get_flow_conversations

GET

/api/v1/flow/conversations

curl --request GET \
  --url https://example.com/api/v1/flow/conversations \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Parameters

Query Parameters

from

integer format: int64

to

integer format: int64

limit

integer format: int32

proto

string

port

string

peer

string

asn

string

dir

string

Responses

200

Source→destination pairs ranked by traffic, AS names resolved

Media typeapplication/json

Array<object>

A conversation: a src→dst pair with summed traffic. src_asn/dst_asn are the stored per-flow AS numbers (0 = unknown); the *_as_name fields are resolved from the IP→ASN table at the API layer (the store leaves them None), mirroring [FlowAsAgg].

object

bytes

required

Bytes.

integer format: int64

dst

required

Destination address.

string

dst_as_name

Destination AS organization name, if resolvable (filled at the API layer).

string | null

dst_asn

required

Destination autonomous-system number (0 = unknown).

integer format: int32

flows

required

Distinct flows.

integer format: int64

packets

required

Packets.

integer format: int64

src

required

Source address.

string

src_as_name

Source AS organization name, if resolvable (filled at the API layer).

string | null

src_asn

required

Source autonomous-system number (0 = unknown).

integer format: int32

Example^generated

[
  {
    "bytes": 1,
    "dst": "example",
    "dst_as_name": "example",
    "dst_asn": 1,
    "flows": 1,
    "packets": 1,
    "src": "example",
    "src_as_name": "example",
    "src_asn": 1
  }
]

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the read permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Flow monitoring is not enabled (no flow store configured)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}