---
title: "IP Timeline Field Summary"
method: GET
path: "/v3/noise/ips/{ip}/timeline"
tags: ["IP Timeline"]
---

# IP Timeline Field Summary

`GET /v3/noise/ips/{ip}/timeline`

Retrieve an IP address' summary of noise activity for a specific field.

_License: This endpoint requires an additional subscription
license to use._

## Response `200`

Success - returns activity data

- IPTimelineResponse
  - `results` object[]
    - `data` integer — Hourly activity count for the field value in this time bucket
    - `label` string — A label that corresponds to a distinct value for the given field
    - `timestamp` string, date-time — Time range bucket based on granularity - the timestamp represents the start of the bucket
  - `metadata` object
    - `ip` string — IP queried
    - `field` string — Field over which to show change
    - `first_seen` string — The earliest date GreyNoise observed any activity from this IP.
    - `start` string, date-time — Start of time range for data
    - `end` string, date-time — End of time range for data
    - `granularity` string — Granularity at which to show data
    - `metric` string — The metric used within the data field

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `404` — Resource not found.
- `500` — Unexpected error

---

[API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)