Skip to content
nsin docs
EN فا

Security actions by family

GET
/analytics/security/actions
 
curl --request GET \
  --url 'https://api.nsin.ir/analytics/security/actions?domain=example.com&period=1h&family=custom' \
  --header 'Authorization: Bearer <token>'

Every request an edge rule acted on, per hour and action family (custom, rate, uam, drop, fingerprint, waf, captcha, ddos, other), split into enforced and dry run, plus totals per action. Hourly UTC buckets. available is false (with empty lists) until the platform’s security rollups are in place.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
domain
required
string

The domain name (for example example.com). These endpoints take the domain as a query parameter rather than a path segment.

Example 
example.com
period
string
default: 24h
Allowed values: 1h 3h 6h 12h 24h 48h 7d 30d

Time window, ending now. Time series are bucketed by minute for 1h, by hour up to 48h, and by day for 7d and 30d. Buckets are cut on Asia/Tehran (UTC+03:30) boundaries and emitted as UTC instants, so an hourly bucket starts at :30 UTC. An unrecognised value falls back to 24h.

family
string
Allowed values: custom rate uam drop fingerprint waf captcha ddos other

Only this action family.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

The figures.

Media type application/json
object
available
boolean
period
string
series
Array<object>
object
t
string format: date-time
family
string
dry_run
boolean
count
integer
families
Array<object>
object
family
string
enforced
integer
dry_run
integer
totals
Array<object>
object
action
string
family
string
dry_run
boolean
count
integer
Example generated
{
  "available": true,
  "period": "example",
  "series": [
    {
      "t": "2026-04-15T12:00:00Z",
      "family": "example",
      "dry_run": true,
      "count": 1
    }
  ],
  "families": [
    {
      "family": "example",
      "enforced": 1,
      "dry_run": 1
    }
  ],
  "totals": [
    {
      "action": "example",
      "family": "example",
      "dry_run": true,
      "count": 1
    }
  ]
}

400

Section titled “400 ”

The domain query parameter is missing.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example missing 
{
  "error": "domain is required"
}

401

Section titled “401 ”

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example invalidKey 
{
  "error": "invalid API key"
}

402

Section titled “402 ”

The domain has no active plan at all, so no plan feature is available on it. Buy or renew a plan for the domain. (A plan that is active but does not include the feature answers 403 instead.)

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example noPlan 
{
  "error": "This domain does not have an active plan."
}

403

Section titled “403 ”

The domain’s plan does not include the feature this endpoint needs (monitoring for most sections, logs for raw and top-N request data).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

404

Section titled “404 ”

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Example 
{
  "error": "read-only API key"
}

429

Section titled “429 ”

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example limited 
{
  "error": "rate limit exceeded"
}

503

Section titled “503 ”

Either the analytics backend is temporarily unreachable (retry; no data is lost), or the answer is still being computed. The per-domain sections and the cached account-wide views (domains-overview, global-summary, global-summary/peak, requests-compare, bandwidth-overview, nodes-overview) wait at most about 25 seconds for their query; past that they answer 503 with pending: true and a Retry-After header, while the query keeps running and caches its result, so the retry is served from that cache instead of starting the same scan again. Identical concurrent requests share one computation.

Media type application/json
object
error
required

Human-readable description of what went wrong.

string
pending

true when the query is still running rather than failing. Retry after Retry-After seconds.

boolean
Examples
{
  "error": "analytics unavailable"
}

Headers

Section titled “Headers ”
Retry-After
integer
Example 
5

Seconds to wait before retrying. Sent only with pending.

504

Section titled “504 ”

The query ran out of time for this period. Retrying the same request runs the same query again, so ask for a shorter period (or narrow it with hostname/path) instead.

Media type application/json

The single error shape used by every endpoint.

object
error
required

Human-readable description of what went wrong.

string
Examples
Example timedOut 
{
  "error": "summary timed out for this period; try a shorter one"
}