get_flow_protocols

GET

/api/v1/flow/protocols

curl --request GET \
  --url https://example.com/api/v1/flow/protocols \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Parameters

Query Parameters

from

integer format: int64

Window start, Unix seconds. Defaults to one hour before to.

to

integer format: int64

Window end, Unix seconds. Defaults to now.

limit

integer format: int32

Maximum rows for a top-N aggregation. Clamped to 1..=1000.

proto

string

IP protocol numbers to include, comma-separated (6 or 6,17). At most 8; a value that is not a protocol number is rejected rather than ignored.

port

string

Destination ports to include, comma-separated (443 or 80,443). At most 8; a value that is not a port is rejected rather than ignored.

peer

string

Peer addresses to include, comma-separated. A row matches when one of these is its source or its destination. At most 8; a value that is not an IP address is rejected.

asn

string

AS numbers to include, comma-separated. A row matches when one of these is its source or destination AS; 0 is the unknown-AS bucket. At most 8; a non-numeric value is rejected.

dir

string

Which AS side top-as aggregates on: src, or dst (the default).

Responses

200

IP protocols ranked by traffic

Media typeapplication/json

Array<object>

A protocol aggregate.

object

bytes

required

Bytes.

integer format: int64

flows

required

Distinct flows.

integer format: int64

packets

required

Packets.

integer format: int64

proto

required

IP protocol number.

integer format: int32

Example^generated

[
  {
    "bytes": 1,
    "flows": 1,
    "packets": 1,
    "proto": 1
  }
]

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the read permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Flow monitoring is not enabled (no flow store configured)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}