated to the minute
destinationIP	IP address of the origin server
domainName	SNI domain name for this session
downstreamSessionId	Downstream session identifier of this session
httpConnectReqStatus	Client HTTP CONNECT request status. Possible values are unknown \| success \| failure
quicErrorCode	QUIC error code. Possible values are https://www.iana.org/assignments/quic/quic.xhtml#quic-transport-error-codes
rttUs	Last Round Trip Time estimation for this session in microseconds
tokenSigningRegion	Broad location assigned to client in this session
totalTunnelSetupDurationUs	Total time taken for tunnel setup in microseconds
transport	Transport protocol used for this session. Possible values are tcp \| quic \| udp
transportStatus	Transport status. Possible values are unknown \| success \| failure

AccountGatewayL4UpstreamSessionsAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayL4UpstreamSessionsAdaptiveGroupsOrderBy

Field	Description

AccountGatewayL4UpstreamSessionsAdaptiveGroupsQuantiles

Field	Description
connectReqHandlingDurationUsP50	Time taken for CONNECT request handling in microseconds
totalTunnelSetupDurationUsP50	Total time taken for tunnel setup in microseconds
tunnelSetupDurationUsP50	Time taken to setup the tunnel in microseconds

AccountGatewayL4UpstreamSessionsAdaptiveGroupsSum

Field	Description
bytesRecvd	Total bytes received in this session
bytesSent	Total bytes sent in this session
connectReqHandlingDurationUs	Time taken for CONNECT request handling in microseconds
originBytesRetransmitted	Total bytes retransmitted by origin in this session
packetsRecvd	Total number of packets received in this session
packetsSent	Total number of packets sent in this session
totalTunnelSetupDurationUs	Total time taken for tunnel setup in microseconds
tunnelSetupDurationUs	Time taken for tunnel setup in microseconds

AccountGatewayL7RequestsAdaptiveGroups

BETA - Aggregate counts of Gateway L7 requests with adaptive sampling

Field	Description
count	The number of Gateway L7 requests
dimensions	List of dimensions to group by

AccountGatewayL7RequestsAdaptiveGroupsDimensions

Field	Description
action	action taken by gateway
coloCode	Colo Code of edge server
datetime	Datetime that the request happened
datetimeHour	Datetime that the request happened truncated to hours
datetimeMinute	Datetime that the request happened truncated to minutes
deviceId	The device ID of the gateway user who made the request
email	The email address of the gateway user who made the request
httpHost	The destination host for the request
httpStatusCode	HTTP status code gateway returned to the user. 0 if nothing was returned(e.g client disconnected)
isIsolated	Indicates whether this request was made through an isolated link
sourceInternalIp	Local LAN IP of the device. Only available when connected via a GRE/IPsec tunnel on-ramp
untrustedCertificateAction	Action taken when an untrusted origin certificate error occurs
userId	The ID of the gateway user who made the request

AccountGatewayL7RequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayL7RequestsAdaptiveGroupsOrderBy

Field	Description

AccountGatewayResolverByCategoryAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling

Field	Description
count	The number of Gateway Resolver queries
dimensions	List of dimensions to group by

AccountGatewayResolverByCategoryAdaptiveGroupsDimensions

Field	Description
categoryId	ID of the category that was assigned to the domain
datetime	The date and time the DNS query was resolved
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to minutes
locationId	The uuid identifying the customer Location used when resolving
resolverDecision	Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)

AccountGatewayResolverByCategoryAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayResolverByCategoryAdaptiveGroupsOrderBy

Field	Description

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroups

Total time spent on executing firewall rules at the edge

Field	Description
avg	The average value for a metric per dimension
count	The number of Gateway Resolver queries
dimensions	List of dimensions to group by
max	Maximum execution time
quantiles	Quantiles of a rule execution performance

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsDimensions

Field	Description
datetime	Request timestamp
datetimeMonth	Request timestamp month

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsMax

Field	Description
executionTime	Maximum execution time

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsOrderBy

Field	Description

AccountGatewayResolverByRuleExecutionPerformanceAdaptiveGroupsQuantiles

Field	Description
executionTimeMsP25	Execution time performance of 25th percentile in milliseconds
executionTimeMsP50	Execution time performance of 50th percentile in milliseconds
executionTimeMsP75	Execution time performance of 75th percentile in milliseconds
executionTimeMsP90	Execution time performance of 90th percentile in milliseconds
executionTimeMsP95	Execution time performance of 95th percentile in milliseconds
executionTimeMsP98	Execution time performance of 98th percentile in milliseconds
executionTimeMsP99	Execution time performance of 99th percentile in milliseconds

AccountGatewayResolverQueriesAdaptiveGroups

BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling

Field	Description
count	The number of Gateway Resolver queries
dimensions	List of dimensions to group by

AccountGatewayResolverQueriesAdaptiveGroupsDimensions

Field	Description
categoryIds	Json array of categories for this query
datetime	The date and time the DNS query was resolved
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to minutes
locationId	The uuid identifying the customer Location used when resolving
matchedIndicatorFeedIds	Json array of indicator feed IDs for this query that matched rule
queryName	Name of the query, e.g. one.dash.cloudflare.com
queryNameReversed	Name of the query in reverse order, e.g. com.cloudflare.dash.one
resolverDecision	Enum identifier for the decision made by gateway-resolver, one of: (0, unknown) (1, allowedByQueryName) (2, blockedByQueryName) (3, blockedByCategory) (4, allowedOnNoLocation) (5, allowedOnNoPolicyMatch) (6, blockedAlwaysCategory) (7, overrideForSafeSearch) (8, overrideApplied) (9, blockedRule) (10, allowedRule)
scheduleInfo	Json object of schedule releated information

AccountGatewayResolverQueriesAdaptiveGroupsFilter_InputObject

Field	Description

AccountGatewayResolverQueriesAdaptiveGroupsOrderBy

Field	Description

AccountHttpRequests1dGroups

Daily rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

AccountHttpRequests1dGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

AccountHttpRequests1dGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

AccountHttpRequests1dGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

AccountHttpRequests1dGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

AccountHttpRequests1dGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

AccountHttpRequests1dGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

AccountHttpRequests1dGroupsDimensions

Field	Description
date	Request date

AccountHttpRequests1dGroupsFilter_InputObject

Field	Description

AccountHttpRequests1dGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

AccountHttpRequests1dGroupsOrderBy

Field	Description

AccountHttpRequests1dGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

AccountHttpRequests1dGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

AccountHttpRequests1dGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

AccountHttpRequests1dGroupsUniq

Field	Description
uniques	A number of unique IPs

AccountHttpRequests1hGroups

Hourly rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

AccountHttpRequests1hGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

AccountHttpRequests1hGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

AccountHttpRequests1hGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

AccountHttpRequests1hGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

AccountHttpRequests1hGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

AccountHttpRequests1hGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

AccountHttpRequests1hGroupsDimensions

Field	Description
date	Request date
datetime	Request datetime truncated to the hour

AccountHttpRequests1hGroupsFilter_InputObject

Field	Description

AccountHttpRequests1hGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

AccountHttpRequests1hGroupsOrderBy

Field	Description

AccountHttpRequests1hGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

AccountHttpRequests1hGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

AccountHttpRequests1hGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

AccountHttpRequests1hGroupsUniq

Field	Description
uniques	A number of unique IPs

AccountHttpRequests1mGroups

Minutely rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

AccountHttpRequests1mGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

AccountHttpRequests1mGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

AccountHttpRequests1mGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

AccountHttpRequests1mGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

AccountHttpRequests1mGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

AccountHttpRequests1mGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

AccountHttpRequests1mGroupsDimensions

Field	Description
date	Request date
datetime	Request datetime, truncated to the minute
datetimeDay	Request datetime truncated to the day
datetimeFifteenMinutes	Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime truncated to multiple of 30 minutes
datetimeHour	Request datetime truncated to the hour
datetimeMinute	Request datetime truncated to the minute

AccountHttpRequests1mGroupsFilter_InputObject

Field	Description

AccountHttpRequests1mGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

AccountHttpRequests1mGroupsOrderBy

Field	Description

AccountHttpRequests1mGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

AccountHttpRequests1mGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

AccountHttpRequests1mGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

AccountHttpRequests1mGroupsUniq

Field	Description
uniques	A number of unique IPs

AccountHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

Field	Description
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botManagementDecision	Judgement of the bot management system
botScore	The final score originated from bot management detections.
botScoreBucketBy10	Range of the bot management score
botScoreSrcName	Name of the source detection which generated the bot management score.
cacheReserveUsed	Used Cache Reserve to serve the response
cacheStatus	Cache status
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientDeviceType
clientIP	The visitor's IP address (IPv4 or IPv6)
clientRefererHost	The referrer host
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	HTTP method of client request
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	Query parameters of client request
clientRequestReferer	HTTP request referrer
clientRequestScheme	The url scheme requested by the visitor
clientSSLProtocol	SSL protocol version
coloCode
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs	The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus	HTTP response status code returned to browser
edgeTimeToFirstByteMs	The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion	Version associated with HTTP Application
isCrossZoneSubrequest	'1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash	MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
originASN
originASNDescription	ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus	HTTP origin response status code returned to browser
requestSource
securityAction	The code of the first-class action the Cloudflare Firewall took on this request
securitySource	The Cloudflare security product triggered by this request
upperTierColoName
userAgent	visitor's user-agent string
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
xRequestedWith	The X-Requested-With header of the client request
zoneTag	Associated zone
zoneVersion	The version of a zone

AccountHttpRequestsAdaptiveFilter_InputObject

Field	Description

AccountHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

Field	Description
avg	The average value used for sample interval
confidence	ALPHA - DO NOT USE
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
quantiles	Quantiles of a metric per dimension
ratio	The ratio of a range of status codes, between 0 and 1
sum	The sum of values for a metric per dimension

AccountHttpRequestsAdaptiveGroupsAvg

Field	Description
crossZoneSubrequests	The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs	The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

AccountHttpRequestsAdaptiveGroupsConfidence

Field	Description
count	The number of values for a metric per dimension, with confidence intervals
level	Confidence level that was requested
sum	The sum of values for a metric per dimension, with confidence intervals

AccountHttpRequestsAdaptiveGroupsDimensions

Field	Description
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botManagementDecision	Judgement of the bot management system
botScore	The final score originated from bot management detections.
botScoreBucketBy10	Range of the bot management score
botScoreSrcName	Name of the source detection which generated the bot management score.
cacheReserveUsed	Used Cache Reserve to serve the response
cacheStatus
clientASNDescription	The ASN of the visitor as string
clientAsn
clientCountryName	Country from which request originated
clientDeviceType
clientIP
clientRefererHost	The referrer host
clientRequestHTTPHost	Host requested by the client
clientRequestHTTPMethodName	HTTP method of client request
clientRequestHTTPProtocol	HTTP protocol version
clientRequestPath	Path of client request
clientRequestQuery	Query parameters of client request
clientRequestReferer	HTTP request referrer
clientRequestScheme	HTTP request URI scheme (http/https)
clientSSLProtocol	SSL protocol version
coloCode
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs	The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs	The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion	Version associated with HTTP Application
isCrossZoneSubrequest	'1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash	MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
originASN
originASNDescription	ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus	HTTP response status code returned by the origin
requestSource
sampleInterval	ABR sample interval
securityAction	The code of the first-class action the Cloudflare Firewall took on this request
securitySource	The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
xRequestedWith	The X-Requested-With header of the client request
zoneTag	Associated zone
zoneVersion	The version of a zone

AccountHttpRequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountHttpRequestsAdaptiveGroupsOrderBy

Field	Description

AccountHttpRequestsAdaptiveGroupsQuantiles

Field	Description
edgeDnsResponseTimeMsP50	50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95	95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99	99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50	50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95	95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99	99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50	50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95	95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99	99th percentile Origin Response Duration (milliseconds)

AccountHttpRequestsAdaptiveGroupsRatio

Field	Description
status4xx
status5xx

AccountHttpRequestsAdaptiveGroupsSum

Field	Description
crossZoneSubrequests	The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits	The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHttpRequestsAdaptiveGroupsSumConfidence

Field	Description
edgeResponseBytes	Confidence interval for the corresponding point estimate

AccountHttpRequestsAdaptiveOrderBy

Field	Description

AccountHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
ratio	The ratio of a metric in comparison to the rest of the traffic, between 0 and 1
sum	The sum of values for a metric per dimension

AccountHttpRequestsOverviewAdaptiveGroupsAvg

Field	Description
originResponseDurationMs	The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval	Average sample interval

AccountHttpRequestsOverviewAdaptiveGroupsDimensions

Field	Description
clientCountryName	Country from which request originated
clientRequestHTTPProtocol	HTTP protocol version
clientSSLProtocol	SSL protocol version
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName	Content type returned to client
edgeResponseStatus	HTTP response status code returned to client
httpApplicationVersion	Version associated with HTTP Application
userAgentBrowser	Browser parsed from the user agent
zoneVersion	The version of a zone

AccountHttpRequestsOverviewAdaptiveGroupsFilter_InputObject

Field	Description

AccountHttpRequestsOverviewAdaptiveGroupsOrderBy

Field	Description

AccountHttpRequestsOverviewAdaptiveGroupsRatio

Field	Description
cachedBytes
cachedRequests
encryptedBytes
encryptedRequests
status4xx
status5xx

AccountHttpRequestsOverviewAdaptiveGroupsSum

Field	Description
bytes
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
pageViews	Successful requests for HTML content
requests
visits	The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

AccountHyperdriveQueriesAdaptiveGroups

Beta. Hyperdrive query events with adaptive sampling.

Field	Description
avg	The average value for a metric per dimension
count	Total number of Hyperdrive queries
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountHyperdriveQueriesAdaptiveGroupsAvg

Field	Description
queryBytes	Average size (in bytes) of queries handled by Hyperdrive
resultBytes	Average size (in bytes) of query results served by Hyperdrive
sampleInterval	The average value used for sample interval

AccountHyperdriveQueriesAdaptiveGroupsDimensions

Field	Description
cacheStatus	The cache status of the Hyperdrive query events
configId	The ID of the Hyperdrive Config
date	Hyperdrive query event timestamp, truncated to start of a day
datetime	Hyperdrive query event timestamp
datetimeHour	Hyperdrive query event timestamp, truncated to start of hour
datetimeMinute	Hyperdrive query event timestamp, truncated to start of minute

AccountHyperdriveQueriesAdaptiveGroupsFilter_InputObject

Field	Description

AccountHyperdriveQueriesAdaptiveGroupsOrderBy

Field	Description

AccountHyperdriveQueriesAdaptiveGroupsSum

Field	Description
queryBytes	Total size (in bytes) of queries handled by Hyperdrive
resultBytes	Total size (in bytes) of query results served by Hyperdrive

AccountImagesRequestsAdaptiveGroups

A high-level summary of Cloudflare Images served to end users.

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountImagesRequestsAdaptiveGroupsAvg

Field	Description
sampleInterval

AccountImagesRequestsAdaptiveGroupsDimensions

Field	Description
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute

AccountImagesRequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountImagesRequestsAdaptiveGroupsOrderBy

Field	Description

AccountImagesRequestsAdaptiveGroupsSum

Field	Description
requests

AccountImagesUniqueTransformations

Image unique transfromations per day

Field	Description
date	The date uniques are calculated for
transformations	Number of unique image transformations per day in sliding window

AccountImagesUniqueTransformationsFilter_InputObject

Field	Description

AccountImagesUniqueTransformationsOrderBy

Field	Description

AccountLogpushHealthAdaptiveGroups

Beta. Logpush job health metrics

Field	Description
avg
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountLogpushHealthAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountLogpushHealthAdaptiveGroupsDimensions

Field	Description
date	Date that we completed pushing the log batch
datetime	Datetime that we completed pushing the log batch
datetimeFifteenMinutes	Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes
datetimeFiveMinutes	Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes
datetimeHour	Datetime that we completed pushing the log batch, truncated to the hour
datetimeMinute	Datetime that we completed pushing the log batch, truncated to the minute
destinationType	Destination type, e.g. 'S3' or 'GCS'
final	Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true.
jobId	The Logpush Job ID
status	HTTP response status code of the log destination

AccountLogpushHealthAdaptiveGroupsFilter_InputObject

Field	Description

AccountLogpushHealthAdaptiveGroupsOrderBy

Field	Description

AccountLogpushHealthAdaptiveGroupsSum

Field	Description
bytes	Bytes of uncompressed log data pushed
bytesCompressed	Bytes of compressed log data pushed
records	A count of the total number of records pushed.

AccountMagicFirewallNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Firewall

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag	Device tag associated with the destination IP of the packet
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
ruleId	Unique identifier of the rule that matched the packet, if any
rulesetId	Unique identifier of the ruleset containing the rule that matched the packet, if any
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag	Device tag associated with the source IP of the packet
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountMagicFirewallNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountMagicFirewallSamplesAdaptiveGroups

Data to visualize traffic allowed and blocked by Magic Firewall rules

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountMagicFirewallSamplesAdaptiveGroupsDimensions

Field	Description
datetime	Date and time that the packet was received
datetimeFiveMinute	Date and time that the packet was received, rounded to the start of the nearest five minutes
ruleId	Unique identifier of the rule that matched the packet, if any

AccountMagicFirewallSamplesAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicFirewallSamplesAdaptiveGroupsOrderBy

Field	Description

AccountMagicFirewallSamplesAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountMagicIDPSNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic IDS

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationDeviceTag	Device tag associated with the destination IP of the packet
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
outcome	The action that was taken on the packet (possible values: pass, drop)
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceDeviceTag	Device tag associated with the source IP of the packet
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet
verdict	The action that Cloudflare thinks should be taken on the packet (possible values: pass, drop)

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountMagicIDPSNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountMagicTransitNetworkAnalyticsAdaptiveGroups

Network analytics data for Magic Transit traffic

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
egressTunnelID	GRE or IPSec Egress Tunnel ID for Magic WAN and Magic Transit traffic
egressTunnelName	GRE or IPSec Egress Tunnel name for Magic WAN and Magic Transit traffic
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ingressTunnelID	GRE or IPSec Ingress Tunnel ID for Magic WAN and Magic Transit traffic
ingressTunnelName	GRE or IPSec Ingress Tunnel name for Magic WAN and Magic Transit traffic
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationSystem	Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountMagicTransitNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountMagicTransitTunnelHealthChecksAdaptiveGroups

Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).

Field	Description
avg
count	Total number of healthcheck results
dimensions	List of dimensions to group by

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval per dimension
tunnelState	Combined Tunnel State aggregated from multiple results. 0 is down, 0.5 is degraded and 1 is healthy

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsDimensions

Field	Description
datetime	The time the healthcheck request was sent
datetimeFifteenMinutes	The time the healthcheck request was sent, truncated to multiple of 15 minutes
datetimeFiveMinutes	The time the healthcheck request was sent, truncated to multiple of 5 minutes
datetimeHalfOfHour	The time the healthcheck request was sent, truncated to multiple of 30 minutes
datetimeHour	The time the healthcheck request was sent, truncated to the hour
datetimeMinute	The time the healthcheck request was sent, truncated to the last minute
edgeColoCity	City of the Cloudflare datacenter from where the healthcheck was run
edgeColoCode	IATA airport code of the Cloudflare datacenter from where the healthcheck was run
edgeColoCountry	Country of the Cloudflare datacenter from where the healthcheck was run
edgeColoName	The name of the Cloudflare datacenter from where the healthcheck was run
edgeColoRegion	Region of the Cloudflare datacenter from where the healthcheck was run
remoteTunnelIPv4	IP address of the remote end of the tunnel
resultStatus	The status of the request
tunnelName	Human friendly tunnel name

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicTransitTunnelHealthChecksAdaptiveGroupsOrderBy

Field	Description

AccountMagicTransitTunnelTrafficAdaptiveGroups

Bandwidth usage metric of a Magic Transit tunnel.

Field	Description
avg	Ingress/Egress bandwidth in bits per second for a past duration
dimensions	List of dimensions to group by

AccountMagicTransitTunnelTrafficAdaptiveGroupsAvg

Field	Description
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour

AccountMagicTransitTunnelTrafficAdaptiveGroupsDimensions

Field	Description
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
edgeColoCity	City where the Cloudflare datacenter that received the packet is located
edgeColoCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
edgeColoCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
edgeColoGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
edgeColoName	Cloudflare datacenter that received the packet (unique site identifier)
tunnelName	Tunnel device name

AccountMagicTransitTunnelTrafficAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicTransitTunnelTrafficAdaptiveGroupsOrderBy

Field	Description

AccountMagicWANConnectorMetricsAdaptiveGroups

Beta. Magic WAN Connector Metrics

Field	Description
avg
dimensions	List of dimensions to group by
max

AccountMagicWANConnectorMetricsAdaptiveGroupsAvg

Field	Description
cpuLoadPercentage	Average CPU load percentage
cpuTemperature	Average CPU temperature
diskUsagePercentage	Average Disk usage percentage
memoryUsagePercentage	Average Memory usage percentage
rxBitrateFiveMinute	Rx Bitrate over 5 minutes
rxBitrateMinute	Rx Bitrate over 1 minute
rxPacketrateFiveMinute	Rx Packet rate over 5 minutes
rxPacketrateMinute	Rx Packet rate over 1 minute
txBitrateFiveMinute	Tx Bitrate over 5 minutes
txBitrateMinute	Tx Bitrate over 1 minute
txPacketrateFiveMinute	Tx Packet rate over 5 minutes
txPacketrateMinute	Tx Packet rate over 1 minute

AccountMagicWANConnectorMetricsAdaptiveGroupsDimensions

Field	Description
datetime	The date and time the event was recorded
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
mconnInterfaceName	Name of connector interface
mconnInterfaceType	Interface type LAN, WAN or IPSEC
mconnSiteID	Customer site identifier

AccountMagicWANConnectorMetricsAdaptiveGroupsFilter_InputObject

Field	Description

AccountMagicWANConnectorMetricsAdaptiveGroupsMax

Field	Description
interfaceCount	Number of interfaces of a given Type

AccountMagicWANConnectorMetricsAdaptiveGroupsOrderBy

Field	Description

AccountMnmFlowDataAdaptiveGroups

Flow data collected through Magic Network Monitoring

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountMnmFlowDataAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds
sampleInterval	Average sample interval applied to the data

AccountMnmFlowDataAdaptiveGroupsDimensions

Field	Description
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAddress	IP to which the data was sent
destinationPort	Value of the Destination Port header field in the packet
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
protocol	Layer 4 protocol
protocolString	Human-readable string representation of the protocol
routerAddress	IP of the router that sampled the flows
ruleIDs	List of flow matching rules
sourceAddress	IP from which the data was sent
sourcePort	Value of the Source Port header field in the packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
version	Version of the record schema

AccountMnmFlowDataAdaptiveGroupsFilter_InputObject

Field	Description

AccountMnmFlowDataAdaptiveGroupsOrderBy

Field	Description

AccountMnmFlowDataAdaptiveGroupsSum

Field	Description
bits	Sum of bits
packets	Sum of packets

AccountNelReportsAdaptiveGroups

Data to visualize network error logs

Field	Description
avg
count	The number of NEL Reports
dimensions	List of dimensions to group by

AccountNelReportsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountNelReportsAdaptiveGroupsDimensions

Field	Description
clientIPASN	Client ASN
clientIPASNDescription	Client ASN Description
clientIPCountry	Client Country
clientIPCountryCode	2 letter client country code using ISO 3166-1 alpha-2 syntax
clientIPVersion	IP Version the client used to connect
date	Request date from browser
datetime	Request datetime from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
lastKnownGoodColoCode	IATA airport code of colo the client connected to
phase	The phase of connection the error occurred in
protocol	HTTP Protocol used when the error occured
type	The type of error in the phase

AccountNelReportsAdaptiveGroupsFilter_InputObject

Field	Description

AccountNelReportsAdaptiveGroupsOrderBy

Field	Description

AccountPagesFunctionsInvocationsAdaptiveGroups

Pages Functions invocations with adaptive sampling

Field	Description
avg
dimensions	List of dimensions to group by
quantiles	Quantiles of a metric per dimension
sum	The sum of values for a metric per dimension

AccountPagesFunctionsInvocationsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountPagesFunctionsInvocationsAdaptiveGroupsDimensions

Field	Description
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of an minute
scriptName	The name of the script
status	Status of the worker invocation
usageModel	Usage model of the worker invocation

AccountPagesFunctionsInvocationsAdaptiveGroupsFilter_InputObject

Field	Description

AccountPagesFunctionsInvocationsAdaptiveGroupsOrderBy

Field	Description

AccountPagesFunctionsInvocationsAdaptiveGroupsQuantiles

Field	Description
cpuTimeP50	CPU time 50th percentile - microseconds
cpuTimeP75	CPU time 75th percentile - microseconds
cpuTimeP99	CPU time 99th percentile - microseconds
cpuTimeP999	CPU time 99.9th percentile - microseconds
durationP50	Duration 50th percentile - GB*s
durationP75	Duration 75th percentile - GB*s
durationP99	Duration 99th percentile - GB*s
durationP999	Duration 99.9th percentile - GB*s

AccountPagesFunctionsInvocationsAdaptiveGroupsSum

Field	Description
duration	Sum of Duration - GB*s
errors	Sum of Errors
requests	Sum of Requests
responseBodySize	Sum of Response Body Sizes
subrequests	Sum of Subrequests
wallTime	Sum of Wall Time

AccountQueueBacklogAdaptiveGroups

Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by

AccountQueueBacklogAdaptiveGroupsAvg

Field	Description
bytes	The average size of the backlog in bytes for sample interval
messages	The average number of messages in the backlog for sample interval
sampleInterval	The average value used for sample interval

AccountQueueBacklogAdaptiveGroupsDimensions

Field	Description
date	Message operation timestamp, truncated to start of a day
datetime	Message operation timestamp
datetimeHour	Message operation timestamp, truncated to start of an hour
datetimeMinute	Message operation timestamp, truncated to start of an minute
queueId	The ID of the Queue

AccountQueueBacklogAdaptiveGroupsFilter_InputObject

Field	Description

AccountQueueBacklogAdaptiveGroupsOrderBy

Field	Description

AccountQueueConsumerMetricsAdaptiveGroups

Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by

AccountQueueConsumerMetricsAdaptiveGroupsAvg

Field	Description
concurrency	The average concurrency of the queue
sampleInterval	The average value used for sample interval

AccountQueueConsumerMetricsAdaptiveGroupsDimensions

Field	Description
date	Consumer metric timestamp, truncated to start of a day
datetime	Consumer metric timestamp
datetimeHour	Consumer metric timestamp, truncated to start of an hour
datetimeMinute	Consumer metric timestamp, truncated to start of an minute
queueId	The ID of the Queue

AccountQueueConsumerMetricsAdaptiveGroupsFilter_InputObject

Field	Description

AccountQueueConsumerMetricsAdaptiveGroupsOrderBy

Field	Description

AccountQueueMessageOperationsAdaptiveGroups

Beta. Queue message operation data with adaptive sampling

Field	Description
avg	The average value for a metric per dimension
count	Number of Message Operations
dimensions	List of dimensions to group by
max	The max of values for a metric per dimension
sum	The sum of values for a metric per dimension

AccountQueueMessageOperationsAdaptiveGroupsAvg

Field	Description
lagTime	The average time in milliseconds between when the message was written to the queue and the current operation over the sample interval. Will always be 0 for WriteMessage operations.
retryCount	The average number of retries per message operation. A retry occurs after an unsucessful delivery, if the queue is configured to retry failed attempts. Only applicable to ReadMessage and DeleteMessage operations. Will always be 0 for WriteMessage operations.
sampleInterval	The average value used for sample interval

AccountQueueMessageOperationsAdaptiveGroupsDimensions

Field	Description
actionType	The type of the Queue message operation
date	Message operation timestamp, truncated to start of a day
datetime	Message operation timestamp
datetimeHour	Message operation timestamp, truncated to start of an hour
datetimeMinute	Message operation timestamp, truncated to start of an minute
outcome	The outcome of the operation. Only applicable to DeleteMessage action types. Can be 'success', 'dlq', or 'fail'. Always 'none' for other operations.
queueId	The ID of the Queue

AccountQueueMessageOperationsAdaptiveGroupsFilter_InputObject

Field	Description

AccountQueueMessageOperationsAdaptiveGroupsMax

Field	Description
messageSize	Max Message Size

AccountQueueMessageOperationsAdaptiveGroupsOrderBy

Field	Description

AccountQueueMessageOperationsAdaptiveGroupsSum

Field	Description
billableOperations	Number of Billable Operations (some message operations count as multiple billable operations)
bytes	Total size (in bytes) of message operations

AccountR2OperationsAdaptiveGroups

Beta. R2 operations with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountR2OperationsAdaptiveGroupsDimensions

Field	Description
actionStatus	Status of the R2 operation
actionType	The name of the R2 operation
bucketName	The name of the R2 bucket, if applicable to this request
date	Request timestamp, truncated to start of a day
datetime	Request timestamp
datetimeHour	Request timestamp, truncated to start of an hour
datetimeMinute	Request timestamp, truncated to start of an minute
objectName	The name of the R2 object, if applicable to this request
responseStatusCode	HTTP status code returned by R2

AccountR2OperationsAdaptiveGroupsFilter_InputObject

Field	Description

AccountR2OperationsAdaptiveGroupsOrderBy

Field	Description

AccountR2OperationsAdaptiveGroupsSum

Field	Description
requests	Sum of Requests
responseObjectSize	Sum of Response Object Sizes

AccountR2StorageAdaptiveGroups

Beta. R2 storage with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
max	The max of values for a metric per dimension

AccountR2StorageAdaptiveGroupsDimensions

Field	Description
bucketName	The name of the R2 bucket, if applicable to this request
date	Storage sample timestamp, truncated to start of a day
datetime	Storage sample timestamp
datetimeHour	Storage sample timestamp, truncated to start of an hour
datetimeMinute	Storage sample timestamp, truncated to start of an minute

AccountR2StorageAdaptiveGroupsFilter_InputObject

Field	Description

AccountR2StorageAdaptiveGroupsMax

Field	Description
metadataSize	Max of metadata size
objectCount	Max of object count
payloadSize	Max of payload size
uploadCount	Max of upload count

AccountR2StorageAdaptiveGroupsOrderBy

Field	Description

AccountRumPageloadEventsAdaptiveGroups

Beta. Aggregated RUM pageload event metrics with adaptive sampling

Field	Description
avg
count	The number of pages viewed by end-users
dimensions	List of dimensions to group by
sum

AccountRumPageloadEventsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountRumPageloadEventsAdaptiveGroupsDimensions

Field	Description
bot	Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName	Client country ISO 3166 alpha2 code
customTagInternalSxg	Signed Exchange enabled status
date	Request date from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
deviceType	Device type used for view the page
refererHost	Host of the HTTP request referer
refererPath	Path of the HTTP request referer
refererScheme	Scheme of the HTTP request referer (http or https)
requestHost	HTTP Host of the web page URL
requestPath	Path of the web page URL
requestScheme	Scheme of the web page URL (http or https)
siteTag	The key value to identify a site
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent

AccountRumPageloadEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountRumPageloadEventsAdaptiveGroupsOrderBy

Field	Description

AccountRumPageloadEventsAdaptiveGroupsSum

Field	Description
visits	The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountRumPerformanceEventsAdaptiveGroups

Beta. Aggregated RUM performance event metrics with adaptive sampling

Field	Description
avg
count	The number of pages viewed by end-users
dimensions	List of dimensions to group by
quantiles
sum

AccountRumPerformanceEventsAdaptiveGroupsAvg

Field	Description
connectionTime	Connection time
dnsTime	Domain lookup time
firstContentfulPaint	The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstPaint	The time when the first pixel is painted onto the screen (i.e. background of the page)
loadEventTime	The time taken for the load event
pageLoadTime	The time to download and display the entire content of a web page in the browser window
pageRenderTime	The time to download and display the entire content of a web page in the browser window
requestTime	The time between initiating the request and receiving the first byte of the response
responseTime	The time between receiving the first byte and the last byte of the response
sampleInterval	Average sample interval

AccountRumPerformanceEventsAdaptiveGroupsDimensions

Field	Description
bot	Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName	Client country ISO 3166 alpha2 code
customTagInternalSxg	Signed Exchange enabled status
date	Request date from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
deviceType	Device type used for view the page
refererHost	Host of the HTTP request referer
refererPath	Path of the HTTP request referer
refererScheme	Scheme of the HTTP request referer (http or https)
requestHost	HTTP Host of the web page URL
requestPath	Path of the web page URL
requestScheme	Scheme of the web page URL (http or https)
siteTag	The key value to identify a site
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent

AccountRumPerformanceEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountRumPerformanceEventsAdaptiveGroupsOrderBy

Field	Description

AccountRumPerformanceEventsAdaptiveGroupsQuantiles

Field	Description
connectionTimeP50	Connection time
connectionTimeP75	Connection time
connectionTimeP90	Connection time
connectionTimeP99	Connection time
dnsTimeP50	Domain lookup time
dnsTimeP75	Domain lookup time
dnsTimeP90	Domain lookup time
dnsTimeP99	Domain lookup time
firstContentfulPaintP50	The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP75	The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP90	The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstContentfulPaintP99	The time when the first content piece from the DOM is painted (i.e. some text or an image)
firstPaintP50	The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP75	The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP90	The time when the first pixel is painted onto the screen (i.e. background of the page)
firstPaintP99	The time when the first pixel is painted onto the screen (i.e. background of the page)
loadEventTimeP50	The time taken for the load event
loadEventTimeP75	The time taken for the load event
loadEventTimeP90	The time taken for the load event
loadEventTimeP99	The time taken for the load event
pageLoadTimeP50	The time to download and display the entire content of a web page in the browser window
pageLoadTimeP75	The time to download and display the entire content of a web page in the browser window
pageLoadTimeP90	The time to download and display the entire content of a web page in the browser window
pageLoadTimeP99	The time to download and display the entire content of a web page in the browser window
pageRenderTimeP50	The time to download and display the entire content of a web page in the browser window
pageRenderTimeP75	The time to download and display the entire content of a web page in the browser window
pageRenderTimeP90	The time to download and display the entire content of a web page in the browser window
pageRenderTimeP99	The time to download and display the entire content of a web page in the browser window
requestTimeP50	The time between initiating the request and receiving the first byte of the response
requestTimeP75	The time between initiating the request and receiving the first byte of the response
requestTimeP90	The time between initiating the request and receiving the first byte of the response
requestTimeP99	The time between initiating the request and receiving the first byte of the response
responseTimeP50	The time between receiving the first byte and the last byte of the response
responseTimeP75	The time between receiving the first byte and the last byte of the response
responseTimeP90	The time between receiving the first byte and the last byte of the response
responseTimeP99	The time between receiving the first byte and the last byte of the response

AccountRumPerformanceEventsAdaptiveGroupsSum

Field	Description
visits	The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountRumWebVitalsEventsAdaptive

Beta. RUM Web Vitals event metrics with adaptive sampling

Field	Description
bot	Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName	Client country ISO 3166 alpha2 code
cumulativeLayoutShift	Cumulative Layout Shift (Core Web Vitals) (-1 indicates N/A)
cumulativeLayoutShiftCurrentRect	Layout values of the rectangular area after the changes
cumulativeLayoutShiftElement	DOM selector name of the largest layout shift
cumulativeLayoutShiftPath	Observed path of the Cumulative Layout Shift (Core Web Vitals)
cumulativeLayoutShiftPreviousRect	Layout values of the rectangular area before the changes
customTagInternalSxg	Signed Exchange enabled status
date	Request date from browser
datetime	Request datetime from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
deviceType	Device type used for view the page
refererHost	Host of the HTTP request referer
refererPath	Path of the HTTP request referer
refererScheme	Scheme of the HTTP request referer (http or https)
requestHost	HTTP Host of the web page URL
requestPath	Path of the web page URL
requestScheme	Scheme of the web page URL (http or https)
sampleInterval	ABR sample interval
siteTag	The key value to identify a site
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent

AccountRumWebVitalsEventsAdaptiveFilter_InputObject

Field	Description

AccountRumWebVitalsEventsAdaptiveGroups

Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling

Field	Description
avg
count	The number of pages viewed by end-users
dimensions	List of dimensions to group by
quantiles
sum

AccountRumWebVitalsEventsAdaptiveGroupsAvg

Field	Description
cumulativeLayoutShift	Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
firstContentfulPaint	First Contentful Paint in microseconds (negative value indicates N/A)
firstInputDelay	First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
interactionToNextPaint	Interaction to Next Paint in microseconds (negative value indicates N/A)
largestContentfulPaint	Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
lcpElementRenderDelay	Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelay	Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadTime	Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
sampleInterval	Average sample interval
timeToFirstByte	Time to First Byte in microseconds (negative value indicates N/A)

AccountRumWebVitalsEventsAdaptiveGroupsDimensions

Field	Description
bot	Indicates if the request is likely from a bot (non-human traffic). Returns 1 if from a bot, 0 otherwise.
countryName	Client country ISO 3166 alpha2 code
cumulativeLayoutShiftElement	DOM selector name of the largest layout shift
cumulativeLayoutShiftPath	Observed path of the Cumulative Layout Shift (Core Web Vitals)
customTagInternalSxg	Signed Exchange enabled status
date	Request date from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
deviceType	Device type used for view the page
firstInputDelayElement	DOM selector name of the input delay
firstInputDelayName	Action name of the input delay
firstInputDelayPath	Observed path of the First Input Delay (Core Web Vitals)
largestContentfulPaintElement	DOM selector name of the largest object
largestContentfulPaintObjectHost	Host of the largest object
largestContentfulPaintObjectPath	Path of the largest object
largestContentfulPaintObjectScheme	Scheme of the largest object (http or https)
largestContentfulPaintPath	Observed path of the Largest Contentful Paint (Core Web Vitals)
lcpFetchPriority	Fetch priority of the LCP element.
lcpInitiatorType	Initiator type of the LCP element.
refererHost	Host of the HTTP request referer
refererPath	Path of the HTTP request referer
refererScheme	Scheme of the HTTP request referer (http or https)
requestHost	HTTP Host of the web page URL
requestPath	Path of the web page URL
requestScheme	Scheme of the web page URL (http or https)
siteTag	The key value to identify a site
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent

AccountRumWebVitalsEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountRumWebVitalsEventsAdaptiveGroupsOrderBy

Field	Description

AccountRumWebVitalsEventsAdaptiveGroupsQuantiles

Field	Description
cumulativeLayoutShiftP50	Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP75	Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP90	Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
cumulativeLayoutShiftP99	Cumulative Layout Shift (Core Web Vitals) (negative value indicates N/A)
firstContentfulPaintP50	First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP75	First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP90	First Contentful Paint in microseconds (negative value indicates N/A)
firstContentfulPaintP99	First Contentful Paint in microseconds (negative value indicates N/A)
firstInputDelayP50	First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP75	First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP90	First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
firstInputDelayP99	First Input Delay (Core Web Vitals) in microseconds (negative value indicates N/A)
interactionToNextPaintP50	Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP75	Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP90	Interaction to Next Paint in microseconds (negative value indicates N/A)
interactionToNextPaintP99	Interaction to Next Paint in microseconds (negative value indicates N/A)
largestContentfulPaintP50	Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP75	Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP90	Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
largestContentfulPaintP99	Largest Contentful Paint (Core Web Vitals) in microseconds (negative value indicates N/A)
lcpElementRenderDelayP50	Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP75	Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP90	Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpElementRenderDelayP99	Largest Contentful Paint Attributions Element Render Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP50	Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP75	Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP90	Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadDelayP99	Largest Contentful Paint Attributions Resource Load Delay in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP50	Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP75	Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP90	Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
lcpResourceLoadTimeP99	Largest Contentful Paint Attributions Resource Load Time in microseconds (negative value indicates N/A)
timeToFirstByteP50	Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP75	Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP90	Time to First Byte in microseconds (negative value indicates N/A)
timeToFirstByteP99	Time to First Byte in microseconds (negative value indicates N/A)

AccountRumWebVitalsEventsAdaptiveGroupsSum

Field	Description
clsGood	Cumulative Layout Shift (Core Web Vitals), count of Good occurrences (under 0.1)
clsNeedsImprovement	Cumulative Layout Shift (Core Web Vitals), count of Needs Improvement occurrences (between 0.1 and 0.25)
clsPoor	Cumulative Layout Shift (Core Web Vitals), count of Poor occurrences (over 0.25)
clsTotal	Cumulative Layout Shift (Core Web Vitals), total count
fcpGood	First Contentful Paint, count of Good occurrences (under 1.8 s)
fcpNeedsImprovement	First Contentful Paint, count of Needs Improvement occurrences (between 1.8 s and 3 s)
fcpPoor	First Contentful Paint, count of Poor occurrences (over 3 s)
fcpTotal	First Contentful Paint, total count
fidGood	First Input Delay (Core Web Vitals), count of Good occurrences (under 100 ms)
fidNeedsImprovement	First Input Delay (Core Web Vitals), count of Needs Improvement occurrences (between 100 ms and 300ms)
fidPoor	First Input Delay (Core Web Vitals), count of Poor occurrences (over 300 ms)
fidTotal	First Input Delay (Core Web Vitals), total count
inpGood	Interaction to Next Paint, count of Good occurrences (under 200 ms)
inpNeedsImprovement	Interaction to Next Paint, count of Needs Improvement occurrences (between 200 ms and 500ms)
inpPoor	Interaction to Next Paint, count of Poor occurrences (over 500 ms)
inpTotal	Interaction to Next Paint, total count
lcpGood	Largest Contentful Paint (Core Web Vitals), count of Good occurrences (under 2.5 sec)
lcpNeedsImprovement	Largest Contentful Paint (Core Web Vitals), count of Needs Improvement occurrences (between 2.5 sec and 4.0 sec)
lcpPoor	Largest Contentful Paint (Core Web Vitals), count of Poor occurrences (over 4.0 sec)
lcpTotal	Largest Contentful Paint (Core Web Vitals), total count
ttfbGood	Time to First Byte, count of Good occurrences (under 800 ms)
ttfbNeedsImprovement	Time to First Byte, count of Needs Improvement occurrences (between 800 ms and 1800ms)
ttfbPoor	Time to First Byte, count of Poor occurrences (over 500 ms)
ttfbTotal	Time to First Byte, total count
visits	The number of pages viewed by end-users that were initiated from a different website (i.e. where the Document.referrer does not match the hostname)

AccountRumWebVitalsEventsAdaptiveOrderBy

Field	Description

AccountSettings

Access and limitations for an account

Field	Description
MagicWANConnectorMetricsAdaptiveGroups
accessLoginRequestsAdaptiveGroups
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups
aiGatewayCacheAdaptiveGroups
aiGatewayErrorsAdaptiveGroups
aiGatewayRequestsAdaptiveGroups
aiInferenceAdaptive
aiInferenceAdaptiveGroups
cdnNetworkAnalyticsAdaptiveGroups
d1AnalyticsAdaptiveGroups
dosdAttackAnalyticsGroups
dosdNetworkAnalyticsAdaptiveGroups
durableObjectsInvocationsAdaptiveGroups
durableObjectsPeriodicGroups
durableObjectsStorageGroups
durableObjectsSubrequestsAdaptiveGroups
fbmAttackAnalyticsGroups
firewallEventsAdaptive
firewallEventsAdaptiveGroups
flowtrackdNetworkAnalyticsAdaptiveGroups
gatewayL4DownstreamSessionsAdaptiveGroups
gatewayL4SessionsAdaptiveGroups
gatewayL4UpstreamSessionsAdaptiveGroups
gatewayL7RequestsAdaptiveGroups
gatewayResolverByCategoryAdaptiveGroups
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups
gatewayResolverQueriesAdaptiveGroups
httpRequests1dGroups
httpRequests1hGroups
httpRequests1mGroups
httpRequestsAdaptive
httpRequestsAdaptiveGroups
httpRequestsOverviewAdaptiveGroups
hyperdriveQueriesAdaptiveGroups
imagesRequestsAdaptiveGroups
imagesUniqueTransformations
logpushHealthAdaptiveGroups
magicFirewallNetworkAnalyticsAdaptiveGroups
magicFirewallSamplesAdaptiveGroups
magicIDPSNetworkAnalyticsAdaptiveGroups
magicTransitNetworkAnalyticsAdaptiveGroups
magicTransitTunnelHealthChecksAdaptiveGroups
magicTransitTunnelTrafficAdaptiveGroups
mnmFlowDataAdaptiveGroups
nelReportsAdaptiveGroups
pagesFunctionsInvocationsAdaptiveGroups
queueBacklogAdaptiveGroups
queueConsumerMetricsAdaptiveGroups
queueMessageOperationsAdaptiveGroups
r2OperationsAdaptiveGroups
r2StorageAdaptiveGroups
rumPageloadEventsAdaptiveGroups
rumPerformanceEventsAdaptiveGroups
rumWebVitalsEventsAdaptive
rumWebVitalsEventsAdaptiveGroups
sinkholeRequestLogsAdaptive
sinkholeRequestLogsAdaptiveGroups
spectrumNetworkAnalyticsAdaptiveGroups
storageTraces
streamMinutesViewedAdaptiveGroups
turnstileAdaptiveGroups
videoBufferEventsAdaptiveGroups
videoPlaybackEventsAdaptiveGroups
videoQualityEventsAdaptiveGroups
warpDeviceAdaptiveGroups
workerPlacementAdaptiveGroups
workersAnalyticsEngineAdaptiveGroups
workersInvocationsAdaptive
workersInvocationsScheduled
workersOverviewDataAdaptiveGroups
workersOverviewRequestsAdaptiveGroups
workersSubrequestsAdaptiveGroups
zarazTriggersAdaptiveGroups
zeroTrustPrivateNetworkDiscoveryGroups

AccountSinkholeRequestLogsAdaptive

Sinkhole Request Logs

Field	Description
body	The request body
datetime	The date and time the event was recorded
destinationAddress	The destination IP address of the request
headers	The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated.
host	The host the request was sent to
method	The request method
r2Path	The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes.
referrer	The referrer of the request
sampleInterval	ABR sample interval
sinkholeId	The ID of the sinkhole that logged the request
sourceAddress	The sender's IP address
uri	The request uri
url	The request url
userAgent	The request user agent

AccountSinkholeRequestLogsAdaptiveFilter_InputObject

Field	Description

AccountSinkholeRequestLogsAdaptiveGroups

Sinkhole Request Logs

Field	Description
count	Number of requests logged (approximation when sampleInterval > 1)
dimensions	List of dimensions to group by

AccountSinkholeRequestLogsAdaptiveGroupsDimensions

Field	Description
body	The request body
datetime	The date and time the event was recorded
destinationAddress	The destination IP address of the request
headers	The request headers. If a header has multiple values, the values are comma separated. Each header is newline separated.
host	The host the request was sent to
method	The request method
r2Path	The path to the object within the R2 bucket linked to this sinkhole that stores overflow body and header data. Blank if neither headers nor body was larger than 256 bytes.
referrer	The referrer of the request
sinkholeId	The ID of the sinkhole that logged the request
sourceAddress	The sender's IP address
uri	The request uri
url	The request url
userAgent	The request user agent

AccountSinkholeRequestLogsAdaptiveGroupsFilter_InputObject

Field	Description

AccountSinkholeRequestLogsAdaptiveGroupsOrderBy

Field	Description

AccountSinkholeRequestLogsAdaptiveOrderBy

Field	Description

AccountSpectrumNetworkAnalyticsAdaptiveGroups

Network analytics data for Spectrum traffic

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountSpectrumNetworkAnalyticsAdaptiveGroupsAvg

Field	Description
bitRate	Sum of bits received, divided by 1 second, providing a per-second bit rate when grouped by datetime
bitRateDay	Sum of bits received, divided by 86400 seconds, providing a per-second bit rate when grouped by date
bitRateFifteenMinutes	Sum of bits received, divided by 900 seconds, providing a per-second bit rate when grouped by datetimeFifteenMinutes
bitRateFiveMinutes	Sum of bits received, divided by 300 seconds, providing a per-second bit rate when grouped by datetimeFiveMinutes
bitRateHour	Sum of bits received, divided by 3600 seconds, providing a per-second bit rate when grouped by datetimeHour
bitRateMinute	Sum of bits received, divided by 60 seconds, providing a per-second bit rate when grouped by datetimeMinute
bitRateTenSeconds	Sum of bits received, divided by 10 seconds, providing a per-second bit rate when grouped by datetimeTenSeconds
packetRate	Sum of packets received, divided by 1 second, providing a per-second packet rate when grouped by datetime
packetRateDay	Sum of packets received, divided by 86400 seconds, providing a per-second packet rate when grouped by date
packetRateFifteenMinutes	Sum of packets received, divided by 900 seconds, providing a per-second packet rate when grouped by datetimeFifteenMinutes
packetRateFiveMinutes	Sum of packets received, divided by 300 seconds, providing a per-second packet rate when grouped by datetimeFiveMinutes
packetRateHour	Sum of packets received, divided by 3600 seconds, providing a per-second packet rate when grouped by datetimeHour
packetRateMinute	Sum of packets received, divided by 60 seconds, providing a per-second packet rate when grouped by datetimeMinute
packetRateTenSeconds	Sum of packets received, divided by 10 seconds, providing a per-second packet rate when grouped by datetimeTenSeconds

AccountSpectrumNetworkAnalyticsAdaptiveGroupsDimensions

Field	Description
applicationTag	Application tag associated with the packet
coloCity	City where the Cloudflare datacenter that received the packet is located
coloCode	Cloudflare datacenter that received the packet (nearest IATA airport code)
coloCountry	Country where the Cloudflare datacenter that received the packet is located (ISO 3166-1 alpha-2)
coloGeohash	Latitude and longitude where the Cloudflare datacenter that received the packet is located (Geohash encoding)
coloName	Cloudflare datacenter that received the packet (unique site identifier)
date	Date that the packet was received
datetime	Date and time that the packet was received
datetimeFifteenMinutes	Date and time that the packet was received, rounded to the start of the nearest fifteen minutes
datetimeFiveMinutes	Date and time that the packet was received, rounded to the start of the nearest five minutes
datetimeHour	Date and time that the packet was received, rounded to the start of the nearest hour
datetimeMinute	Date and time that the packet was received, rounded to the start of the nearest minute
datetimeTenSeconds	Date and time that the packet was received, rounded to the start of the nearest ten seconds
destinationAsn	ASN associated with the destination IP of the packet, or 0 if there was no mapping available
destinationAsnName	Name of ASN associated with the destination IP of the packet, if available
destinationCountry	Country where the destination IP of the packet is located (ISO 3166-1 alpha-2)
destinationGeohash	Latitude and longitude where the destination IP of the packet is located (Geohash encoding)
destinationPort	Value of the Destination Port header field in the TCP or UDP packet
direction	Direction of the packet relative to the customer network (possible values: inbound, outbound, lateral)
ethertype	Value of the Ethertype header field in the Ethernet packet (2048 for IPv4; 34525 for IPv6)
greChecksum	Value of the Checkusm header field in the GRE packet
greEthertype	Value of the Ethertype header field in the GRE packet
greHeaderLength	Length of the GRE packet header, in bytes
greKey	Value of the Key header field in the GRE packet
greSequenceNumber	Value of the Sequence Number header field in the GRE packet
greVersion	Value of the Version header field in the GRE packet
icmpChecksum	Value of the Checkusm header field in the ICMP packet
icmpCode	Value of the Code header field in the ICMP packet
icmpType	Value of the Type header field in the ICMP packet
ipDestinationAddress	Value of the Destination Address header field in the IPv4 or IPv6 packet
ipDestinationSubnet	Computed subnet of the Destination Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipFragmentOffset	Value of the Fragment Offset header field in the IPv4 or IPv6 packet
ipHeaderLength	Length of the IPv4 or IPv6 packet header, in bytes
ipMoreFragments	Value of the More Fragments header field in the IPv4 or IPv6 packet
ipProtocol	Value of the Protocol header field in the IPv4 or IPv6 packet
ipProtocolName	Name of the protocol specified by the Protocol header field in the IPv4 or IPv6 packet
ipSourceAddress	Value of the Source Address header field in the IPv4 or IPv6 packet
ipSourceSubnet	Computed subnet of the Source Address header field in the IPv4 or IPv6 packet (/24 for IPv4; /64 for IPv6)
ipTotalLength	Total length of the IPv4 or IPv6 packet, in bytes
ipTotalLengthBuckets	Total length of the IPv4 or IPv6 packet, in bytes, with the last two digits truncated
ipTtl	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet
ipTtlBuckets	Value of the TTL header field in the IPv4 packet or the Hop Limit header field in the IPv6 packet, with the last digit truncated
ipv4Checksum	Value of the Checksum header field in the IPv4 packet
ipv4DontFragment	Value of the Don't Fragment header field in the IPv4 packet
ipv4Dscp	Value of the Differentiated Services Code Point header field in the IPv4 packet
ipv4Ecn	Value of the Explicit Congestion Notification header field in the IPv4 packet
ipv4Identification	Value of the Identification header field in the IPv4 packet
ipv4Options	List of Options numbers included in the IPv4 packet header
ipv6Dscp	Value of the Differentiated Services Code Point header field in the IPv6 packet
ipv6Ecn	Value of the Explicit Congestion Notification header field in the IPv6 packet
ipv6ExtensionHeaders	List of Extension Header numbers included in the IPv6 packet header
ipv6FlowLabel	Value of the Flow Label header field in the IPv6 packet
ipv6Identification	Value of the Identification extension header field in the IPv6 packet
leaseTag	IP lease tag associated with the packet
mitigationSystem	Which system dropped the packet (possible values: dosd, flowtrackd, magic-firewall)
outcome	The action that was taken on the packet (possible values: pass, drop)
prefixTag	IP prefix tag associated with the packet
sampleInterval	ABR sample interval
sourceAsn	ASN associated with the source IP of the packet, or 0 if there was no mapping available
sourceAsnName	Name of ASN associated with the source IP of the packet, if available
sourceCountry	Country where the source IP of the packet is located (ISO 3166-1 alpha-2)
sourceGeohash	Latitude and longitude where the source IP of the packet is located (Geohash encoding)
sourcePort	Value of the Source Port header field in the TCP or UDP packet
tcpAcknowledgementNumber	Value of the Acknowledgement Number header field in the TCP packet
tcpChecksum	Value of the Checkusm header field in the TCP packet
tcpDataOffset	Value of the Data Offset header field in the TCP packet
tcpFlags	Value of the Flags header field in the TCP packet
tcpFlagsString	Human-readable string representation of the Flags header field in the TCP packet
tcpMss	Value of the MSS option header field in the TCP packet
tcpOptions	List of Options numbers included in the TCP packet header
tcpSackBlocks	Value of the SACK Blocks option header field in the TCP packet
tcpSackPermitted	Value of the SACK Permitted option header field in the TCP packet
tcpSequenceNumber	Value of the Sequence Number header field in the TCP packet
tcpTimestampEcr	Value of the Timestamp Echo Reply option header field in the TCP packet
tcpTimestampValue	Value of the Timestamp option header field in the TCP packet
tcpUrgentPointer	Value of the Urgent Pointer header field in the TCP packet
tcpWindowScale	Value of the Window Scale option header field in the TCP packet
tcpWindowSize	Value of the Window Size header field in the TCP packet
udpChecksum	Value of the Checkusm header field in the UDP packet
udpPayloadLength	Value of the Payload Length header field in the UDP packet

AccountSpectrumNetworkAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

AccountSpectrumNetworkAnalyticsAdaptiveGroupsOrderBy

Field	Description

AccountSpectrumNetworkAnalyticsAdaptiveGroupsSum

Field	Description
bits	Sum of bits received
packets	Sum of packets received

AccountStorageTraces

Storage Tracing Information

Field	Description
containerId	The container that this resource is stored under.
datetime	Storage trace timestamp
resourceId	The identifier to access this resource in the container.
serviceId	The identifier of the storage service that houses the resourse.
traceId	The ID that this trace entry is under.
userAccountId	The AccountID of the user who owns the resource.

AccountStorageTracesFilter_InputObject

Field	Description

AccountStorageTracesOrderBy

Field	Description

AccountStreamMinutesViewedAdaptiveGroups

A high-level summary of Cloudflare Stream minutes viewed.

Field	Description
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountStreamMinutesViewedAdaptiveGroupsDimensions

Field	Description
clientCountryName	ISO 3166 alpha2 country code from the client
creator	Customer-provided creator ID of a video
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
mediaType	The source of the minutes viewed
uid	Unique ID of a video

AccountStreamMinutesViewedAdaptiveGroupsFilter_InputObject

Field	Description

AccountStreamMinutesViewedAdaptiveGroupsOrderBy

Field	Description

AccountStreamMinutesViewedAdaptiveGroupsSum

Field	Description
minutesViewed

AccountTurnstileAdaptiveGroups

Beta. Cloudflare Turnstile aggregated events with adaptive sampling

Field	Description
avg
count	Number of Cloudflare Turnstile events processed
dimensions	List of dimensions to group by

AccountTurnstileAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountTurnstileAdaptiveGroupsDimensions

Field	Description
action	The action tag of the challenge event
date	The date the challenge event was emitted
datetime	The date and time the challenge event was emitted
datetimeDay	The date and time the challenge event was emitted truncated to the day
datetimeFifteenMinutes	The date and time the challenge event was emitted truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the challenge event was emitted truncated to a multiple of 5 minutes
datetimeHalfOfHour	The date and time the challenge event was emitted truncated to a multiple of 30 minutes
datetimeHour	The date and time the challenge event was emitted truncated to the hour
datetimeMinute	The date and time the challenge event was emitted truncated to the minute
eventType	The type of the Cloudflare Turnstile event
siteKey	The sitekey of the widget associated with the event

AccountTurnstileAdaptiveGroupsFilter_InputObject

Field	Description

AccountTurnstileAdaptiveGroupsOrderBy

Field	Description

AccountVideoBufferEventsAdaptiveGroups

Beta. Aggregated video streaming buffer event metrics with adaptive sampling

Field	Description
avg
count	Total number of buffer events
dimensions	List of dimensions to group by

AccountVideoBufferEventsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountVideoBufferEventsAdaptiveGroupsDimensions

Field	Description
clientCountryName	ISO 3166 alpha2 country code from the client
date	Request date of the event
datetime	Request datetime of the event
datetimeFifteenMinutes	Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour	Request datetime of the event, truncated to the hour
datetimeMinute	Request datetime of the event, truncated to the minute
deviceBrowser	Browser of the device used in playback
deviceOs	OS of the device used in playback
deviceType	Device type used in playback
uid	unique id for a video

AccountVideoBufferEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountVideoBufferEventsAdaptiveGroupsOrderBy

Field	Description

AccountVideoPlaybackEventsAdaptiveGroups

Beta. Aggregated video streaming playback event metrics with adaptive sampling

Field	Description
avg
count	Total number of playback starts
dimensions	List of dimensions to group by
sum

AccountVideoPlaybackEventsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountVideoPlaybackEventsAdaptiveGroupsDimensions

Field	Description
clientCountryName	ISO 3166 alpha2 country code from the client
date	Request date of the event
datetime	Request datetime of the event
datetimeFifteenMinutes	Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour	Request datetime of the event, truncated to the hour
datetimeMinute	Request datetime of the event, truncated to the minute
deviceBrowser	Browser of the device used in playback
deviceOs	OS of the device used in playback
deviceType	Device type used in playback
uid	unique id for a video

AccountVideoPlaybackEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountVideoPlaybackEventsAdaptiveGroupsOrderBy

Field	Description

AccountVideoPlaybackEventsAdaptiveGroupsSum

Field	Description
timeViewedMinutes	Total time viewed in minutes

AccountVideoQualityEventsAdaptiveGroups

Beta. Aggregated video streaming quality change event metrics with adaptive sampling

Field	Description
avg
count	Total number of quality change events
dimensions	List of dimensions to group by

AccountVideoQualityEventsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

AccountVideoQualityEventsAdaptiveGroupsDimensions

Field	Description
clientCountryName	ISO 3166 alpha2 country code from the client
date	Request date of the event
datetime	Request datetime of the event
datetimeFifteenMinutes	Request datetime of the event, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime of the event, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime of the event, truncated to multiple of 30 minutes
datetimeHour	Request datetime of the event, truncated to the hour
datetimeMinute	Request datetime of the event, truncated to the minute
deviceBrowser	Browser of the device used in playback
deviceOs	OS of the device used in playback
deviceType	Device type used in playback
qualityResolution	Video playback vertical resolution
uid	unique id for a video

AccountVideoQualityEventsAdaptiveGroupsFilter_InputObject

Field	Description

AccountVideoQualityEventsAdaptiveGroupsOrderBy

Field	Description

AccountWarpDeviceAdaptiveGroups

Beta. Warp device health events with adaptive sampling

Field	Description
count	Number of device health events, which usually occur at 2m intervals per device
dimensions	List of dimensions to group by
uniq

AccountWarpDeviceAdaptiveGroupsDimensions

Field	Description
clientPlatform	Device's OS
clientVersion	Device's Warp version
colo	Device's connected colo
date	The date of the device log
datetime	The date and time of the device log
datetimeFiveMinute	The date and time of the device log truncated to every five minutes
datetimeHour	The date and time of the device log truncated to the hour
datetimeTenMinute	The date and time of the device log truncated to every ten minutes
deviceId	Device ID
mode	Device's Warp mode
status	Device connection status

AccountWarpDeviceAdaptiveGroupsFilter_InputObject

Field	Description

AccountWarpDeviceAdaptiveGroupsOrderBy

Field	Description

AccountWarpDeviceAdaptiveGroupsUniq

Field	Description
deviceIds	Approximate count of unique deviceIds

AccountWorkerPlacementAdaptiveGroups

Worker placement metrics

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountWorkerPlacementAdaptiveGroupsDimensions

Field	Description
date	Request timestamp, truncated to start of a day
datetime	Request timestamp
datetimeHour	Request timestamp, truncated to start of an hour
datetimeMinute	Request timestamp, truncated to start of an minute
httpStatus	Response status of worker
isSample	1 if the request was sampled to bypass Smart Placement, 0 otherwise
placementUsed	1 if the request was processed using Smart Placement, 0 if it was processed in default mode
requestDurationBucketMin	Bucket of request duration rounded down to nearest 10*2^n
requestDurationBucketMin100ms	Bucket of request duration rounded down to nearest 100ms
scriptName	The script name
scriptTag	The unique tag of the script

AccountWorkerPlacementAdaptiveGroupsFilter_InputObject

Field	Description

AccountWorkerPlacementAdaptiveGroupsOrderBy

Field	Description

AccountWorkerPlacementAdaptiveGroupsSum

Field	Description
requestDuration	Sum of duration ms of requests measured at the data centers that receive the requests
requests	Total number of requests

AccountWorkersAnalyticsEngineAdaptiveGroups

Beta. Custom Events with adaptive sampling

Field	Description
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by

AccountWorkersAnalyticsEngineAdaptiveGroupsDimensions

Field	Description
dataset	The dataset name
date	The date the event occurred
datetime	The date and time the event occurred
datetimeFifteenMinutes	The date and time the event occurred truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred truncated to the start of an hour
datetimeMinute	The date and time the event occurred truncated to the start of a minute

AccountWorkersAnalyticsEngineAdaptiveGroupsFilter_InputObject

Field	Description

AccountWorkersAnalyticsEngineAdaptiveGroupsOrderBy

Field	Description

AccountWorkersInvocationsAdaptive

Beta. Workers invocations with adaptive sampling

Field	Description
avg	The average value used for sample interval
dimensions	List of dimensions to group by
max	The max value for a metric
min	The min value for a metric
quantiles	Quantiles of a metric per dimension
sum	The sum of values for a metric per dimension

AccountWorkersInvocationsAdaptiveAvg

Field	Description
sampleInterval

AccountWorkersInvocationsAdaptiveDimensions

Field	Description
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of an minute
dispatchNamespaceName	The name of the script's dispatch namespace
environmentName	The name of the script environment
scriptName	The name of the script
scriptTag	The unique tag of the script
status	Status of the worker invocation
usageModel	Usage model of the worker invocation

AccountWorkersInvocationsAdaptiveFilter_InputObject

Field	Description

AccountWorkersInvocationsAdaptiveMax

Field	Description
cpuTime	Maximum CPU time for one request - microseconds
duration	Maximum duration of one request - GB*s
responseBodySize	Maximum response body size for one request - bytes
wallTime	Maximum wall time for one request - microseconds

AccountWorkersInvocationsAdaptiveMin

Field	Description
cpuTime	Minimum CPU time for one request - microseconds
duration	Minimum duration of one request - GB*s
responseBodySize	Minimum response body size for one request - bytes
wallTime	Minimum wall time for one request - microseconds

AccountWorkersInvocationsAdaptiveOrderBy

Field	Description

AccountWorkersInvocationsAdaptiveQuantiles

Field	Description
cpuTimeP25	CPU time 25th percentile - microseconds
cpuTimeP50	CPU time 50th percentile - microseconds
cpuTimeP75	CPU time 75th percentile - microseconds
cpuTimeP90	CPU time 90th percentile - microseconds
cpuTimeP99	CPU time 99th percentile - microseconds
cpuTimeP999	CPU time 99.9th percentile - microseconds
durationP25	Duration 25th percentile - GB*s
durationP50	Duration 50th percentile - GB*s
durationP75	Duration 75th percentile - GB*s
durationP90	Duration 90th percentile - GB*s
durationP99	Duration 99th percentile - GB*s
durationP999	Duration 99.9th percentile - GB*s
responseBodySizeP25	Response body size 25th percentile - bytes
responseBodySizeP50	Response body size 50th percentile - bytes
responseBodySizeP75	Response body size 75th percentile - bytes
responseBodySizeP90	Response body size 90th percentile - bytes
responseBodySizeP99	Response body size 99th percentile - bytes
responseBodySizeP999	Response body size 99.9th percentile - bytes
wallTimeP25	Wall time 25th percentile - microseconds
wallTimeP50	Wall time 50th percentile - microseconds
wallTimeP75	Wall time 75th percentile - microseconds
wallTimeP90	Wall time 90th percentile - microseconds
wallTimeP99	Wall time 99th percentile - microseconds
wallTimeP999	Wall time 99.9th percentile - microseconds

AccountWorkersInvocationsAdaptiveSum

Field	Description
duration	Sum of Duration - GB*s
errors	Sum of Errors
requests	Sum of Requests
responseBodySize	Sum of Response Body Sizes
subrequests	Sum of Subrequests
wallTime	Sum of Wall Time

AccountWorkersInvocationsScheduled

Workers scheduled invocations

Field	Description
cpuTimeUs	CPU time - microseconds
cron	The cron string of the schedule
datetime	Request datetime
environmentName	The name of the script environment
scheduledDatetime	Scheduled datetime
scriptName	The name of the script
status	Status of the worker invocation

AccountWorkersInvocationsScheduledFilter_InputObject

Field	Description

AccountWorkersInvocationsScheduledOrderBy

Field	Description

AccountWorkersOverviewDataAdaptiveGroups

Beta. Workers account overview invocation data with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountWorkersOverviewDataAdaptiveGroupsDimensions

Field	Description
datetime	Request datetime
usageModel	Usage model of the worker invocation

AccountWorkersOverviewDataAdaptiveGroupsFilter_InputObject

Field	Description

AccountWorkersOverviewDataAdaptiveGroupsOrderBy

Field	Description

AccountWorkersOverviewDataAdaptiveGroupsSum

Field	Description
standardCpuTimeUs	Standard usage model cpu time in us
unboundDurationUs	Unbound usage model duration in us

AccountWorkersOverviewRequestsAdaptiveGroups

Beta. Workers account overview invocation count with adaptive sampling

Field	Description
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountWorkersOverviewRequestsAdaptiveGroupsDimensions

Field	Description
datetime	Request datetime
status	Status of the worker invocation
usageModel	Usage model of the worker invocation

AccountWorkersOverviewRequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountWorkersOverviewRequestsAdaptiveGroupsOrderBy

Field	Description

AccountWorkersOverviewRequestsAdaptiveGroupsSum

Field	Description
cpuTimeUs	Cpu time in us

AccountWorkersSubrequestsAdaptiveGroups

Beta. Workers subrequests with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

AccountWorkersSubrequestsAdaptiveGroupsDimensions

Field	Description
cacheStatus	Cache status
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of an minute
environmentName	The name of the script environment
scriptName	The name of the script
usageModel	Usage model of the worker invocation

AccountWorkersSubrequestsAdaptiveGroupsFilter_InputObject

Field	Description

AccountWorkersSubrequestsAdaptiveGroupsOrderBy

Field	Description

AccountWorkersSubrequestsAdaptiveGroupsSum

Field	Description
requestBodySizeUncached	Workers fetch request body size in bytes where the request was not cached
subrequests	Number of subrequests

AccountZarazTriggersAdaptiveGroups

Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)

Field	Description
count	Number of processed Zaraz Triggers
dimensions	List of dimensions to group by

AccountZarazTriggersAdaptiveGroupsDimensions

Field	Description
date	The date when trigger was triggerd
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
triggerName	Trigger Name

AccountZarazTriggersAdaptiveGroupsFilter_InputObject

Field	Description

AccountZarazTriggersAdaptiveGroupsOrderBy

Field	Description

AccountZeroTrustPrivateNetworkDiscoveryGroups

Beta - Unique origins, applications, and users discovered for Zero Trust private networks

Field	Description
count	Sum of network access during the select range
dimensions	List of dimensions to group by
max
uniq

AccountZeroTrustPrivateNetworkDiscoveryGroupsDimensions

Field	Description
date	Request date
datetimeHour	Request datetime and start of the hour
destinationIP	Destination IPv4 or IPv6
destinationPort	Destination port
email	The email address of the user who accessed the resource
hostname	SNI hostname of the origin if TLS intercept is enabled
originId	UUID of the origin if it has been identified before
status	status of the origin, one of unreviewed, in_review, approved, unapproved
transport	The transport protocol used in the session, one of (0, tcp) (1, quic) (2, udp)
userId	The ID of the user who accessed the resource

AccountZeroTrustPrivateNetworkDiscoveryGroupsFilter_InputObject

Field	Description

AccountZeroTrustPrivateNetworkDiscoveryGroupsMax

Field	Description
dateTime	Latest access time of a user

AccountZeroTrustPrivateNetworkDiscoveryGroupsOrderBy

Field	Description

AccountZeroTrustPrivateNetworkDiscoveryGroupsUniq

Field	Description
emails	Approximate count of unique emails
origins	Approximate count of unique origins. An origin is a (transport, destinationIP, destinationPort)
userIds	Approximate count of unique users

Confidence

Field	Description
estimate	Estimated value of this metric
isValid	True if the confidence interval is valid, i.e. there is enough samples at low enough sample interval
lower	Lower bound of confidence interval
sampleSize	Number of samples that contributed to the estimate
upper	Upper bound of confidence interval

Date

Scalar type types.Date

Field	Description

Mutation

Mutations are not supported

Field	Description
do

Query

Field	Description
cost
viewer

Settings

Access and limitations

Field	Description
availableFields	The list of available fields to query
enabled
maxDuration	Requested time range should not be wider than this (seconds)
maxNumberOfFields	Maximum number of fields to request at once
maxPageSize	Maximum allowed value for 'limit'
notOlderThan	Cannot reach for data beyond this distance in the past (seconds)

Time

Scalar type time.Time

Field	Description

ZoneApiGatewayGraphqlQueryAnalyticsGroups

GraphQL query attributes and trends

Field	Description
avg
count	Number of events with GraphQL query attributes computed
dimensions	List of dimensions to group by

ZoneApiGatewayGraphqlQueryAnalyticsGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZoneApiGatewayGraphqlQueryAnalyticsGroupsDimensions

Field	Description
apiGatewayGraphqlQueryDepth	Maximum depth level of a terminal (leaf) field in the query
apiGatewayGraphqlQuerySize	Number of terminal (leaf) fields in the query
date
datetime
datetimeDay
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHalfOfHour
datetimeHour
datetimeMinute

ZoneApiGatewayGraphqlQueryAnalyticsGroupsFilter_InputObject

Field	Description

ZoneApiGatewayGraphqlQueryAnalyticsGroupsOrderBy

Field	Description

ZoneApiGatewayMatchedSessionIDsAdaptiveGroups

Beta. Aggregated count of Session Identifier matches

Field	Description
avg
count	Number of events with Session Identifiers
dimensions	List of dimensions to group by

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsDimensions

Field	Description
apiGatewayMatchedSessionIdentifierName	Name of session identifier
apiGatewayMatchedSessionIdentifierType	Type of session identifier. Possible values are header \| cookie
date
datetime
datetimeDay
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHalfOfHour
datetimeHour
datetimeMinute

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneApiGatewayMatchedSessionIDsAdaptiveGroupsOrderBy

Field	Description

ZoneApiRequestSequencesGroups

Sequences of API endpoint operations. Sequences are grouped by AuthID and currently ranked by correlation score. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes

Field	Description
aggArgMax
aggMax
dimensions	List of dimensions to group by

ZoneApiRequestSequencesGroupsAggArgMax

Field	Description
correlation	Correlation score estimated over a 24 hour window (higher scores mean more correlation between requests in the sequence of endpoint operations)
numOccurrences	Estimated number of occurrences of this sequence of endpoint operations
numOccurrencesPrefix	Estimated number of occurrences of this sequence of endpoint operations, disregarding the last operation
numOccurrencesSuffix	Estimated number of occurrences of this sequence of endpoint operations, disregarding the first operation
operationsApiEndpoints	API endpoints comprising the sequence of operations. Individual endpoints are delimited by # symbols
operationsClientRequestHTTPMethods	HTTP request methods comprising the sequence of operations. Individual request method names are delimited by # symbols
samplingFraction	Fraction of requests sampled

ZoneApiRequestSequencesGroupsAggMax

Field	Description
timeLastSeen	Time of the most recent occurrence of this sequence of endpoint operations (based on the timestamp of the first request in the sequence)
timeLastUpdated	The time at which Cloudflare last refreshed this data

ZoneApiRequestSequencesGroupsDimensions

Field	Description
apiHost	The host associated with this sequence of endpoint operations
clientRequestHTTPHost	The host associated with this sequence of endpoint operations
datetime	Sequence generation timeslot, truncated to 10 minutes
rank	Sequence rank based on ordering sequences by correlation

ZoneApiRequestSequencesGroupsFilter_InputObject

Field	Description

ZoneApiRequestSequencesGroupsOrderBy

Field	Description

ZoneCacheReserveOperationsAdaptiveGroups

Beta. Cache Reserve operations with adaptive sampling

Field	Description
avg	The average value used for sample interval
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneCacheReserveOperationsAdaptiveGroupsAvg

Field	Description
sampleInterval

ZoneCacheReserveOperationsAdaptiveGroupsDimensions

Field	Description
actionStatus	Status of the R2 operation
bucketName	Name of bucket containing stored objects
date	Request timestamp, truncated to start of a day
datetime	Request timestamp
datetimeFifteenMinutes	Request timestamp, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request timestamp, truncated to multiple of 5 minutes
datetimeHour	Request timestamp, truncated to start of an hour
datetimeMinute	Request timestamp, truncated to start of an minute
operationClass	Billable class of storage operation

ZoneCacheReserveOperationsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneCacheReserveOperationsAdaptiveGroupsOrderBy

Field	Description

ZoneCacheReserveOperationsAdaptiveGroupsSum

Field	Description
requests	Sum of Requests

ZoneCacheReserveRequestsAdaptiveGroups

Cache Reserve HTTP requests data with adaptive sampling

Field	Description
avg	The average value used for sample interval
count
dimensions	List of dimensions to group by
sum	Sum of bytes returned to client

ZoneCacheReserveRequestsAdaptiveGroupsAvg

Field	Description
sampleInterval

ZoneCacheReserveRequestsAdaptiveGroupsDimensions

Field	Description
cacheStatus	Cache status
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName	Content type returned to client
edgeResponseStatus	HTTP response status code returned to browser

ZoneCacheReserveRequestsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneCacheReserveRequestsAdaptiveGroupsOrderBy

Field	Description

ZoneCacheReserveRequestsAdaptiveGroupsSum

Field	Description
edgeResponseBytes

ZoneCacheReserveStorageAdaptiveGroups

Beta. Cache Reserve storage with adaptive sampling

Field	Description
avg	The average value used for sample interval
dimensions	List of dimensions to group by
max	The max of values for a metric per dimension

ZoneCacheReserveStorageAdaptiveGroupsAvg

Field	Description
sampleInterval

ZoneCacheReserveStorageAdaptiveGroupsDimensions

Field	Description
bucketHash	Hash of bucket containing stored objects
bucketName	Name of bucket containing stored objects
date	Storage sample timestamp, truncated to start of a day
datetime	Storage sample timestamp
datetimeFifteenMinutes	Storage sample timestamp, truncated to multiple of 15 minutes
datetimeFiveMinutes	Storage sample timestamp, truncated to multiple of 5 minutes
datetimeHour	Storage sample timestamp, truncated to start of an hour
datetimeMinute	Storage sample timestamp, truncated to start of an minute

ZoneCacheReserveStorageAdaptiveGroupsFilter_InputObject

Field	Description

ZoneCacheReserveStorageAdaptiveGroupsMax

Field	Description
objectCount	Max of object count
storedBytes	Payload and metadata size of objects in bucket

ZoneCacheReserveStorageAdaptiveGroupsOrderBy

Field	Description

ZoneDmarcReportsAdaptive

Dmarc report records with adaptive sampling

Field	Description
datetime	The date and time the source email was received
disposition	DMARC policy disposition
dkim	DKIM result
domain	Domain to which this report refers to
envelopeFrom	Envelope From of emails
envelopeTo	Envelope To of emails
evaluatedReason	Reason (if any) why the record was evaluated
headerFrom	Header From of emails
matchingMessages	Number of messages that matched
orgName	Organization that generated report
policyDKIMAlignmentMode	DKIM alignment mode specified in the policy
policyDomain	DMARC policy of the domain
policyPercentage	Percentage of emails that should be checked
policySPFAlignmentMode	SPF alignment mode specified in the policy
policySubDomain	DMARC policy of subdomains
recordId	Unique identifier of this record
recordIndex	Index of this record within the report
reportBegin	Start of the reporting period
reportEnd	End of the reporting period
reportError	Error message (if any)
reportId	Unique identifier of the report to which this record belongs
sampleInterval	ABR sample interval
sourceIP	Source IP address of the email
sourceLocationName	Country name from source IP
sourceOrgName	Source IP address organisation name
sourceOrgSlug	Source IP address organisation slug
sourcePTR	Source Domain from IP address
spf	SPF result
spfMFromDomain	Checked domain from scope mfrom

ZoneDmarcReportsAdaptiveFilter_InputObject

Field	Description

ZoneDmarcReportsAdaptiveOrderBy

Field	Description

ZoneDmarcReportsSourcesAdaptiveGroups

Aggregated dmarc reports by sources logs with adaptive sampling

Field	Description
avg	Beta. The avg of values for a metric per dimension
dimensions	List of dimensions to group by
sum
uniq

ZoneDmarcReportsSourcesAdaptiveGroupsAvg

Field	Description
dkimPass	Percentage of dkim messages pass
dmarc	Percentage of dmarc messages pass
spfPass	Percentage of spf messages pass

ZoneDmarcReportsSourcesAdaptiveGroupsDimensions

Field	Description
date	The date the source email was received
datetimeDay	The date and time the source email was received truncated to the day
datetimeHour	The date and time the source email was received truncated to the hour
datetimeLast31Days	The date and time the source email was received truncated to the last 31 days
datetimeMonth	The date and time the source email was received truncated to the month
datetimeWeek	The date and time the source email was received truncated to the week
disposition	DMARC policy disposition
dkim	DKIM result
domain	Domain to which this report refers to
envelopeFrom	Envelope From of emails
envelopeTo	Envelope To of emails
evaluatedReason	Reason (if any) why the record was evaluated
headerFrom	Header From of emails
orgName	Organization that generated report
sampleInterval	ABR sample interval
sourceIP	Source IP address of the email
sourceLocationName	Country name from source IP
sourceOrgName	Source IP address organisation name
sourceOrgSlug	Source IP address organisation slug
sourcePTR	Source Domain from IP address
spf	SPF result
spfMFromDomain	Checked domain from scope mfrom

ZoneDmarcReportsSourcesAdaptiveGroupsFilter_InputObject

Field	Description

ZoneDmarcReportsSourcesAdaptiveGroupsOrderBy

Field	Description

ZoneDmarcReportsSourcesAdaptiveGroupsSum

Field	Description
dkimPass	Total of dkim messages pass
dmarc	Total of dmarc messages pass
spfPass	Total of spf messages pass
totalMatchingMessages	Total matching messages

ZoneDmarcReportsSourcesAdaptiveGroupsUniq

Field	Description
ipCount	Number of distinct IPs

ZoneDnsAnalyticsAdaptive

Analytics data for DNS queries (currently, only Foundation DNS zones are supported)

Field	Description
coloName	IATA airport code of the data center that processed the query
ipVersion	Internet Protocol version over which the query was received
protocol	Transport protocol over which the query was received
queryName	DNS query name without trailing dot
querySize	Size of the DNS query in bytes
queryType	DNS query type
responseCached	Whether the DNS response was served from cache
responseCode	DNS response code
responseSize	Size of the DNS response in bytes
responseStale	Whether a stale DNS response was served from cache
sampleInterval	ABR sample interval
timestamp	Time at which the query was received
upstream	Upstream server that the query was forwarded to

ZoneDnsAnalyticsAdaptiveFilter_InputObject

Field	Description

ZoneDnsAnalyticsAdaptiveGroups

Analytics data for DNS queries (currently, only Foundation DNS zones are supported)

Field	Description
avg	Average of a metric per dimension
count	Number of queries per dimension
dimensions	List of dimensions to group by
quantiles	Quantiles of a metric per dimension

ZoneDnsAnalyticsAdaptiveGroupsAvg

Field	Description
responseTimeUs	Average response time in microseconds
sampleInterval	Average sample interval

ZoneDnsAnalyticsAdaptiveGroupsDimensions

Field	Description
coloName	IATA airport code of the data center that processed the query
ipVersion	Internet Protocol version over which the query was received
protocol	Transport protocol over which the query was received
queryName	DNS query name without trailing dot
querySizeBucket	Size of the DNS query in bytes (in multiples of 16)
queryType	DNS query type
responseCached	Whether the DNS response was served from cache
responseCode	DNS response code
responseSizeBucket	Size of the DNS response in bytes (in multiples of 16)
responseStale	Whether a stale DNS response was served from cache
timestamp	Time at which the query was received
upstream	Upstream server that the query was forwarded to

ZoneDnsAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneDnsAnalyticsAdaptiveGroupsOrderBy

Field	Description

ZoneDnsAnalyticsAdaptiveGroupsQuantiles

Field	Description
responseTimeUsP50	50th percentile response time in microseconds (median)
responseTimeUsP90	90th percentile response time in microseconds
responseTimeUsP99	99th percentile response time in microseconds

ZoneDnsAnalyticsAdaptiveOrderBy

Field	Description

ZoneEmailRoutingAdaptive

Beta. Raw email routing logs with adaptive sampling

Field	Description
datetime	The date and time the source email was received
dkim	DKIM check status of the source email
dmarc	DMARC check status of the source email
errorDetail	Detailed error message (if any)
from	The sender email address of the source email
isNDR	Is this event related to a NDR (bounce) email?
messageId	The Message-ID header of the source email (if present)
ruleMatched	The UUID of the routing rule matched by the source email
sampleInterval	ABR sample interval
sessionId	Unique identifier for the email log entry (note: retries for the same email may result in multiple log entries)
spf	SPF check status of the source email
status	The resulting outcome (action) for the email
subject	The subject of the source email
to	The recipient email address of the source email

ZoneEmailRoutingAdaptiveFilter_InputObject

Field	Description

ZoneEmailRoutingAdaptiveGroups

Beta. Aggregated email routing logs with adaptive sampling

Field	Description
count	Number of emails processed (approximation when sampleInterval > 1)
dimensions	List of dimensions to group by

ZoneEmailRoutingAdaptiveGroupsDimensions

Field	Description
date	The date the source email was received
datetimeFifteenMinutes	The date and time the source email was received truncated to fifteen minutes
datetimeFiveMinutes	The date and time the source email was received truncated to five minutes
datetimeHour	The date and time the source email was received truncated to the hour
datetimeMinute	The date and time the source email was received truncated to the minute
dkim	DKIM check status of the source email
dmarc	DMARC check status of the source email
isNDR	Is this event related to a NDR (bounce) email?
ruleMatched	The UUID of the routing rule matched by the source email
sampleInterval	ABR sample interval
spf	SPF check status of the source email
status	The resulting outcome (action) for the email

ZoneEmailRoutingAdaptiveGroupsFilter_InputObject

Field	Description

ZoneEmailRoutingAdaptiveGroupsOrderBy

Field	Description

ZoneEmailRoutingAdaptiveOrderBy

Field	Description

ZoneFilter_InputObject

Field	Description

ZoneFirewallEventsAdaptive

Raw Firewall events with adaptive sampling

Field	Description
action	The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botScore	The final score originated from bot management detections.
botScoreSrcName	Name of the source detection which generated the bot management score.
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientIP	The visitor's IP address (IPv4 or IPv6)
clientIPClass	The classification of the visitor's IP address, possible values are: unknown \| clean \| badHost \| searchEngine \| allowlist \| greylist \| monitoringService \| securityScanner \| noRecord \| scan \| backupService \| mobilePlatform \| tor
clientRefererHost	The referer host
clientRefererPath	The referer path requested by visitor
clientRefererQuery	The referer query-string was requested by the visitor
clientRefererScheme	The referer url scheme requested by the visitor
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	The HTTP method used by the visitor
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	The query-string was requested by the visitor
clientRequestScheme	The url scheme requested by the visitor
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
contentScanObjResults	Array of scan results in order of detection
contentScanObjTypes	Array of content types in order of detection
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
description	The description of the rule triggered by this request
edgeColoName	The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus	HTTP response status code returned to browser
httpApplicationVersion	Version associated with HTTP Application
ja3Hash	MD5 hash of the JA3 TLS fingerprint
kind	The kind of event, currently only possible values are: firewall
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
matchIndex	Rules match index in the chain
metadata	Additional product-specific information. Metadata is organized in key:value pairs
originResponseStatus	HTTP origin response status code returned to browser
originatorRayName	The RayId of the request that issued the challenge/jschallenge
rayName	The RayId of the request
ref	The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId	The Cloudflare security product-specific RuleId triggered by this request
rulesetId	The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval	ABR sample interval
source	The Cloudflare security product triggered by this request
userAgent	visitor's user-agent string
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore	Beta. Overall request score generated by the WAF detection module
wafMlSqliAttackScore	Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore	Beta. WAF ML score for an XSS attack
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
zoneVersion	The version of a zone

ZoneFirewallEventsAdaptiveByTimeGroups

Aggregated Firewall events with adaptive sampling grouped by time

Field	Description
avg	The average value used for sample interval
count	The sum of sample interval values
dimensions	List of dimensions to group by

ZoneFirewallEventsAdaptiveByTimeGroupsAvg

Field	Description
sampleInterval

ZoneFirewallEventsAdaptiveByTimeGroupsDimensions

Field	Description
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botScore	The final score originated from bot management detections.
botScoreSrcName	Name of the source detection which generated the bot management score.
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
description	The description of the rule triggered by this request
httpApplicationVersion	Version associated with HTTP Application
ja3Hash	MD5 hash of the JA3 TLS fingerprint
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore	Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore	Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore	Beta. WAF ML score for an XSS attack
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
zoneVersion	The version of a zone

ZoneFirewallEventsAdaptiveByTimeGroupsFilter_InputObject

Field	Description

ZoneFirewallEventsAdaptiveByTimeGroupsOrderBy

Field	Description

ZoneFirewallEventsAdaptiveFilter_InputObject

Field	Description

ZoneFirewallEventsAdaptiveGroups

Aggregated Firewall events with adaptive sampling

Field	Description
avg	The average value used for sample interval
count	The sum of sample interval values
dimensions	List of dimensions to group by

ZoneFirewallEventsAdaptiveGroupsAvg

Field	Description
sampleInterval

ZoneFirewallEventsAdaptiveGroupsDimensions

Field	Description
action	The code of the first-class action the Cloudflare Firewall took on this request
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botScore	The final score originated from bot management detections.
botScoreSrcName	Name of the source detection which generated the bot management score.
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientIP	The visitor's IP address (IPv4 or IPv6)
clientIPClass	The classification of the visitor's IP address, possible values are: unknown \| clean \| badHost \| searchEngine \| allowlist \| greylist \| monitoringService \| securityScanner \| noRecord \| scan \| backupService \| mobilePlatform \| tor
clientRefererHost	The referer host
clientRefererPath	The referer path requested by visitor
clientRefererQuery	The referer query-string was requested by the visitor
clientRefererScheme	The referer url scheme requested by the visitor
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	The HTTP method used by the visitor
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	The query-string was requested by the visitor
clientRequestScheme	The url scheme requested by the visitor
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
description	The description of the rule triggered by this request
edgeColoName	The airport code of the Cloudflare datacenter that served this request
edgeResponseStatus	HTTP response status code returned to browser
httpApplicationVersion	Version associated with HTTP Application
ja3Hash	MD5 hash of the JA3 TLS fingerprint
kind	The kind of event, currently only possible values are: firewall
matchIndex	Rules match index in the chain
originResponseStatus	HTTP origin response status code returned to browser
originatorRayName	The RayId of the request that issued the challenge/jschallenge
rayName	The RayId of the request
ref	The ref-field is a user-defined rule identifier that can be set via the API for some firewall products and allows users to label their rules individually alongside cloudflare provided identifiers (only available to entitled customers)
ruleId	The Cloudflare security product-specific RuleId triggered by this request
rulesetId	The Cloudflare security product-specific RulesetId triggered by this request
sampleInterval	ABR sample interval
source	The Cloudflare security product triggered by this request
userAgent	visitor's user-agent string
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafMlAttackScore	Beta. Overall request score generated by the WAF ML detection module
wafMlSqliAttackScore	Beta. WAF ML score for an SQLi attack
wafMlXssAttackScore	Beta. WAF ML score for an XSS attack
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
zoneVersion	The version of a zone

ZoneFirewallEventsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneFirewallEventsAdaptiveGroupsOrderBy

Field	Description

ZoneFirewallEventsAdaptiveMetadataElem

Field	Description
key	The key of the metadata. Key format can vary by Cloudflare security product and can change over time.
value	The value of the metadata. Value format can vary by Cloudflare security product and can change over time.

ZoneFirewallEventsAdaptiveOrderBy

Field	Description

ZoneHealthCheckEventsAdaptive

Raw Health Check events with adaptive sampling

Field	Description
date	The date the event was written to the database
datetime	The date and time the event was written to the database
eventId	The event id that created this healthcheck event
expectedResponseCodes	The expected response codes for the health check
failureReason	Reason why the health check failed
fqdn	Fully qualified domain name of the origin (if available)
healthChanged	1 if the origin health status has changed since the last health check, 0 otherwise
healthCheckId	A unique identifier for the health check
healthCheckName	Human-identifiable health check name
healthStatus	Origin health status
originIP	IP address of the origin
originResponseStatus	HTTP status code returned by the origin
region	Region where the health check occurred
rttMs	RTT (milliseconds) to reach the origin
sampleInterval	ABR sample interval
scope	Geographic aggregation level of the health status
tcpConnMs	Time taken for the tcp connection to be established
timeToFirstByteMs	Time taken for the first byte to be received once connection is available
tlsHandshakeMs	Time taken for the tls handshake to be completed

ZoneHealthCheckEventsAdaptiveFilter_InputObject

Field	Description

ZoneHealthCheckEventsAdaptiveGroups

Aggregated Health Check events with adaptive sampling

Field	Description
avg	The average value for a metric
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneHealthCheckEventsAdaptiveGroupsAvg

Field	Description
rttMs	Average RTT (milliseconds)
sampleInterval	Average sample interval
tcpConnMs	Average TCP Connection time (milliseconds)
timeToFirstByteMs	Average Time To First Byte (milliseconds)
tlsHandshakeMs	Average TLS Handshake time (milliseconds)

ZoneHealthCheckEventsAdaptiveGroupsDimensions

Field	Description
date	The date the event was written to the database
datetime	Datetime the event was written to the database
datetimeFifteenMinutes	Datetime the event was written to the database truncated to a multiple of 15 minutes
datetimeFiveMinutes	Datetime the event was written to the database truncated to a multiple of 5 minutes
datetimeHour	Datetime the event was written to the database truncated to the hour
datetimeMinute	Datetime the event was written to the database truncated to the minute
failureReason	Reason why the health check failed
fqdn	Fully qualified domain name of the origin (if available)
healthChanged	1 if the origin health status has changed since the last health check, 0 otherwise
healthCheckId	A unique identifier for the health check
healthCheckName	Human-identifiable health check name
healthStatus	Origin health status
originIP	IP address of the origin
originResponseStatus	HTTP status code returned by the origin
region	Region where the health check occurred
rttMs	RTT (milliseconds) to reach the origin
sampleInterval	ABR sample interval
scope	Geographic aggregation level of the health status
tcpConnMs	Time taken for the tcp connection to be established
timeToFirstByteMs	Time taken for the first byte to be received once connection is available
tlsHandshakeMs	Time taken for the tls handshake to be completed

ZoneHealthCheckEventsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneHealthCheckEventsAdaptiveGroupsOrderBy

Field	Description

ZoneHealthCheckEventsAdaptiveGroupsSum

Field	Description
healthStatus

ZoneHealthCheckEventsAdaptiveOrderBy

Field	Description

ZoneHttpRequests1dByColoGroups

Daily rollups of request data by colo

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneHttpRequests1dByColoGroupsCountryMapElem

Field	Description
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

ZoneHttpRequests1dByColoGroupsDimensions

Field	Description
coloCode	Code of edge server
date	Request date

ZoneHttpRequests1dByColoGroupsFilter_InputObject

Field	Description

ZoneHttpRequests1dByColoGroupsOrderBy

Field	Description

ZoneHttpRequests1dByColoGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

ZoneHttpRequests1dByColoGroupsSum

Field	Description
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
countryMap
requests
responseStatusMap
threatPathingMap

ZoneHttpRequests1dByColoGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

ZoneHttpRequests1dGroups

Daily rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

ZoneHttpRequests1dGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

ZoneHttpRequests1dGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

ZoneHttpRequests1dGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

ZoneHttpRequests1dGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

ZoneHttpRequests1dGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

ZoneHttpRequests1dGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

ZoneHttpRequests1dGroupsDimensions

Field	Description
date	Request date

ZoneHttpRequests1dGroupsFilter_InputObject

Field	Description

ZoneHttpRequests1dGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

ZoneHttpRequests1dGroupsOrderBy

Field	Description

ZoneHttpRequests1dGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

ZoneHttpRequests1dGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

ZoneHttpRequests1dGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

ZoneHttpRequests1dGroupsUniq

Field	Description
uniques	A number of unique IPs

ZoneHttpRequests1hGroups

Hourly rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

ZoneHttpRequests1hGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

ZoneHttpRequests1hGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

ZoneHttpRequests1hGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

ZoneHttpRequests1hGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

ZoneHttpRequests1hGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

ZoneHttpRequests1hGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

ZoneHttpRequests1hGroupsDimensions

Field	Description
date	Request date
datetime	Request datetime truncated to the hour

ZoneHttpRequests1hGroupsFilter_InputObject

Field	Description

ZoneHttpRequests1hGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

ZoneHttpRequests1hGroupsOrderBy

Field	Description

ZoneHttpRequests1hGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

ZoneHttpRequests1hGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

ZoneHttpRequests1hGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

ZoneHttpRequests1hGroupsUniq

Field	Description
uniques	A number of unique IPs

ZoneHttpRequests1mByColoGroups

Minutely rollups of request data by colo

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneHttpRequests1mByColoGroupsCountryMapElem

Field	Description
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

ZoneHttpRequests1mByColoGroupsDimensions

Field	Description
coloCode	Code of edge server
date	Request date
datetime	Request datetime
datetimeFifteenMinutes	Request datetime truncated to multiple of 15 minutes
datetimeHalfOfHour	Request datetime truncated to multiple of 30 minutes
datetimeHour	Request datetime truncated to the hour

ZoneHttpRequests1mByColoGroupsFilter_InputObject

Field	Description

ZoneHttpRequests1mByColoGroupsOrderBy

Field	Description

ZoneHttpRequests1mByColoGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

ZoneHttpRequests1mByColoGroupsSum

Field	Description
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
countryMap
requests
responseStatusMap
threatPathingMap

ZoneHttpRequests1mByColoGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

ZoneHttpRequests1mGroups

Minutely rollups of request data

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension
uniq	The number of unique values for a metric per dimension

ZoneHttpRequests1mGroupsAvg

Field	Description
bytes
sampleInterval	Average sample interval

ZoneHttpRequests1mGroupsBrowserMapElem

Field	Description
pageViews	Successful requests for HTML content
uaBrowserFamily	Browser type

ZoneHttpRequests1mGroupsClientHTTPVersionMapElem

Field	Description
clientHTTPProtocol	HTTP version
requests

ZoneHttpRequests1mGroupsClientSSLMapElem

Field	Description
clientSSLProtocol	Protocol version
requests

ZoneHttpRequests1mGroupsContentTypeMapElem

Field	Description
bytes	Bytes returned to client
edgeResponseContentTypeName	Content type returned to client
requests

ZoneHttpRequests1mGroupsCountryMapElem

Field	Description
bytes	Bytes returned to client
clientCountryName	Country from which request originated
requests
threats	Requests classified as threats

ZoneHttpRequests1mGroupsDimensions

Field	Description
date	Request date
datetime	Request datetime, truncated to the minute
datetimeDay	Request datetime truncated to the day
datetimeFifteenMinutes	Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime truncated to multiple of 30 minutes
datetimeHour	Request datetime truncated to the hour
datetimeMinute	Request datetime truncated to the minute

ZoneHttpRequests1mGroupsFilter_InputObject

Field	Description

ZoneHttpRequests1mGroupsIpClassMapElem

Field	Description
ipType	IP class
requests

ZoneHttpRequests1mGroupsOrderBy

Field	Description

ZoneHttpRequests1mGroupsResponseStatusMapElem

Field	Description
edgeResponseStatus	HTTP response status code returned to client
requests

ZoneHttpRequests1mGroupsSum

Field	Description
browserMap
bytes	Bytes returned to client
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
clientHTTPVersionMap
clientSSLMap
contentTypeMap
countryMap
encryptedBytes	Bytes returned to client using SSL/TLS protocol
encryptedRequests	Requests served using SSL/TLS protocol
ipClassMap
pageViews	Successful requests for HTML content
requests
responseStatusMap
threatPathingMap
threats	Requests classified as threats

ZoneHttpRequests1mGroupsThreatPathingMapElem

Field	Description
requests
threatPathingName	Threat type

ZoneHttpRequests1mGroupsUniq

Field	Description
uniques	A number of unique IPs

ZoneHttpRequestsAdaptive

Raw HTTP requests with adaptive sampling

Field	Description
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botManagementDecision	Judgement of the bot management system
botScore	The final score originated from bot management detections.
botScoreBucketBy10	Range of the bot management score
botScoreSrcName	Name of the source detection which generated the bot management score.
cacheReserveUsed	Used Cache Reserve to serve the response
cacheStatus	Cache status
clientASNDescription	The ASN of the visitor as string
clientAsn	The ASN number of the visitor
clientCountryName	Country from which request originated
clientDeviceType
clientIP	The visitor's IP address (IPv4 or IPv6)
clientRefererHost	The referrer host
clientRequestHTTPHost	The HTTP hostname requested by the visitor
clientRequestHTTPMethodName	HTTP method of client request
clientRequestHTTPProtocol	The version of HTTP protocol requested by the visitor
clientRequestPath	The path requested by visitor
clientRequestQuery	Query parameters of client request
clientRequestReferer	HTTP request referrer
clientRequestScheme	The url scheme requested by the visitor
clientSSLProtocol	SSL protocol version
coloCode
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs	The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus	HTTP response status code returned to browser
edgeTimeToFirstByteMs	The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion	Version associated with HTTP Application
isCrossZoneSubrequest	'1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash	MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
originASN
originASNDescription	ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus	HTTP origin response status code returned to browser
requestSource
securityAction	The code of the first-class action the Cloudflare Firewall took on this request
securitySource	The Cloudflare security product triggered by this request
upperTierColoName
userAgent	visitor's user-agent string
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
xRequestedWith	The X-Requested-With header of the client request
zoneVersion	The version of a zone

ZoneHttpRequestsAdaptiveFilter_InputObject

Field	Description

ZoneHttpRequestsAdaptiveGroups

Aggregated HTTP requests data with adaptive sampling

Field	Description
avg	The average value used for sample interval
confidence	ALPHA - DO NOT USE
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
quantiles	Quantiles of a metric per dimension
ratio	The ratio of a range of status codes, between 0 and 1
sum	The sum of values for a metric per dimension

ZoneHttpRequestsAdaptiveGroupsAvg

Field	Description
crossZoneSubrequests	The proportion of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeTimeToFirstByteMs
originResponseDurationMs	The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval

ZoneHttpRequestsAdaptiveGroupsConfidence

Field	Description
count	The number of values for a metric per dimension, with confidence intervals
level	Confidence level that was requested
sum	The sum of values for a metric per dimension, with confidence intervals

ZoneHttpRequestsAdaptiveGroupsDimensions

Field	Description
apiGatewayMatchedEndpoint	API Gateway endpoint matched at the edge
apiGatewayMatchedHost	API Gateway host matched at the edge
botManagementDecision	Judgement of the bot management system
botScore	The final score originated from bot management detections.
botScoreBucketBy10	Range of the bot management score
botScoreSrcName	Name of the source detection which generated the bot management score.
cacheReserveUsed	Used Cache Reserve to serve the response
cacheStatus
clientASNDescription	The ASN of the visitor as string
clientAsn
clientCountryName	Country from which request originated
clientDeviceType
clientIP
clientRefererHost	The referrer host
clientRequestHTTPHost	Host requested by the client
clientRequestHTTPMethodName	HTTP method of client request
clientRequestHTTPProtocol	HTTP protocol version
clientRequestPath	Path of client request
clientRequestQuery	Query parameters of client request
clientRequestReferer	HTTP request referrer
clientRequestScheme	HTTP request URI scheme (http/https)
clientSSLProtocol	SSL protocol version
coloCode
contentScanHasFailed	1 if not all contents for this request where successfully scanned, else 0
contentScanNumMaliciousObj	Number of scannable content objects that are malicious
contentScanNumObj	Number of scannable content objects
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeDnsResponseTimeMs	The time elapsed resolving a CNAME if it was required to reach your origin
edgeResponseContentTypeName
edgeResponseStatus
edgeTimeToFirstByteMs	The time elapsed between processing the first byte of the request until when we started sending a response
httpApplicationVersion	Version associated with HTTP Application
isCrossZoneSubrequest	'1' if a request was inititiated by a Cloudflare Worker on another zone; '0' otherwise.
ja3Hash	MD5 hash of the JA3 TLS fingerprint
leakedCredentialCheckResult	The distinct result of checking for leaked credentials
originASN
originASNDescription	ASN associated with origin
originIP
originResponseDurationMs
originResponseStatus	HTTP response status code returned by the origin
requestSource
sampleInterval	ABR sample interval
securityAction	The code of the first-class action the Cloudflare Firewall took on this request
securitySource	The Cloudflare security product triggered by this request
upperTierColoName
userAgent
userAgentBrowser	Browser parsed from the user agent
userAgentOS	OS parsed from the user agent
wafAttackScore	Beta. Overall request score generated by the WAF detection module
wafAttackScoreClass	Beta. Overall request score class generated by the WAF detection module
wafRceAttackScore	Beta. WAF score for a RCE attack
wafSqliAttackScore	Beta. WAF score for a SQLi attack
wafXssAttackScore	Beta. WAF score for a XSS attack
xRequestedWith	The X-Requested-With header of the client request
zoneVersion	The version of a zone

ZoneHttpRequestsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneHttpRequestsAdaptiveGroupsOrderBy

Field	Description

ZoneHttpRequestsAdaptiveGroupsQuantiles

Field	Description
edgeDnsResponseTimeMsP50	50th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP95	95th percentile DNS Response Time (milliseconds)
edgeDnsResponseTimeMsP99	99th percentile DNS Response Time (milliseconds)
edgeTimeToFirstByteMsP50	50th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP95	95th percentile Time To First Byte (milliseconds)
edgeTimeToFirstByteMsP99	99th percentile Time To First Byte (milliseconds)
originResponseDurationMsP50	50th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP95	95th percentile Origin Response Duration (milliseconds)
originResponseDurationMsP99	99th percentile Origin Response Duration (milliseconds)

ZoneHttpRequestsAdaptiveGroupsRatio

Field	Description
status4xx
status5xx

ZoneHttpRequestsAdaptiveGroupsSum

Field	Description
crossZoneSubrequests	The number of requests that were inititiated by a Cloudflare Worker on another zone
edgeDnsResponseTimeMs
edgeResponseBytes
edgeTimeToFirstByteMs
originResponseDurationMs
visits	The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

ZoneHttpRequestsAdaptiveGroupsSumConfidence

Field	Description
edgeResponseBytes	Confidence interval for the corresponding point estimate

ZoneHttpRequestsAdaptiveOrderBy

Field	Description

ZoneHttpRequestsOverviewAdaptiveGroups

A high-level summary of HTTP requests made by end users.

Field	Description
avg	The average value for a metric per dimension
dimensions	List of dimensions to group by
ratio	The ratio of a metric in comparison to the rest of the traffic, between 0 and 1
sum	The sum of values for a metric per dimension

ZoneHttpRequestsOverviewAdaptiveGroupsAvg

Field	Description
originResponseDurationMs	The average originResponseDuration, in milliseconds, excluding 0 values (i.e. cached ones)
sampleInterval	Average sample interval

ZoneHttpRequestsOverviewAdaptiveGroupsDimensions

Field	Description
clientCountryName	Country from which request originated
clientRequestHTTPProtocol	HTTP protocol version
clientSSLProtocol	SSL protocol version
date	The date the event occurred at the edge
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	The date and time the event occurred at the edge truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event occurred at the edge truncated to a multiple of 5 minutes
datetimeHour	The date and time the event occurred at the edge truncated to hours
datetimeMinute	The date and time the event occurred at the edge truncated to the minute
edgeResponseContentTypeName	Content type returned to client
edgeResponseStatus	HTTP response status code returned to client
httpApplicationVersion	Version associated with HTTP Application
userAgentBrowser	Browser parsed from the user agent
zoneVersion	The version of a zone

ZoneHttpRequestsOverviewAdaptiveGroupsFilter_InputObject

Field	Description

ZoneHttpRequestsOverviewAdaptiveGroupsOrderBy

Field	Description

ZoneHttpRequestsOverviewAdaptiveGroupsRatio

Field	Description
cachedBytes
cachedRequests
encryptedBytes
encryptedRequests
status4xx
status5xx

ZoneHttpRequestsOverviewAdaptiveGroupsSum

Field	Description
bytes
cachedBytes	Bytes returned to client from cache
cachedRequests	Requests served from cache
pageViews	Successful requests for HTML content
requests
visits	The number of requests by end-users that were initiated from a different website (i.e. where the request HTTP Referer header does not match the host in the HTTP Host header)

ZoneImageResizingRequests1mGroups

Minutely rollups of Image Resizing requests

Field	Description
count	Counts a number of rows per specific dimensions
dimensions	List of dimensions to group by
sum	Calculates a sum of each field per speicific dimensions

ZoneImageResizingRequests1mGroupsDimensions

Field	Description
contentType
date
datetime
datetimeFifteenMinutes
datetimeFiveMinutes
datetimeHour
datetimeMinute
resizeError	Error description when a resized image was requested but could not be served

ZoneImageResizingRequests1mGroupsFilter_InputObject

Field	Description

ZoneImageResizingRequests1mGroupsOrderBy

Field	Description

ZoneImageResizingRequests1mGroupsSum

Field	Description
originalBytes	The size of the image before resizing
originalPixels	The area of the image before resizing
requests	Count of image resizing requests
resizedBytes	The size of the image after resizing
resizedPixels	The area of the image after resizing

ZoneLoadBalancingRequestsAdaptive

Raw Load Balancing origin requests with adaptive sampling

Field	Description
coloCode	IATA airport code of data center that received the request
datetime	Request datetime
errorType	Error generated when selecting an origin
lbName	Load balancer name
numberOriginsSelected	Number of origins that were selected and returned to the client
origins	All origins in the pool that was selected based on steering policy
pools	List of pools from which a pool will be selected based on steering policy
proxied	Whether traffic is proxied through the Cloudflare network (orange-clouded)
region	Load balancing region where request originated
sampleInterval	ABR sample interval
selectedOriginIndex	Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list
selectedPoolAvgRttMs	Average RTT (milliseconds) to reach the origins within the selected pool
selectedPoolHealthChecksEnabled	Health checks active status for the selected pool
selectedPoolHealthy	Health status for the selected pool
selectedPoolId	A unique identifier for the selected pool
selectedPoolIndex	Index of the selected pool from the list of all pools
selectedPoolName	Name for the selected pool
sessionAffinity	Type of session affinity enabled
sessionAffinityStatus	Current status of session affinity
steeringPolicy	Policy by which the load balancer will route traffic

ZoneLoadBalancingRequestsAdaptiveFilter_InputObject

Field	Description

ZoneLoadBalancingRequestsAdaptiveGroups

Aggregated Load Balancing origin requests with adaptive sampling

Field	Description
avg
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by

ZoneLoadBalancingRequestsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZoneLoadBalancingRequestsAdaptiveGroupsDimensions

Field	Description
coloCode	IATA airport code of data center that received the request
datetime	Request datetime
datetimeFifteenMinutes	Request datetime truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime truncated to multiple of 30 minutes
datetimeHour	Request datetime truncated to the hour
datetimeMinute	Request datetime truncated to multiple of 1 minute
errorType	Error generated when selecting an origin
lbName	Load balancer name
multipleOriginsSelected	Indicates whether multiple origins were returned to the client
numberOriginsSelected	Number of origins that were selected and returned to the client
proxied	Whether traffic is proxied through the Cloudflare network (orange-clouded)
region	Load balancing region where request originated
sampleInterval	ABR sample interval
selectedOriginIndex	Index of the selected origin from the list of all origins. If multiple origins were selected, this is the index of the first origin in that list
selectedOriginName	Name of the selected origin
selectedOriginNames	Names of each selected origin
selectedPoolAvgRttMs	Dynamic Latency: RTT (milliseconds) to reach the origin pool
selectedPoolHealthChecksEnabled	Health checks status for the selected pool
selectedPoolHealthy	Health status for the selected pool
selectedPoolId	A unique identifier for the selected pool
selectedPoolIndex	Index of the selected pool from the list of all pools
selectedPoolName	Name for the selected pool
sessionAffinityEnabled	Type of session affinity enabled
sessionAffinityStatus	Current status of session affinity
steeringPolicy	Policy by which the load balancer will route traffic

ZoneLoadBalancingRequestsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneLoadBalancingRequestsAdaptiveGroupsOrderBy

Field	Description

ZoneLoadBalancingRequestsAdaptiveOrderBy

Field	Description

ZoneLoadBalancingRequestsAdaptiveOriginsElem

Field	Description
fqdn	Fully qualified domain name of the origin (if available)
health	Origin health status
ipv4	IPv4 Address of the origin
ipv6	IPv6 address of the origin
originName	Origin name
selected	All the origins that were returned to the client
weight	Ratio of traffic that will be distributed to this origin among all origins in the pool

ZoneLoadBalancingRequestsAdaptivePoolsElem

Field	Description
avgRttMs	Dynamic Latency: RTT (milliseconds) to reach the origin pool
distance	Distance to Pool KM
healthCheckEnabled	Health checks status
healthy	Pool health status
id	A unique identifier for the pool
poolName	Pool name

ZoneLogpushHealthAdaptiveGroups

Beta. Logpush job health metrics

Field	Description
avg
count	The number of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneLogpushHealthAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZoneLogpushHealthAdaptiveGroupsDimensions

Field	Description
date	Date that we completed pushing the log batch
datetime	Datetime that we completed pushing the log batch
datetimeFifteenMinutes	Datetime that we completed pushing the log batch, truncated to multiple of 15 minutes
datetimeFiveMinutes	Datetime that we completed pushing the log batch, truncated to multiple of 5 minutes
datetimeHour	Datetime that we completed pushing the log batch, truncated to the hour
datetimeMinute	Datetime that we completed pushing the log batch, truncated to the minute
destinationType	Destination type, e.g. 'S3' or 'GCS'
final	Cloudflare may attempt to push a batch of logs multiple times if we encounter a failure. This field will be set to 'true' if this was the last push attempt for this batch of logs. If this field is set to false, it means the push failed but another retry was attempted. If this field is set to true and status >= 300, then the batch of logs failed to push and log data was lost. If you want to count the total number of logs that succeeded or failed, you should always set final = true.
jobId	The Logpush Job ID
status	HTTP response status code of the log destination

ZoneLogpushHealthAdaptiveGroupsFilter_InputObject

Field	Description

ZoneLogpushHealthAdaptiveGroupsOrderBy

Field	Description

ZoneLogpushHealthAdaptiveGroupsSum

Field	Description
bytes	Bytes of uncompressed log data pushed
bytesCompressed	Bytes of compressed log data pushed
records	A count of the total number of records pushed.

ZoneNelReportsAdaptiveGroups

Data to visualize network error logs

Field	Description
avg
count	The number of NEL Reports
dimensions	List of dimensions to group by

ZoneNelReportsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZoneNelReportsAdaptiveGroupsDimensions

Field	Description
clientIPASN	Client ASN
clientIPASNDescription	Client ASN Description
clientIPCountry	Client Country
clientIPCountryCode	2 letter client country code using ISO 3166-1 alpha-2 syntax
clientIPVersion	IP Version the client used to connect
date	Request date from browser
datetime	Request datetime from browser
datetimeFifteenMinutes	Request datetime from browser, truncated to multiple of 15 minutes
datetimeFiveMinutes	Request datetime from browser, truncated to multiple of 5 minutes
datetimeHalfOfHour	Request datetime from browser, truncated to multiple of 30 minutes
datetimeHour	Request datetime from browser, truncated to the hour
datetimeMinute	Request datetime from browser, truncated to the minute
lastKnownGoodColoCode	IATA airport code of colo the client connected to
phase	The phase of connection the error occurred in
protocol	HTTP Protocol used when the error occured
type	The type of error in the phase

ZoneNelReportsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneNelReportsAdaptiveGroupsOrderBy

Field	Description

ZonePageShieldReportsAdaptiveGroups

Page Shield CSP reports

Field	Description
avg
count	Number of Page Shield CSP reports
dimensions	List of dimensions to group by

ZonePageShieldReportsAdaptiveGroupsAvg

Field	Description
sampleInterval	Average sample interval

ZonePageShieldReportsAdaptiveGroupsDimensions

Field	Description
action	policy action, log \| allow
cspDirective	csp directive e.g 'script-src'
date
datetime	The date and time the event occurred at the edge
datetimeFifteenMinutes	Report datetime from edge, truncated to multiple of 15 minutes
datetimeFiveMinutes	Report datetime from edge, truncated to multiple of 5 minutes
datetimeHalfOfHour	Report datetime from edge, truncated to multiple of 30 minutes
datetimeHour	Report datetime from edge, truncated to the hour
datetimeMinute	Report datetime from edge, truncated to the minute
host	hostname of the zone
pageURL	page on which the resource was found
policyID	The ID of the Policy
resourceType	resource type e.g script
url	URL of the CSP reported resource
urlHost	hostname of the resource URL

ZonePageShieldReportsAdaptiveGroupsFilter_InputObject

Field	Description

ZonePageShieldReportsAdaptiveGroupsOrderBy

Field	Description

ZoneSettings

Access and limitations for a zone

Field	Description
apiGatewayGraphqlQueryAnalyticsGroups
apiGatewayMatchedSessionIDsAdaptiveGroups
apiRequestSequencesGroups
cacheReserveOperationsAdaptiveGroups
cacheReserveRequestsAdaptiveGroups
cacheReserveStorageAdaptiveGroups
dmarcReportsAdaptive
dmarcReportsSourcesAdaptiveGroups
dnsAnalyticsAdaptive
dnsAnalyticsAdaptiveGroups
emailRoutingAdaptive
emailRoutingAdaptiveGroups
firewallEventsAdaptive
firewallEventsAdaptiveByTimeGroups
firewallEventsAdaptiveGroups
healthCheckEventsAdaptive
healthCheckEventsAdaptiveGroups
httpRequests1dByColoGroups
httpRequests1dGroups
httpRequests1hGroups
httpRequests1mByColoGroups
httpRequests1mGroups
httpRequestsAdaptive
httpRequestsAdaptiveGroups
httpRequestsOverviewAdaptiveGroups
imageResizingRequests1mGroups
loadBalancingRequestsAdaptive
loadBalancingRequestsAdaptiveGroups
logpushHealthAdaptiveGroups
nelReportsAdaptiveGroups
pageShieldReportsAdaptiveGroups
waitingRoomAnalyticsAdaptive
waitingRoomAnalyticsAdaptiveGroups
workersZoneInvocationsAdaptiveGroups
workersZoneSubrequestsAdaptiveGroups
zarazActionsAdaptiveGroups
zarazTrackAdaptiveGroups
zarazTriggersAdaptiveGroups

ZoneWaitingRoomAnalyticsAdaptive

Raw Waiting Room analytics logs

Field	Description
datetime	The date and time of the state of analytics for the waiting room
maxEstimatedTimeMinutes	Maximum value of estimated time in minutes
newUsersPerMinute	Actual value of new users per minute
newUsersPerMinuteConfig	Configured value of new users per minute
sampleInterval	ABR sample interval
sessionDuration	Configured value of session duration
timeBetweenRefreshesP50	50th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP75	75th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP90	90th percentile of the time between session refreshes in seconds
timeBetweenRefreshesP95	95th percentile of the time between session refreshes in seconds
timeInQueueP50	50th percentile of the time spent waiting in queue in seconds
timeInQueueP75	75th percentile of the time spent waiting in queue in seconds
timeInQueueP90	90th percentile of the time spent waiting in queue in seconds
timeInQueueP95	95th percentile of the time spent waiting in queue in seconds
timeOnOriginP50	50th percentile of the time spent on the origin in seconds
timeOnOriginP75	75th percentile of the time spent on the origin in seconds
timeOnOriginP90	90th percentile of the time spent on the origin in seconds
timeOnOriginP95	95th percentile of the time spent on the origin in seconds
totalActiveUsers	Actual value of total active users
totalActiveUsersConfig	Configured value of total active users
totalQueuedUsers	Total number of users that are queued
totalTimeWaitedP50	50th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP75	75th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP90	90th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
totalTimeWaitedP95	95th percentile of the total time (in seconds) spent waiting in queue by users who were queued and then gained access to the origin
waitingRoomId	Unique Identifier for the waiting room
waitingRoomName	Name of the waiting room

ZoneWaitingRoomAnalyticsAdaptiveFilter_InputObject

Field	Description

ZoneWaitingRoomAnalyticsAdaptiveGroups

Aggregated Waiting Room analytics logs with adaptive sampling

Field	Description
avg	Beta. The avg of values for a metric per dimension
avgWeighted	Beta. The avgWeighted values for a metric per dimension
dimensions	List of dimensions to group by
max	Beta. The max value for a metric per dimenstion
min	Beta. The minimum value for a metric per dimenstion
sum	The sum for a metric per dimension. Use for shorter queries since data gets sampled after 7 days.

ZoneWaitingRoomAnalyticsAdaptiveGroupsAvg

Field	Description
maxEstimatedTimeMinutes	Average of the maximum estimated wait time per minute. A negative number means no data
newUsersPerMinute	Average rate of new users per minute. A negative number means no data
newUsersPerMinuteConfig	Configured value of new users per minute. A negative number means no data
sampleInterval	Average sample interval
sessionDuration	Configured value of session duration. A negative number means no data
totalActiveUsers	Average rate of total active users. A negative number means no data
totalActiveUsersConfig	Configured value of total active users. A negative number means no data
totalQueuedUsers	Average of total queued users

ZoneWaitingRoomAnalyticsAdaptiveGroupsAvgWeighted

Field	Description
timeBetweenRefreshesP50	Weighted average of 50th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP75	Weighted average of 75th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP90	Weighted average of 90th percentile of time spent between session refreshes in seconds. A negative number means no data
timeBetweenRefreshesP95	Weighted average of 95th percentile of time spent between session refreshes in seconds. A negative number means no data
timeInQueueP50	Weighted average of 50th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP75	Weighted average of 75th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP90	Weighted average of 90th percentile of time spent in queue in seconds. A negative number means no data
timeInQueueP95	Weighted average of 95th percentile of time spent in queue in seconds. A negative number means no data
timeOnOriginP50	Weighted average of 50th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP75	Weighted average of 75th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP90	Weighted average of 90th percentile of time spent on origin in seconds. A negative number means no data
timeOnOriginP95	Weighted average of 95th percentile of time spent on origin in seconds. A negative number means no data
totalTimeWaitedP50	Weighted average of 50th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP75	Weighted average of 75th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP90	Weighted average of 90th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data
totalTimeWaitedP95	Weighted average of 95th percentile of the total time spent waiting in queue by users who have gained access to the origin in seconds. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsDimensions

Field	Description
date	The date the event was written to the database
datetime	The date and time the event was written to the database
datetimeFifteenMinutes	The date and time the event was written to the database, truncated to a multiple of 15 minutes
datetimeFiveMinutes	The date and time the event was written to the database, truncated to a multiple of 5 minutes
datetimeHour	The date and time the event was written to the database, truncated to the hour
datetimeMinute	The date and time the event was written to the database, truncated to the minute
sampleInterval	ABR sample interval
waitingRoomId	Unique Identifier for the waiting room

ZoneWaitingRoomAnalyticsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneWaitingRoomAnalyticsAdaptiveGroupsMax

Field	Description
maxEstimatedTimeMinutes	The maximum value of estimated time in minutes. A negative number means no data
newUsersPerMinute	The maximum value of the actual new users per minute. A negative number means no data
newUsersPerMinuteConfig	The maximum value of the configured new users per minute. A negative number means no data
sessionDuration	The maximum value of the configured session duration configuration. A negative number means no data
totalActiveUsers	The maximum value of the actual total active users. A negative number means no data
totalActiveUsersConfig	The maximum value of the configured total active users. A negative number means no data
totalQueuedUsers	The maximum value of total number of queued users. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsMin

Field	Description
maxEstimatedTimeMinutes	The minimum value of estimated time in minutes. A negative number means no data
newUsersPerMinute	The minimum value of the actual new users per minute. A negative number means no data
newUsersPerMinuteConfig	The minimum value of the configured new users per minute. A negative number means either Waiting Room is in passthrough or no data
sessionDuration	The minimum value of the configured session duration configuration. A negative number means no data
totalActiveUsers	The minimum value of the actual total active users. A negative number means no data
totalActiveUsersConfig	The minimum value of the configured total active users. A negative number means either Waiting Room is in passthrough or no data
totalQueuedUsers	The minimum value of total number of queued users. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveGroupsOrderBy

Field	Description

ZoneWaitingRoomAnalyticsAdaptiveGroupsSum

Field	Description
newUsersPerMinute	Sum of new users per minute. A negative number means no data

ZoneWaitingRoomAnalyticsAdaptiveOrderBy

Field	Description

ZoneWorkersZoneInvocationsAdaptiveGroups

Workers invocations with adaptive sampling

Field	Description
avg	The average of values for a metric per dimension
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneWorkersZoneInvocationsAdaptiveGroupsAvg

Field	Description
avgCpuTime	Average CPU time used per request (in microseconds)

ZoneWorkersZoneInvocationsAdaptiveGroupsDimensions

Field	Description
constantScriptId	Worker script Id
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of an minute
httpResponseStatus	Origin HTTP response code
status	Status of the worker invocation

ZoneWorkersZoneInvocationsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneWorkersZoneInvocationsAdaptiveGroupsOrderBy

Field	Description

ZoneWorkersZoneInvocationsAdaptiveGroupsSum

Field	Description
requests	Sum of Requests
responseBodySize	Bandwidth (in bytes) returned to eyeball
subrequests	Number of sub-requests issued by the edge worker
totalCpuTime	Total CPU time used (in microseconds)

ZoneWorkersZoneSubrequestsAdaptiveGroups

Workers subrequests with adaptive sampling

Field	Description
dimensions	List of dimensions to group by
sum	The sum of values for a metric per dimension

ZoneWorkersZoneSubrequestsAdaptiveGroupsDimensions

Field	Description
cacheStatus	Cache status
date	Request datetime, truncated to start of a day
datetime	Request datetime
datetimeHour	Request datetime, truncated to start of an hour
datetimeMinute	Request datetime, truncated to start of an minute
httpResponseStatus	Origin HTTP response code

ZoneWorkersZoneSubrequestsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneWorkersZoneSubrequestsAdaptiveGroupsOrderBy

Field	Description

ZoneWorkersZoneSubrequestsAdaptiveGroupsSum

Field	Description
responseBodySize	Bandwidth (in bytes) received via subrequests
subrequests	Number of subrequests issued by a worker

ZoneZarazActionsAdaptiveGroups

Zaraz Actions Analytics

Field	Description
count	Number of processed Zaraz Actions
dimensions	List of dimensions to group by

ZoneZarazActionsAdaptiveGroupsDimensions

Field	Description
actionName	Action Name
date	The date the Action was triggered
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
toolName	Tool Name

ZoneZarazActionsAdaptiveGroupsFilter_InputObject

Field	Description

ZoneZarazActionsAdaptiveGroupsOrderBy

Field	Description

ZoneZarazTrackAdaptiveGroups

Zaraz Track Analytics - counts zaraz.track calls

Field	Description
count	Number of processed Zaraz Track requests
dimensions	List of dimensions to group by

ZoneZarazTrackAdaptiveGroupsDimensions

Field	Description
date	Date when track was called
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
trackName	Track Name
urlPath	The URL from where Track was called

ZoneZarazTrackAdaptiveGroupsFilter_InputObject

Field	Description

ZoneZarazTrackAdaptiveGroupsOrderBy

Field	Description

ZoneZarazTriggersAdaptiveGroups

Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)

Field	Description
count	Number of processed Zaraz Triggers
dimensions	List of dimensions to group by

ZoneZarazTriggersAdaptiveGroupsDimensions

Field	Description
date	The date when trigger was triggerd
datetimeFifteenMinutes	The date and time truncated to fifteen minutes
datetimeFiveMinutes	The date and time truncated to five minutes
datetimeHour	The date and time truncated to the hour
datetimeMinute	The date and time truncated to the minute
triggerName	Trigger Name

ZoneZarazTriggersAdaptiveGroupsFilter_InputObject

Field	Description

ZoneZarazTriggersAdaptiveGroupsOrderBy

Field	Description

account

Field	Description
MagicWANConnectorMetricsAdaptiveGroups	Beta. Magic WAN Connector Metrics
accessLoginRequestsAdaptiveGroups	Access login requests
accountTag
advancedDnsProtectionNetworkAnalyticsAdaptiveGroups	Network analytics data for Advanced DNS Protection
advancedTcpProtectionNetworkAnalyticsAdaptiveGroups	Network analytics data for Advanced TCP Protection
aiGatewayCacheAdaptiveGroups	AI Gateway Cache
aiGatewayErrorsAdaptiveGroups	AI Gateway Errors
aiGatewayRequestsAdaptiveGroups	AI Gateway Requests
aiInferenceAdaptive	AI Inference logs with adaptive sampling
aiInferenceAdaptiveGroups	Aggregated AI Inference logs with adaptive sampling
cdnNetworkAnalyticsAdaptiveGroups	Network analytics data for Cloudflare CDN traffic
d1AnalyticsAdaptiveGroups	Beta. Aggregated D1 analytics with adaptive sampling
dosdAttackAnalyticsGroups	Attack analytics metadata for attacks detected by dosd
dosdNetworkAnalyticsAdaptiveGroups	Network analytics data for dosd
durableObjectsInvocationsAdaptiveGroups	Durable Objects invocations with adaptive sampling
durableObjectsPeriodicGroups	Durable Objects periodic metrics
durableObjectsStorageGroups	Durable Objects storage metrics
durableObjectsSubrequestsAdaptiveGroups	Durable Objects subrequests with adaptive sampling
fbmAttackAnalyticsGroups	FBM analytics metadata for attacks detected by dosd
firewallEventsAdaptive	Raw Firewall events with adaptive sampling
firewallEventsAdaptiveGroups	Aggregated Firewall events with adaptive sampling
flowtrackdNetworkAnalyticsAdaptiveGroups	Network analytics data for flowtrackd
gatewayL4DownstreamSessionsAdaptiveGroups	Aggregated metrics about downstream (client to edge) L4 Gateway Sessions. Metrics are reported on TCP or UDP session close
gatewayL4SessionsAdaptiveGroups	BETA - Aggregate counts of Gateway L4 sessions with adaptive sampling
gatewayL4UpstreamSessionsAdaptiveGroups	Aggregated metrics about upstream (edge to client) L4 Gateway Sessions. Metrics are reported on TCP, QUIC or UDP session close
gatewayL7RequestsAdaptiveGroups	BETA - Aggregate counts of Gateway L7 requests with adaptive sampling
gatewayResolverByCategoryAdaptiveGroups	BETA - Aggregate counts of Gateway Resolver queries by category with adaptive sampling
gatewayResolverByRuleExecutionPerformanceAdaptiveGroups	Total time spent on executing firewall rules at the edge
gatewayResolverQueriesAdaptiveGroups	BETA - Aggregate counts of Gateway Resolver queries with adaptive sampling
httpRequests1dGroups	Daily rollups of request data
httpRequests1hGroups	Hourly rollups of request data
httpRequests1mGroups	Minutely rollups of request data
httpRequestsAdaptive	Raw HTTP requests with adaptive sampling
httpRequestsAdaptiveGroups	Aggregated HTTP requests data with adaptive sampling
httpRequestsOverviewAdaptiveGroups	A high-level summary of HTTP requests made by end users.
hyperdriveQueriesAdaptiveGroups	Beta. Hyperdrive query events with adaptive sampling.
imagesRequestsAdaptiveGroups	A high-level summary of Cloudflare Images served to end users.
imagesUniqueTransformations	Image unique transfromations per day
logpushHealthAdaptiveGroups	Beta. Logpush job health metrics
magicFirewallNetworkAnalyticsAdaptiveGroups	Network analytics data for Magic Firewall
magicFirewallSamplesAdaptiveGroups	Data to visualize traffic allowed and blocked by Magic Firewall rules
magicIDPSNetworkAnalyticsAdaptiveGroups	Network analytics data for Magic IDS
magicTransitNetworkAnalyticsAdaptiveGroups	Network analytics data for Magic Transit traffic
magicTransitTunnelHealthChecksAdaptiveGroups	Beta. Magic Transit Health check results for customer GRE Tunnels with adaptive sampling (ABR).
magicTransitTunnelTrafficAdaptiveGroups	Bandwidth usage metric of a Magic Transit tunnel.
mnmFlowDataAdaptiveGroups	Flow data collected through Magic Network Monitoring
nelReportsAdaptiveGroups	Data to visualize network error logs
pagesFunctionsInvocationsAdaptiveGroups	Pages Functions invocations with adaptive sampling
queueBacklogAdaptiveGroups	Beta. Queue backlog data with adaptive sampling. Queues that are not being written to, or read from, will not return data, even if they have a backlog.
queueConsumerMetricsAdaptiveGroups	Beta. Queue consumer metrics with adaptive sampling. Inactive queues will not return data.
queueMessageOperationsAdaptiveGroups	Beta. Queue message operation data with adaptive sampling
r2OperationsAdaptiveGroups	Beta. R2 operations with adaptive sampling
r2StorageAdaptiveGroups	Beta. R2 storage with adaptive sampling
rumPageloadEventsAdaptiveGroups	Beta. Aggregated RUM pageload event metrics with adaptive sampling
rumPerformanceEventsAdaptiveGroups	Beta. Aggregated RUM performance event metrics with adaptive sampling
rumWebVitalsEventsAdaptive	Beta. RUM Web Vitals event metrics with adaptive sampling
rumWebVitalsEventsAdaptiveGroups	Beta. Aggregated RUM Web Vitals event metrics with adaptive sampling
settings
sinkholeRequestLogsAdaptive	Sinkhole Request Logs
sinkholeRequestLogsAdaptiveGroups	Sinkhole Request Logs
spectrumNetworkAnalyticsAdaptiveGroups	Network analytics data for Spectrum traffic
storageTraces	Storage Tracing Information
streamMinutesViewedAdaptiveGroups	A high-level summary of Cloudflare Stream minutes viewed.
turnstileAdaptiveGroups	Beta. Cloudflare Turnstile aggregated events with adaptive sampling
videoBufferEventsAdaptiveGroups	Beta. Aggregated video streaming buffer event metrics with adaptive sampling
videoPlaybackEventsAdaptiveGroups	Beta. Aggregated video streaming playback event metrics with adaptive sampling
videoQualityEventsAdaptiveGroups	Beta. Aggregated video streaming quality change event metrics with adaptive sampling
warpDeviceAdaptiveGroups	Beta. Warp device health events with adaptive sampling
workerPlacementAdaptiveGroups	Worker placement metrics
workersAnalyticsEngineAdaptiveGroups	Beta. Custom Events with adaptive sampling
workersInvocationsAdaptive	Beta. Workers invocations with adaptive sampling
workersInvocationsScheduled	Workers scheduled invocations
workersOverviewDataAdaptiveGroups	Beta. Workers account overview invocation data with adaptive sampling
workersOverviewRequestsAdaptiveGroups	Beta. Workers account overview invocation count with adaptive sampling
workersSubrequestsAdaptiveGroups	Beta. Workers subrequests with adaptive sampling
zarazTriggersAdaptiveGroups	Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
zeroTrustPrivateNetworkDiscoveryGroups	Beta - Unique origins, applications, and users discovered for Zero Trust private networks
zones

bool

Scalar type bool

Field	Description

bytes

Scalar type []uint8

Field	Description

float32

Scalar type float32

Field	Description

float64

Scalar type float64

Field	Description

int16

Scalar type int16

Field	Description

int64

Scalar type int64

Field	Description

int8

Scalar type int8

Field	Description

string

Scalar type string

Field	Description

uint16

Scalar type uint16

Field	Description

uint32

Scalar type uint32

Field	Description

uint64

Scalar type uint64

Field	Description

uint8

Scalar type uint8

Field	Description

viewer

Field	Description
accounts
budget
zones

zone

Field	Description
apiGatewayGraphqlQueryAnalyticsGroups	GraphQL query attributes and trends
apiGatewayMatchedSessionIDsAdaptiveGroups	Beta. Aggregated count of Session Identifier matches
apiRequestSequencesGroups	Sequences of API endpoint operations. Sequences are grouped by AuthID and currently ranked by correlation score. Correlation scores are estimated over a 24 hour window and are current to within 10 minutes
cacheReserveOperationsAdaptiveGroups	Beta. Cache Reserve operations with adaptive sampling
cacheReserveRequestsAdaptiveGroups	Cache Reserve HTTP requests data with adaptive sampling
cacheReserveStorageAdaptiveGroups	Beta. Cache Reserve storage with adaptive sampling
dmarcReportsAdaptive	Dmarc report records with adaptive sampling
dmarcReportsSourcesAdaptiveGroups	Aggregated dmarc reports by sources logs with adaptive sampling
dnsAnalyticsAdaptive	Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
dnsAnalyticsAdaptiveGroups	Analytics data for DNS queries (currently, only Foundation DNS zones are supported)
emailRoutingAdaptive	Beta. Raw email routing logs with adaptive sampling
emailRoutingAdaptiveGroups	Beta. Aggregated email routing logs with adaptive sampling
firewallEventsAdaptive	Raw Firewall events with adaptive sampling
firewallEventsAdaptiveByTimeGroups	Aggregated Firewall events with adaptive sampling grouped by time
firewallEventsAdaptiveGroups	Aggregated Firewall events with adaptive sampling
healthCheckEventsAdaptive	Raw Health Check events with adaptive sampling
healthCheckEventsAdaptiveGroups	Aggregated Health Check events with adaptive sampling
httpRequests1dByColoGroups	Daily rollups of request data by colo
httpRequests1dGroups	Daily rollups of request data
httpRequests1hGroups	Hourly rollups of request data
httpRequests1mByColoGroups	Minutely rollups of request data by colo
httpRequests1mGroups	Minutely rollups of request data
httpRequestsAdaptive	Raw HTTP requests with adaptive sampling
httpRequestsAdaptiveGroups	Aggregated HTTP requests data with adaptive sampling
httpRequestsOverviewAdaptiveGroups	A high-level summary of HTTP requests made by end users.
imageResizingRequests1mGroups	Minutely rollups of Image Resizing requests
loadBalancingRequestsAdaptive	Raw Load Balancing origin requests with adaptive sampling
loadBalancingRequestsAdaptiveGroups	Aggregated Load Balancing origin requests with adaptive sampling
logpushHealthAdaptiveGroups	Beta. Logpush job health metrics
nelReportsAdaptiveGroups	Data to visualize network error logs
pageShieldReportsAdaptiveGroups	Page Shield CSP reports
settings
waitingRoomAnalyticsAdaptive	Raw Waiting Room analytics logs
waitingRoomAnalyticsAdaptiveGroups	Aggregated Waiting Room analytics logs with adaptive sampling
workersZoneInvocationsAdaptiveGroups	Workers invocations with adaptive sampling
workersZoneSubrequestsAdaptiveGroups	Workers subrequests with adaptive sampling
zarazActionsAdaptiveGroups	Zaraz Actions Analytics
zarazTrackAdaptiveGroups	Zaraz Track Analytics - counts zaraz.track calls
zarazTriggersAdaptiveGroups	Zaraz Triggers Analytics (a trigger is a set of rules that can trigger a zaraz action)
zoneTag