Raw request logs

GET

/analytics/logs

const url = 'https://api.nsin.ir/analytics/logs?domain=example.com&period=3h&limit=100&offset=0&cache=hit&reqStatus=cache';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.nsin.ir/analytics/logs?domain=example.com&period=3h&limit=100&offset=0&cache=hit&reqStatus=cache' \
  --header 'Authorization: Bearer <token>'

Individual request records, newest first, with every filter applied as an AND. Requires a plan including the logs feature.

Header and body fields are retained for a shorter window than the rest of the row, so older entries return them empty.

Authorizations

bearerAuth
apiKeyAuth

Parameters

Query Parameters

domain

required

string

The domain name (for example example.com). These endpoints take the domain as a query parameter rather than a path segment.

Example

example.com

period

string

default: 24h

Allowed values: 3h 6h 12h 24h 7d 30d

Time window, ending now. Buckets are hourly up to 24h and daily for 7d and 30d. An unrecognised value falls back to 24h.

limit

integer

default: 100 >= 1 <= 500

Rows per page, 1–500. Values outside the range fall back to 100.

offset

integer

status

string

Exact HTTP status code.

method

string

HTTP method — case-insensitive.

uri

string

URI substring match.

cache

string

Allowed values: hit miss bypass

Cache status: hit, miss or bypass.

reqStatus

string

Allowed values: cache proxied direct

Serving path: cache, proxied or direct.

rayId

string

Exact ray id of a single request.

hostname

string

Exact host, a subdomain of it, or a bare subdomain label.

originHost

string

Host header sent to the origin.

originSni

string

SNI presented to the origin.

originAddr

string

Origin address the edge connected to.

originAddrs

string

Comma-separated list of origin addresses.

remoteAddr

string

Client IP address.

country

string

Client ISO country code.

nodeCountry

string

ISO country of the edge node that served the request.

node

string

Edge node name.

threat

string

Threat category.

detectAction

string

Action a detection rule took on the request.

botKind

string

Classified bot kind.

wafRuleId

string

A CRS rule id that fired.

headerSearch

string

Substring searched across the captured headers.

uriPatterns

string

Comma-separated URI patterns.

path

string

URL path prefix.

Responses

200

A page of request logs.

application/json

object

data

Array<object>

One request. Header and body fields are retained for a shorter window than the rest of the row, so older entries return them empty.

object

domain_id

integer

timestamp

string format: date-time

hostname

string

method

string

uri

Percent-encoded exactly as the client sent it.

string

status

Status returned to the visitor.

integer

remote_addr

string

country

string

duration

Total request duration in ms. For WebSockets this spans the whole connection.

number

bytes_in

integer

bytes_out

integer

cache_status

string

Allowed values: hit miss bypass

bypass_reason

string

req_status

string

Allowed values: cache proxied direct

user_agent

string

headers

Request headers as captured by the edge.

string

origin_req_headers

Headers the edge sent to the origin.

string

origin_headers

Headers the origin returned.

string

client_resp_headers

Headers returned to the visitor.

string

body

string

is_ws

boolean

content_type

string

error

string

node

Edge node that served the request.

string

ray_id

Unique id for this request.

string

protocol

Client-to-edge protocol, e.g. HTTP/2.0.

string

origin_protocol

Edge-to-origin protocol. Empty on a cache hit.

string

origin_status

Status the origin returned. 0 on a cache hit.

integer

origin_error_body

Bounded prefix of the body the origin sent with a 5xx, which the edge replaced with an error page.

string

origin_addr

Origin IP:port the edge connected to.

string

tls_version

string

tls_cipher

string

tls_resumed

boolean

content_encoding

string

referer

string

cache_age

Seconds the served object had been cached.

integer

asn

integer

asn_org

string

bot_kind

Bot classification, when the request was identified as one.

string

bot_verified

Whether the bot’s identity was verified, rather than merely claimed.

boolean

detect_action

Action a detection rule took.

string

detect_dry_run

True when the rule was in dry-run, so nothing was enforced.

boolean

waf_score

WAF anomaly score.

integer

waf_rule_ids

CRS rule ids that fired.

string

ja4

string

ja4h

string

md_converted

The response was served as Markdown.

boolean

md_tokens

integer

orig_tokens

integer

md_fail_reason

string

total

Rows matching the filters, before paging.

integer

limit

integer

offset

integer

Example

{
  "data": [
    {
      "cache_status": "hit",
      "req_status": "cache"
    }
  ]
}

400

The domain query parameter is missing.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

missing

{
  "error": "domain is required"
}

401

Missing, malformed, revoked or expired API key — or the owning account is inactive.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

invalidKey

{
  "error": "invalid API key"
}

403

The domain’s plan does not include the feature this endpoint needs (monitoring for most sections, logs for raw and top-N request data).

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

404

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

429

The key exceeded its request budget (300 requests per minute by default).

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

limited

{
  "error": "rate limit exceeded"
}

503

The analytics backend is temporarily unreachable. Retry; no data is lost.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

unavailable

{
  "error": "analytics unavailable"
}