QueryDeliveryTimeseries returns event delivery (forwarder) counts bucketed by time, suitable for plotting trend charts in a single call.

End of the query range, exclusive. RFC 3339 UTC timestamp. Must be after start.

Bucket width for the returned buckets, expressed as a duration string: a number with a unit suffix "s", "m", or "h" (e.g. "30m", "1h", "24h"). Units may be combined, e.g. "1h30m". The response echoes the effective interval in normalized form (e.g. "300s" becomes "5m").

The interval must be a whole multiple of 1 minute. Which multiples are allowed depends on how far back the range starts, because finer-grained data is retained for less time. Divisibility — not size — decides the tier:

• Multiples of 24h (1 day), e.g. "24h", "168h": allowed for any range within the 13-month retention period.
• Multiples of 1h that are not multiples of 1 day, e.g. "1h", "2h", "12h": the range must start on or after 00:00 UTC six days before the current UTC day (roughly the last 7 days).
• Every other multiple of 1 minute, e.g. "1m", "5m", "30m": the range must start within the last 48 hours. Note "90m" lands in this tier — it is larger than an hour but not a whole multiple of one. In addition, the range divided by the interval must yield at most 400 buckets.

Violations return INVALID_ARGUMENT (HTTP 400) naming the violated rule and the finest interval that fits the range.

Buckets are aligned to the Unix epoch in UTC: hour-multiple intervals start on the hour, day-multiple intervals at 00:00 UTC (note: a 7-day interval therefore starts buckets on Thursdays). For intervals finer than 1 hour, buckets starting within the last 2 minutes are omitted because their data is still arriving and would under-report; data_through in the response marks where the returned data stops. Counts are attributed to buckets by the time the platform recorded the stat, which can lag the event itself by up to ~65 seconds — at minute granularity a burst of traffic may appear one bucket later than it occurred.

If unset, the server selects the finest interval permitted by the rules above and echoes it in the response.

Start of the query range, inclusive. RFC 3339 UTC timestamp.

Exclusive upper bound of the returned buckets. Equals end, except when an interval finer than 1 hour omits still-arriving trailing buckets — then data_through marks where the returned data stops. Totals cover only the returned buckets; compare data_through with end to detect truncation.

Echo of the requested range end.

The effective bucket width as a normalized duration string (e.g. "5m", "1h", "24h"): the requested interval, or the server-selected one when the request omitted it.

Echo of the requested range start.

Total number of events successfully sent to integrations across the entire range and all series.

Total number of events that failed to reach the integration due to errors, across the entire range and all series. Unexpected data loss.

Total number of events dropped by filtering mechanisms such as pipeline, compliance, and playbook filters, across the entire range and all series. Expected data loss.