flowLogs

List Flow Log details

<Info icon="fa-light fa-lock" className="permission-callout"> <div className="permission-callout__header"><span className="permission-callout__title"><span className="permission-callout__label">Required permissions</span> <span className="fern-docs-badge small blue subtle rounded-full permission-callout__beta">Beta</span></span> <span className="permission-callout__learn-more">[Learn more](/developers/api-guidelines/permissions#how-permissions-work)</span></div>

Endpoint.FlowLogs.Detail + List

<div className="permission-callout__roles"><span className="permission-callout__roles-label">Roles:</span> <Badge intent="info">Administrator</Badge></div> </Info>

Returns individual (non-aggregated) Flow Log rows for a device, with pagination, filtering, and sorting. Each row includes information such as destination_ip, destination_port, protocol, bytes_up, and bytes_down, and, when available, the destination_hostname, pdp_context, country, and network.

By default, the response covers the last hour. Use started_from in the q parameter to look back up to 30 days.

Filters follow the standard q=<field>:<criteria> syntax:

  • Combine multiple filters on different fields with , (AND).
  • Combine multiple values for the same field with || (OR).

Use sort to order the results and page / per_page to paginate.

get/api/v1/endpoint/{endpointId}/flowlogs/detail

Request

  • Base URL: https://cdn.emnify.net
  • URL: https://cdn.emnify.net/api/v1/endpoint/{endpointId}/flowlogs/detail
  • Auth: HTTP bearer

Path parameters

endpointIdnumber double required

Query parameters

per_pageinteger

Number of detail rows to return per page.

pageinteger

Page number to retrieve. Starts at 1.

sortstring

Sorts detail rows by field value. Use <operator><field> format. Operators: - descending, + ascending.

<Tip> You can also combine multiple sort fields with commas (for example, `-started_on,destination_hostname`). </Tip>
qstring

Filters detail rows by field value. Use <field>:<criteria> format.

Combine multiple filters with commas (for example, protocol:TCP,destination_hostname:api.example.com). Use || within one field for multiple values (for example, protocol:TCP||UDP).

Supported keys: destination_hostname, destination_ip, destination_port, protocol, flow_id, event_type.

Time window (optional, each as <field>:<ISO-8601 UTC>):

  • started_from - Lower bound on flow start
    • Defaults to 1 hour ago
    • Maximum look-back 30 days.
  • started_until - Upper bound on flow start
    • Defaults to now.
  • completed_from / completed_until - Bounds on flow completion time.
<Warning> Window fields must use `:` only (no other operators). </Warning>

Response

Detail rows for the requested filter window.

flow_idstring

Unique identifier of the flow.

organisation_idinteger

Identifier of the organization that owns the endpoint.

endpoint_idinteger

Identifier of the endpoint the flow belongs to.

started_onstring date-time

Start time of the flow.

completed_onstring date-time

Completion time of the flow.

duration_secondsinteger

Duration of the flow in seconds.

event_typestring

Type of flow event (for example, flow_start, flow_update).

directionstring

Direction of the flow (for example, ingress, egress).

source_ipstring

Source IP address of the flow.

source_portinteger

Source port of the flow.

destination_ipstring

IP address of the destination.

destination_portinteger

Destination port number.

protocolstring

Transport protocol (for example, TCP, UDP).

bytes_upinteger

Total bytes uploaded to the destination.

bytes_downinteger

Total bytes downloaded from the destination.

destination_hostnamestring nullable

Hostname of the destination, if resolved.

destination_hostname_sourcestring nullable

Source used to resolve the destination hostname (for example, TLS_SNI, reverse_dns).

session_idstring

Identifier of the PDP session the flow belongs to.

last_loaded_atstring date-time

Time the flow record was last loaded.

Changes

No recorded changes to this operation across all 1 revision of this API.