Skip to content
nsin docs
EN فا

Top-N breakdown by a chosen metric

GET
/analytics/top-requests
 
curl --request GET \
  --url 'https://api.nsin.ir/analytics/top-requests?domain=example.com&metric=slow_requests&period=1h' \
  --header 'Authorization: Bearer <token>'

A ranked breakdown of the domain’s traffic. metric selects what is ranked, and which fields of each row are populated — rows omit the fields that do not apply.

It takes no hostname or path filter: every row covers the whole domain.

Requires a plan including the logs feature.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
domain
required
string

The domain name (for example example.com). These endpoints take the domain as a query parameter rather than a path segment.

Example 
example.com
metric
required
string
Allowed values: slow_requests uris errors_5xx hosts countries user_agents networks
  • slow_requests — slowest paths, with average and maximum duration. Excludes WebSockets.
  • uris — most requested paths.
  • errors_5xx — paths returning server errors.
  • hosts — busiest subdomains.
  • countries — busiest visitor countries.
  • user_agents — busiest user agents.
  • networks — busiest visitor networks, keyed AS<number> with the operator in label.
period
string
default: 24h
Allowed values: 1h 3h 6h 12h 24h 48h 7d 30d

Time window, ending now. Time series are bucketed by minute for 1h, by hour up to 48h, and by day for 7d and 30d. Buckets are cut on Asia/Tehran (UTC+03:30) boundaries and emitted as UTC instants, so an hourly bucket starts at :30 UTC. An unrecognised value falls back to 24h.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Ranked rows.

Media type application/json
object
data
Array<object>

One ranked row. Which fields are populated depends on the metric — the rest are omitted.

object
key

The ranked value — path, country, user agent, hostname or AS<number>.

string
label

Network operator name, for the networks metric.

string
hostname

Owning host, for path-based metrics.

string
asn
integer
requests
integer
bytes
integer
avg_duration

Milliseconds.

number
max_duration

Milliseconds.

number
Example generated
{
  "data": [
    {
      "key": "example",
      "label": "example",
      "hostname": "example",
      "asn": 1,
      "requests": 1,
      "bytes": 1,
      "avg_duration": 1,
      "max_duration": 1
    }
  ]
}

400

Section titled “400 ”

The domain query parameter is missing.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example missing 
{
  "error": "domain is required"
}

401

Section titled “401 ”

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example invalidKey 
{
  "error": "invalid API key"
}

402

Section titled “402 ”

The domain has no active plan at all, so no plan feature is available on it. Buy or renew a plan for the domain. (A plan that is active but does not include the feature answers 403 instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example noPlan 
{
  "error": "This domain does not have an active plan."
}

403

Section titled “403 ”

The domain’s plan does not include the feature this endpoint needs (monitoring for most sections, logs for raw and top-N request data).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

404

Section titled “404 ”

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

429

Section titled “429 ”

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example limited 
{
  "error": "rate limit exceeded"
}

503

Section titled “503 ”

Either the analytics backend is temporarily unreachable (retry; no data is lost), or the answer is still being computed. The per-domain sections and the cached account-wide views (domains-overview, global-summary, global-summary/peak, requests-compare, bandwidth-overview, nodes-overview) wait at most about 25 seconds for their query; past that they answer 503 with pending: true and a Retry-After header, while the query keeps running and caches its result, so the retry is served from that cache instead of starting the same scan again. Identical concurrent requests share one computation.

Media type application/json
object
error
required

Human-readable description of what went wrong.

string
pending

true when the query is still running rather than failing. Retry after Retry-After seconds.

boolean
Examples
{
  "error": "analytics unavailable"
}

Headers

Section titled “Headers ”
Retry-After
integer
Example 
5

Seconds to wait before retrying. Sent only with pending.

504

Section titled “504 ”

The query ran out of time for this period. Retrying the same request runs the same query again, so ask for a shorter period (or narrow it with hostname/path) instead.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example timedOut 
{
  "error": "summary timed out for this period; try a shorter one"
}