---
title: "Access breakdown"
method: GET
path: "/access/breakdown"
tags: ["Access"]
---

# Access breakdown

`GET /access/breakdown`

## Request

- Base URL: `https://api.tatum.io/v4/logs`
- URL: `https://api.tatum.io/v4/logs/access/breakdown`
- Auth: API key in header `x-api-key`

Where the window's requests went: the top 10 networks plus one "other"
total, the top status codes and methods, the top 10 client IPs (each with
its error rate and egress) plus one "other" total, every traffic source
with a trend, and p50/p90/p95 latency over
time — for the same window, source and filters as `/access/chart`, so a
zoom updates it. Shares are of `total_requests` in the same response.
Source sparklines share the KPI sparklines' grid (at most 30 points,
`sources_step_ms` wide); the latency series has its own of at most 60.
Accepts every `filter[...]` field `/access/events` does except `event_id`,
plus `search`. When a raw read trips its bound the response is
`capped: true`: `total_requests` and every `*_other` are `null` and the lists are empty.

## Query parameters

- `time_range` union
  - '5m'
  - '15m'
  - '1h'
  - '6h'
  - '24h'
  - '7d'
  - '14d'
  - '30d'
- `from` string, date-time
- `to` string, date-time
- `search` string
- `filter[status_code][in]` integer[]
- `filter[status_code][nin]` integer[]
- `filter[status_code][between]` integer[]
- `filter[network][in]` string[]
- `filter[network][nin]` string[]
- `filter[chain][in]` string[]
- `filter[chain][nin]` string[]
- `filter[method][in]` string[]
- `filter[method][nin]` string[]
- `filter[method][contains]` string
- `filter[remote_ip][in]` string[]
- `filter[remote_ip][nin]` string[]
- `filter[source][in]` string[]
- `filter[source][nin]` string[]
- `filter[req_id][in]` string[]

## Response `200`

Requests by network, status code, method, client IP and source, and latency percentiles over time.

- AccessBreakdownResponse: Where the window's requests went: by network, status code, method, client IP, by product (source) and their latency over time — the same window, source and filters as `/access/chart`.
  - `total_requests` number, nullable, required: Requests in the window — the denominator of every `share_pct`. `null` when capped: the raw read bound counts rows scanned, not rows matched.
  - `networks` AccessNetworkShare[], required: Top 10 networks by requests, highest first; empty when capped.
    - `network` string, required: Chain-qualified network; `""` when the request carried none.
    - `chain` string, required
    - `requests` number, required
    - `share_pct` number, required: Percentage of `total_requests` in the same response; `0` when that is 0.
  - `networks_other` AccessOtherShare, required: Every network, status code, method or IP beyond the listed ones, summed.
    - `requests` number, required
    - `share_pct` number, required
  - `statuses` AccessStatusShare[], required: Top 20 status codes by requests, highest first, ties by ascending code; empty when capped. Also the code list for a status-code filter picker.
    - `status_code` number, required: HTTP response status code. `0` means Envoy aborted before a response.
    - `requests` number, required
    - `share_pct` number, required: Percentage of `total_requests` in the same response; `0` when that is 0.
  - `statuses_other` AccessOtherShare, required: Every network, status code, method or IP beyond the listed ones, summed.
    - `requests` number, required
    - `share_pct` number, required
  - `methods` AccessMethodShare[], required: Top 10 HTTP methods by requests, highest first, ties by name; empty when capped.
    - `method` string, required: HTTP request method; `""` when the request carried none.
    - `requests` number, required
    - `share_pct` number, required: Percentage of `total_requests` in the same response; `0` when that is 0.
  - `methods_other` AccessOtherShare, required: Every network, status code, method or IP beyond the listed ones, summed.
    - `requests` number, required
    - `share_pct` number, required
  - `ips` AccessIpShare[], required: Top 10 client IPs by requests, highest first, ties by address; empty when capped. A row's address is the value `filter[remote_ip][in]` takes.
    - `remote_ip` string, required: Client IP as seen by the edge, IPv4 or canonical IPv6; `""` when the request carried none.
    - `requests` number, required
    - `share_pct` number, required: Percentage of `total_requests` in the same response; `0` when that is 0.
    - `error_rate_pct` number, required: Percentage of this IP's requests answered 4xx or 5xx.
    - `egress_bytes` number, required: Response bytes sent to this IP.
  - `ips_other` AccessOtherShare, required: Every network, status code, method or IP beyond the listed ones, summed.
    - `requests` number, required
    - `share_pct` number, required
  - `sources` AccessSourceShare[], required: Every source, ranked by requests; empty when capped.
    - `source` string, required: The ingestion slug as stored; `""` when unattributed.
    - `requests` number, required
    - `share_pct` number, required: Percentage of `total_requests`, which comes from a separate read; on a live window the sources' shares can sum to slightly more or less than 100.
    - `sparkline` AccessCountPoint[], required: Requests per point of the grid `sources_step_ms` describes.
      - `timestamp` string, required: Start of the point, ISO-8601 UTC.
      - `value` number, required
  - `sources_step_ms` number, required: Width of each source sparkline point: the KPI sparklines' grid of at most 30 points from the window start, a whole multiple of the chart's `bucket_ms`. Set also when capped.
  - `latency` AccessLatencySeries, required: The breakdown's latency series: one point per chart bucket, each `step_ms` wide, counted from the window start. `step_ms` equals the chart's `bucket_ms`, and the points carry the same percentiles as the chart buckets' `latency_*_ms`.
    - `step_ms` number, required
    - `points` AccessLatencyGridPoint[], required
      - `timestamp` string, required: Start of the point, ISO-8601 UTC.
      - `p50_ms` number, nullable, required
      - `p90_ms` number, nullable, required
      - `p95_ms` number, nullable, required
  - `capped` boolean, required: True when the window was answered from the raw table and a read stopped at `ACCESS_RAW_ROW_CAP` rows scanned.

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/tatum/apis/logs-api.md) - [All operations](https://skmtc.dev/tatum/apis/logs-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tatum/apis/logs-api/revisions/e47603e0f75f?raw)