# DNS

## Get DNS summary by dimension

**get** `/radar/dns/summary/{dimension}`

Retrieves the distribution of DNS queries by the specified dimension.

### Path Parameters

- `dimension: "AS" or "CACHE_HIT" or "DNSSEC" or 11 more`

  Specifies the attribute by which to group the results. Grouping by `TLD_DNS_MAGNITUDE` does not support sub-daily aggregation intervals; `15m` and `1h` are raised to `1d`.

  - `"AS"`

  - `"CACHE_HIT"`

  - `"DNSSEC"`

  - `"DNSSEC_AWARE"`

  - `"DNSSEC_E2E"`

  - `"IP_VERSION"`

  - `"LOCATION"`

  - `"MATCHING_ANSWER"`

  - `"PROTOCOL"`

  - `"QUERY_TYPE"`

  - `"RESPONSE_CODE"`

  - `"RESPONSE_TTL"`

  - `"TLD"`

  - `"TLD_DNS_MAGNITUDE"`

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `cacheHit: optional array of boolean`

  Filters results based on cache status.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"`

  Filters results based on DNSSEC (DNS Security Extensions) support.

  - `"INVALID"`

  - `"INSECURE"`

  - `"SECURE"`

  - `"OTHER"`

- `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"`

  Filters results based on DNSSEC (DNS Security Extensions) client awareness.

  - `"SUPPORTED"`

  - `"NOT_SUPPORTED"`

- `dnssecE2e: optional array of boolean`

  Filters results based on DNSSEC-validated answers by end-to-end security status.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `ipVersion: optional array of "IPv4" or "IPv6"`

  Filters results by IP version (Ipv4 vs. IPv6).

  - `"IPv4"`

  - `"IPv6"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `matchingAnswer: optional array of boolean`

  Filters results based on whether the queries have a matching answer.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more`

  Filters results by DNS response TTL.

  - `"LTE_1M"`

  - `"GT_1M_LTE_5M"`

  - `"GT_5M_LTE_15M"`

  - `"GT_15M_LTE_1H"`

  - `"GT_1H_LTE_1D"`

  - `"GT_1D_LTE_1W"`

  - `"GT_1W"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/$DIMENSION \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "IPv4": "50.168733",
      "IPv6": "25.084366"
    }
  },
  "success": true
}
```

## Get DNS queries time series

**get** `/radar/dns/timeseries`

Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `cacheHit: optional array of boolean`

  Filters results based on cache status.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"`

  Filters results based on DNSSEC (DNS Security Extensions) support.

  - `"INVALID"`

  - `"INSECURE"`

  - `"SECURE"`

  - `"OTHER"`

- `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"`

  Filters results based on DNSSEC (DNS Security Extensions) client awareness.

  - `"SUPPORTED"`

  - `"NOT_SUPPORTED"`

- `dnssecE2e: optional array of boolean`

  Filters results based on DNSSEC-validated answers by end-to-end security status.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `ipVersion: optional array of "IPv4" or "IPv6"`

  Filters results by IP version (Ipv4 vs. IPv6).

  - `"IPv4"`

  - `"IPv6"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `matchingAnswer: optional array of boolean`

  Filters results based on whether the queries have a matching answer.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more`

  Filters results by DNS response TTL.

  - `"LTE_1M"`

  - `"GT_1M_LTE_5M"`

  - `"GT_5M_LTE_15M"`

  - `"GT_15M_LTE_1H"`

  - `"GT_1H_LTE_1D"`

  - `"GT_1D_LTE_1W"`

  - `"GT_1W"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    }
  },
  "success": true
}
```

## Get DNS time series grouped by dimension

**get** `/radar/dns/timeseries_groups/{dimension}`

Retrieves the distribution of DNS queries grouped by dimension over time.

### Path Parameters

- `dimension: "AS" or "CACHE_HIT" or "DNSSEC" or 11 more`

  Specifies the attribute by which to group the results. Grouping by `TLD_DNS_MAGNITUDE` does not support sub-daily aggregation intervals; `15m` and `1h` are raised to `1d`.

  - `"AS"`

  - `"CACHE_HIT"`

  - `"DNSSEC"`

  - `"DNSSEC_AWARE"`

  - `"DNSSEC_E2E"`

  - `"IP_VERSION"`

  - `"LOCATION"`

  - `"MATCHING_ANSWER"`

  - `"PROTOCOL"`

  - `"QUERY_TYPE"`

  - `"RESPONSE_CODE"`

  - `"RESPONSE_TTL"`

  - `"TLD"`

  - `"TLD_DNS_MAGNITUDE"`

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `cacheHit: optional array of boolean`

  Filters results based on cache status.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"`

  Filters results based on DNSSEC (DNS Security Extensions) support.

  - `"INVALID"`

  - `"INSECURE"`

  - `"SECURE"`

  - `"OTHER"`

- `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"`

  Filters results based on DNSSEC (DNS Security Extensions) client awareness.

  - `"SUPPORTED"`

  - `"NOT_SUPPORTED"`

- `dnssecE2e: optional array of boolean`

  Filters results based on DNSSEC-validated answers by end-to-end security status.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `ipVersion: optional array of "IPv4" or "IPv6"`

  Filters results by IP version (Ipv4 vs. IPv6).

  - `"IPv4"`

  - `"IPv6"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `matchingAnswer: optional array of boolean`

  Filters results based on whether the queries have a matching answer.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `normalization: optional "PERCENTAGE" or "MIN0_MAX" or "RANK"`

  Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/). `RANK` is only meaningful with the `TLD_DNS_MAGNITUDE` dimension, where it ranks TLDs by DNS query magnitude at each timestamp; for other dimensions it has no effect.

  - `"PERCENTAGE"`

  - `"MIN0_MAX"`

  - `"RANK"`

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more`

  Filters results by DNS response TTL.

  - `"LTE_1M"`

  - `"GT_1M_LTE_5M"`

  - `"GT_5M_LTE_15M"`

  - `"GT_15M_LTE_1H"`

  - `"GT_1H_LTE_1D"`

  - `"GT_1D_LTE_1W"`

  - `"GT_1W"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/$DIMENSION \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}
```

## Domain Types

### DNS Summary V2 Response

- `DNSSummaryV2Response object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

### DNS Timeseries Response

- `DNSTimeseriesResponse object { meta }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

### DNS Timeseries Groups V2 Response

- `DNSTimeseriesGroupsV2Response object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

# Top

## Get top ASes by DNS queries

**get** `/radar/dns/top/ases`

Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `cacheHit: optional array of boolean`

  Filters results based on cache status.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"`

  Filters results based on DNSSEC (DNS Security Extensions) support.

  - `"INVALID"`

  - `"INSECURE"`

  - `"SECURE"`

  - `"OTHER"`

- `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"`

  Filters results based on DNSSEC (DNS Security Extensions) client awareness.

  - `"SUPPORTED"`

  - `"NOT_SUPPORTED"`

- `dnssecE2e: optional array of boolean`

  Filters results based on DNSSEC-validated answers by end-to-end security status.

- `domain: optional array of string`

  Filters results by domain name. When set, no other DNS filter may be used — only date filtering (`dateRange`, or `dateStart`/`dateEnd`) is allowed — and the date range cannot exceed 31 days.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `ipVersion: optional array of "IPv4" or "IPv6"`

  Filters results by IP version (Ipv4 vs. IPv6).

  - `"IPv4"`

  - `"IPv6"`

- `limit: optional number`

  Limits the number of objects returned in the response.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `matchingAnswer: optional array of boolean`

  Filters results based on whether the queries have a matching answer.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more`

  Filters results by DNS response TTL.

  - `"LTE_1M"`

  - `"GT_1M_LTE_5M"`

  - `"GT_5M_LTE_15M"`

  - `"GT_15M_LTE_1H"`

  - `"GT_1H_LTE_1D"`

  - `"GT_1D_LTE_1W"`

  - `"GT_1W"`

### Returns

- `result: object { meta, top_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `top_0: array of object { clientASN, clientASName, value }`

    - `clientASN: number`

    - `clientASName: string`

    - `value: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/top/ases \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "top_0": [
      {
        "clientASN": 3243,
        "clientASName": "MEO",
        "value": "10"
      }
    ]
  },
  "success": true
}
```

## Get top locations by DNS queries

**get** `/radar/dns/top/locations`

Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `cacheHit: optional array of boolean`

  Filters results based on cache status.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dnssec: optional array of "INVALID" or "INSECURE" or "SECURE" or "OTHER"`

  Filters results based on DNSSEC (DNS Security Extensions) support.

  - `"INVALID"`

  - `"INSECURE"`

  - `"SECURE"`

  - `"OTHER"`

- `dnssecAware: optional array of "SUPPORTED" or "NOT_SUPPORTED"`

  Filters results based on DNSSEC (DNS Security Extensions) client awareness.

  - `"SUPPORTED"`

  - `"NOT_SUPPORTED"`

- `dnssecE2e: optional array of boolean`

  Filters results based on DNSSEC-validated answers by end-to-end security status.

- `domain: optional array of string`

  Filters results by domain name. When set, no other DNS filter may be used — only date filtering (`dateRange`, or `dateStart`/`dateEnd`) is allowed — and the date range cannot exceed 31 days.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `ipVersion: optional array of "IPv4" or "IPv6"`

  Filters results by IP version (Ipv4 vs. IPv6).

  - `"IPv4"`

  - `"IPv6"`

- `limit: optional number`

  Limits the number of objects returned in the response.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `matchingAnswer: optional array of boolean`

  Filters results based on whether the queries have a matching answer.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `responseTtl: optional array of "LTE_1M" or "GT_1M_LTE_5M" or "GT_5M_LTE_15M" or 4 more`

  Filters results by DNS response TTL.

  - `"LTE_1M"`

  - `"GT_1M_LTE_5M"`

  - `"GT_5M_LTE_15M"`

  - `"GT_15M_LTE_1H"`

  - `"GT_1H_LTE_1D"`

  - `"GT_1D_LTE_1W"`

  - `"GT_1W"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, top_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }`

    - `clientCountryAlpha2: string`

    - `clientCountryName: string`

    - `value: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/top/locations \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "top_0": [
      {
        "clientCountryAlpha2": "PT",
        "clientCountryName": "Portugal",
        "value": "10"
      }
    ]
  },
  "success": true
}
```

## Domain Types

### Top Ases Response

- `TopAsesResponse object { meta, top_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `top_0: array of object { clientASN, clientASName, value }`

    - `clientASN: number`

    - `clientASName: string`

    - `value: string`

      A numeric string.

### Top Locations Response

- `TopLocationsResponse object { meta, top_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `top_0: array of object { clientCountryAlpha2, clientCountryName, value }`

    - `clientCountryAlpha2: string`

    - `clientCountryName: string`

    - `value: string`

      A numeric string.

# Summary

## Get DNS queries by cache status summary

**get** `/radar/dns/summary/cache_hit`

Retrieves the distribution of DNS queries by cache status.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/cache_hit \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "NEGATIVE": "10",
      "POSITIVE": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC support summary

**get** `/radar/dns/summary/dnssec`

Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { INSECURE, INVALID, OTHER, SECURE }`

    - `INSECURE: string`

      A numeric string.

    - `INVALID: string`

      A numeric string.

    - `OTHER: string`

      A numeric string.

    - `SECURE: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "INSECURE": "10",
      "INVALID": "10",
      "OTHER": "10",
      "SECURE": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC awareness summary

**get** `/radar/dns/summary/dnssec_aware`

Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NOT_SUPPORTED, SUPPORTED }`

    - `NOT_SUPPORTED: string`

      A numeric string.

    - `SUPPORTED: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec_aware \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "NOT_SUPPORTED": "10",
      "SUPPORTED": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC end-to-end summary

**get** `/radar/dns/summary/dnssec_e2e`

Retrieves the distribution of DNSSEC-validated answers by end-to-end security status.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/dnssec_e2e \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "NEGATIVE": "10",
      "POSITIVE": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by IP version summary

**get** `/radar/dns/summary/ip_version`

Retrieves the distribution of DNS queries by IP version.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { IPv4, IPv6 }`

    - `IPv4: string`

      A numeric string.

    - `IPv6: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/ip_version \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "IPv4": "10",
      "IPv6": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by matching answer summary

**get** `/radar/dns/summary/matching_answer`

Retrieves the distribution of DNS queries by matching answers.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/matching_answer \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "NEGATIVE": "10",
      "POSITIVE": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by protocol summary

**get** `/radar/dns/summary/protocol`

Retrieves the distribution of DNS queries by DNS transport protocol.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { HTTPS, TCP, TLS, UDP }`

    - `HTTPS: string`

      A numeric string.

    - `TCP: string`

      A numeric string.

    - `TLS: string`

      A numeric string.

    - `UDP: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/protocol \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "HTTPS": "10",
      "TCP": "10",
      "TLS": "10",
      "UDP": "10"
    }
  },
  "success": true
}
```

## Get DNS queries by type summary

**get** `/radar/dns/summary/query_type`

Retrieves the distribution of DNS queries by type.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/query_type \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "A": "20",
      "AAAA": "20",
      "HTTPS": "20",
      "NS": "20",
      "PTR": "20"
    }
  },
  "success": true
}
```

## Get DNS queries by response code summary

**get** `/radar/dns/summary/response_code`

Retrieves the distribution of DNS queries by response code.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/response_code \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "NOERROR": "70",
      "NOTIMP": "5",
      "NXDOMAIN": "10",
      "REFUSED": "5",
      "SERVFAIL": "5"
    }
  },
  "success": true
}
```

## Get DNS queries by response TTL summary

**get** `/radar/dns/summary/response_ttl`

Retrieves the distribution of DNS queries by minimum response TTL.

### Query Parameters

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }`

    - `gt_15m_lte_1h: string`

      A numeric string.

    - `gt_1d_lte_1w: string`

      A numeric string.

    - `gt_1h_lte_1d: string`

      A numeric string.

    - `gt_1m_lte_5m: string`

      A numeric string.

    - `gt_1w: string`

      A numeric string.

    - `gt_5m_lte_15m: string`

      A numeric string.

    - `lte_1m: string`

      A numeric string.

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/summary/response_ttl \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "summary_0": {
      "gt_15m_lte_1h": "10",
      "gt_1d_lte_1w": "10",
      "gt_1h_lte_1d": "10",
      "gt_1m_lte_5m": "10",
      "gt_1w": "10",
      "gt_5m_lte_15m": "10",
      "lte_1m": "10"
    }
  },
  "success": true
}
```

## Domain Types

### Summary Cache Hit Response

- `SummaryCacheHitResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

### Summary DNSSEC Response

- `SummaryDNSSECResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { INSECURE, INVALID, OTHER, SECURE }`

    - `INSECURE: string`

      A numeric string.

    - `INVALID: string`

      A numeric string.

    - `OTHER: string`

      A numeric string.

    - `SECURE: string`

      A numeric string.

### Summary DNSSEC Aware Response

- `SummaryDNSSECAwareResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NOT_SUPPORTED, SUPPORTED }`

    - `NOT_SUPPORTED: string`

      A numeric string.

    - `SUPPORTED: string`

      A numeric string.

### Summary DNSSEC E2E Response

- `SummaryDNSSECE2EResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

### Summary IP Version Response

- `SummaryIPVersionResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { IPv4, IPv6 }`

    - `IPv4: string`

      A numeric string.

    - `IPv6: string`

      A numeric string.

### Summary Matching Answer Response

- `SummaryMatchingAnswerResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: string`

      A numeric string.

    - `POSITIVE: string`

      A numeric string.

### Summary Protocol Response

- `SummaryProtocolResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { HTTPS, TCP, TLS, UDP }`

    - `HTTPS: string`

      A numeric string.

    - `TCP: string`

      A numeric string.

    - `TLS: string`

      A numeric string.

    - `UDP: string`

      A numeric string.

### Summary Query Type Response

- `SummaryQueryTypeResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

### Summary Response Code Response

- `SummaryResponseCodeResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: map[string]`

### Summary Response TTL Response

- `SummaryResponseTTLResponse object { meta, summary_0 }`

  - `meta: object { confidenceInfo, dateRange, lastUpdated, 2 more }`

    Metadata for the results.

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `summary_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }`

    - `gt_15m_lte_1h: string`

      A numeric string.

    - `gt_1d_lte_1w: string`

      A numeric string.

    - `gt_1h_lte_1d: string`

      A numeric string.

    - `gt_1m_lte_5m: string`

      A numeric string.

    - `gt_1w: string`

      A numeric string.

    - `gt_5m_lte_15m: string`

      A numeric string.

    - `lte_1m: string`

      A numeric string.

# Timeseries Groups

## Get DNS queries by cache status time series

**get** `/radar/dns/timeseries_groups/cache_hit`

Retrieves the distribution of DNS queries by cache status over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/cache_hit \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "NEGATIVE": [
        "10"
      ],
      "POSITIVE": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC support time series

**get** `/radar/dns/timeseries_groups/dnssec`

Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { INSECURE, INVALID, OTHER, SECURE }`

    - `INSECURE: array of string`

    - `INVALID: array of string`

    - `OTHER: array of string`

    - `SECURE: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "INSECURE": [
        "10"
      ],
      "INVALID": [
        "10"
      ],
      "OTHER": [
        "10"
      ],
      "SECURE": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC awareness time series

**get** `/radar/dns/timeseries_groups/dnssec_aware`

Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NOT_SUPPORTED, SUPPORTED }`

    - `NOT_SUPPORTED: array of string`

    - `SUPPORTED: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec_aware \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "NOT_SUPPORTED": [
        "10"
      ],
      "SUPPORTED": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by DNSSEC end-to-end time series

**get** `/radar/dns/timeseries_groups/dnssec_e2e`

Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/dnssec_e2e \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "NEGATIVE": [
        "10"
      ],
      "POSITIVE": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by IP version time series

**get** `/radar/dns/timeseries_groups/ip_version`

Retrieves the distribution of DNS queries by IP version over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { IPv4, IPv6 }`

    - `IPv4: array of string`

    - `IPv6: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/ip_version \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "IPv4": [
        "10"
      ],
      "IPv6": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by matching answer time series

**get** `/radar/dns/timeseries_groups/matching_answer`

Retrieves the distribution of DNS queries by matching answers over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/matching_answer \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "NEGATIVE": [
        "10"
      ],
      "POSITIVE": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by protocol time series

**get** `/radar/dns/timeseries_groups/protocol`

Retrieves the distribution of DNS queries by DNS transport protocol over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { HTTPS, TCP, TLS, UDP }`

    - `HTTPS: array of string`

    - `TCP: array of string`

    - `TLS: array of string`

    - `UDP: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/protocol \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "HTTPS": [
        "10"
      ],
      "TCP": [
        "10"
      ],
      "TLS": [
        "10"
      ],
      "UDP": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by type time series

**get** `/radar/dns/timeseries_groups/query_type`

Retrieves the distribution of DNS queries by type over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/query_type \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by response code time series

**get** `/radar/dns/timeseries_groups/response_code`

Retrieves the distribution of DNS queries by response code over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `limitPerGroup: optional number`

  Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an "other" category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2.

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/response_code \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "timestamps": [
        "2023-08-08T10:15:00Z"
      ]
    }
  },
  "success": true
}
```

## Get DNS queries by response TTL time series

**get** `/radar/dns/timeseries_groups/response_ttl`

Retrieves the distribution of DNS queries by minimum answer TTL over time.

### Query Parameters

- `aggInterval: optional "15m" or "1h" or "1d" or "1w"`

  Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/). When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

  - `"15m"`

  - `"1h"`

  - `"1d"`

  - `"1w"`

- `asn: optional array of string`

  Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from results. For example, `-174, 3356` excludes results from AS174, but includes results from AS3356.

- `continent: optional array of string`

  Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude continents from results. For example, `-EU,NA` excludes results from EU, but includes results from NA.

- `dateEnd: optional array of string`

  End of the date range (inclusive). Alternative to `dateRange`; provide together with `dateStart`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `dateRange: optional array of string`

  Filters results by relative date range ending at the current time, with each value producing a separate series. Use `<n>d` for days (up to `364d`) or `<n>w` for weeks (up to `52w`). Append `control` to request the equivalent previous period for comparison: the comparison window is shifted back by the current window's length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. `7dcontrol` covers days -14 to -7, `10dcontrol` covers days -24 to -14). For example, pass `7d` and `7dcontrol` to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including `control`) satisfy this automatically. Use this parameter or set specific start and end dates (`dateStart` and `dateEnd` parameters).

- `dateStart: optional array of string`

  Start of the date range. Alternative to `dateRange`; provide together with `dateEnd`. When requesting comparison series, every series must resolve to the same duration as the main series. Each `dateStart`/`dateEnd` is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected.

- `format: optional "JSON" or "CSV"`

  Format in which results will be returned.

  - `"JSON"`

  - `"CSV"`

- `location: optional array of string`

  Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with `-` to exclude locations from results. For example, `-US,PT` excludes results from the US, but includes results from PT.

- `name: optional array of string`

  Array of names used to label the series in the response.

- `nodata: optional array of boolean`

  Specifies whether the response includes empty DNS responses (NODATA).

- `protocol: optional array of "UDP" or "TCP" or "HTTPS" or "TLS"`

  Filters results by DNS transport protocol.

  - `"UDP"`

  - `"TCP"`

  - `"HTTPS"`

  - `"TLS"`

- `queryType: optional array of "A" or "AAAA" or "A6" or 85 more`

  Filters results by DNS query type.

  - `"A"`

  - `"AAAA"`

  - `"A6"`

  - `"AFSDB"`

  - `"ANY"`

  - `"APL"`

  - `"ATMA"`

  - `"AXFR"`

  - `"CAA"`

  - `"CDNSKEY"`

  - `"CDS"`

  - `"CERT"`

  - `"CNAME"`

  - `"CSYNC"`

  - `"DHCID"`

  - `"DLV"`

  - `"DNAME"`

  - `"DNSKEY"`

  - `"DOA"`

  - `"DS"`

  - `"EID"`

  - `"EUI48"`

  - `"EUI64"`

  - `"GPOS"`

  - `"GID"`

  - `"HINFO"`

  - `"HIP"`

  - `"HTTPS"`

  - `"IPSECKEY"`

  - `"ISDN"`

  - `"IXFR"`

  - `"KEY"`

  - `"KX"`

  - `"L32"`

  - `"L64"`

  - `"LOC"`

  - `"LP"`

  - `"MAILA"`

  - `"MAILB"`

  - `"MB"`

  - `"MD"`

  - `"MF"`

  - `"MG"`

  - `"MINFO"`

  - `"MR"`

  - `"MX"`

  - `"NAPTR"`

  - `"NB"`

  - `"NBSTAT"`

  - `"NID"`

  - `"NIMLOC"`

  - `"NINFO"`

  - `"NS"`

  - `"NSAP"`

  - `"NSEC"`

  - `"NSEC3"`

  - `"NSEC3PARAM"`

  - `"NULL"`

  - `"NXT"`

  - `"OPENPGPKEY"`

  - `"OPT"`

  - `"PTR"`

  - `"PX"`

  - `"RKEY"`

  - `"RP"`

  - `"RRSIG"`

  - `"RT"`

  - `"SIG"`

  - `"SINK"`

  - `"SMIMEA"`

  - `"SOA"`

  - `"SPF"`

  - `"SRV"`

  - `"SSHFP"`

  - `"SVCB"`

  - `"TA"`

  - `"TALINK"`

  - `"TKEY"`

  - `"TLSA"`

  - `"TSIG"`

  - `"TXT"`

  - `"UINFO"`

  - `"UID"`

  - `"UNSPEC"`

  - `"URI"`

  - `"WKS"`

  - `"X25"`

  - `"ZONEMD"`

- `responseCode: optional array of "NOERROR" or "FORMERR" or "SERVFAIL" or 16 more`

  Filters results by DNS response code.

  - `"NOERROR"`

  - `"FORMERR"`

  - `"SERVFAIL"`

  - `"NXDOMAIN"`

  - `"NOTIMP"`

  - `"REFUSED"`

  - `"YXDOMAIN"`

  - `"YXRRSET"`

  - `"NXRRSET"`

  - `"NOTAUTH"`

  - `"NOTZONE"`

  - `"BADSIG"`

  - `"BADKEY"`

  - `"BADTIME"`

  - `"BADMODE"`

  - `"BADNAME"`

  - `"BADALG"`

  - `"BADTRUNC"`

  - `"BADCOOKIE"`

- `tld: optional array of string`

  Filters results by top-level domain. Incompatible with the `ipVersion`, `protocol`, `dnssecE2e`, `dnssecAware`, `responseTtl`, and `cacheHit` filters/dimensions; this restriction does not apply to country-code TLDs (2-letter, e.g. `uk`).

### Returns

- `result: object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }`

    - `gt_15m_lte_1h: array of string`

    - `gt_1d_lte_1w: array of string`

    - `gt_1h_lte_1d: array of string`

    - `gt_1m_lte_5m: array of string`

    - `gt_1w: array of string`

    - `gt_5m_lte_15m: array of string`

    - `lte_1m: array of string`

- `success: boolean`

### Example

```http
curl https://api.cloudflare.com/client/v4/radar/dns/timeseries_groups/response_ttl \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

#### Response

```json
{
  "result": {
    "meta": {
      "aggInterval": "FIFTEEN_MINUTES",
      "confidenceInfo": {
        "annotations": [
          {
            "dataSource": "ALL",
            "description": "Cable cut in Tonga",
            "endDate": "2019-12-27T18:11:19.117Z",
            "eventType": "EVENT",
            "isInstantaneous": true,
            "linkedUrl": "https://example.com",
            "startDate": "2019-12-27T18:11:19.117Z",
            "tags": [
              "BOT_CLASS"
            ]
          }
        ],
        "level": 0
      },
      "dateRange": [
        {
          "endTime": "2022-09-17T10:22:57.555Z",
          "startTime": "2022-09-16T10:22:57.555Z"
        }
      ],
      "lastUpdated": "2019-12-27T18:11:19.117Z",
      "normalization": "PERCENTAGE",
      "units": [
        {
          "name": "*",
          "value": "requests"
        }
      ]
    },
    "serie_0": {
      "gt_15m_lte_1h": [
        "10"
      ],
      "gt_1d_lte_1w": [
        "10"
      ],
      "gt_1h_lte_1d": [
        "10"
      ],
      "gt_1m_lte_5m": [
        "10"
      ],
      "gt_1w": [
        "10"
      ],
      "gt_5m_lte_15m": [
        "10"
      ],
      "lte_1m": [
        "10"
      ]
    }
  },
  "success": true
}
```

## Domain Types

### Timeseries Group Cache Hit Response

- `TimeseriesGroupCacheHitResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

### Timeseries Group DNSSEC Response

- `TimeseriesGroupDNSSECResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { INSECURE, INVALID, OTHER, SECURE }`

    - `INSECURE: array of string`

    - `INVALID: array of string`

    - `OTHER: array of string`

    - `SECURE: array of string`

### Timeseries Group DNSSEC Aware Response

- `TimeseriesGroupDNSSECAwareResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NOT_SUPPORTED, SUPPORTED }`

    - `NOT_SUPPORTED: array of string`

    - `SUPPORTED: array of string`

### Timeseries Group DNSSEC E2E Response

- `TimeseriesGroupDNSSECE2EResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

### Timeseries Group IP Version Response

- `TimeseriesGroupIPVersionResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { IPv4, IPv6 }`

    - `IPv4: array of string`

    - `IPv6: array of string`

### Timeseries Group Matching Answer Response

- `TimeseriesGroupMatchingAnswerResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { NEGATIVE, POSITIVE }`

    - `NEGATIVE: array of string`

    - `POSITIVE: array of string`

### Timeseries Group Protocol Response

- `TimeseriesGroupProtocolResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { HTTPS, TCP, TLS, UDP }`

    - `HTTPS: array of string`

    - `TCP: array of string`

    - `TLS: array of string`

    - `UDP: array of string`

### Timeseries Group Query Type Response

- `TimeseriesGroupQueryTypeResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

### Timeseries Group Response Code Response

- `TimeseriesGroupResponseCodeResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { timestamps }`

    - `timestamps: array of string`

### Timeseries Group Response TTL Response

- `TimeseriesGroupResponseTTLResponse object { meta, serie_0 }`

  - `meta: object { aggInterval, confidenceInfo, dateRange, 3 more }`

    Metadata for the results.

    - `aggInterval: "FIFTEEN_MINUTES" or "ONE_HOUR" or "ONE_DAY" or 2 more`

      Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to [Aggregation intervals](https://edgetunnel-b2h.pages.dev/radar/concepts/aggregation-intervals/).

      - `"FIFTEEN_MINUTES"`

      - `"ONE_HOUR"`

      - `"ONE_DAY"`

      - `"ONE_WEEK"`

      - `"ONE_MONTH"`

    - `confidenceInfo: object { annotations, level }`

      - `annotations: array of object { dataSource, description, endDate, 5 more }`

        - `dataSource: "ALL" or "AI_BOTS" or "AI_GATEWAY" or 22 more`

          Data source for annotations.

          - `"ALL"`

          - `"AI_BOTS"`

          - `"AI_GATEWAY"`

          - `"BGP"`

          - `"BOTS"`

          - `"CONNECTION_ANOMALY"`

          - `"CT"`

          - `"DNS"`

          - `"DNS_MAGNITUDE"`

          - `"DNS_AS112"`

          - `"DOS"`

          - `"EMAIL_ROUTING"`

          - `"EMAIL_SECURITY"`

          - `"FW"`

          - `"FW_PG"`

          - `"HTTP"`

          - `"HTTP_CONTROL"`

          - `"HTTP_CRAWLER_REFERER"`

          - `"HTTP_ORIGINS"`

          - `"IQI"`

          - `"LEAKED_CREDENTIALS"`

          - `"NET"`

          - `"ROBOTS_TXT"`

          - `"SPEED"`

          - `"WORKERS_AI"`

        - `description: string`

        - `endDate: string`

        - `eventType: "EVENT" or "GENERAL" or "OUTAGE" or 3 more`

          Event type for annotations.

          - `"EVENT"`

          - `"GENERAL"`

          - `"OUTAGE"`

          - `"PARTIAL_PROJECTION"`

          - `"PIPELINE"`

          - `"TRAFFIC_ANOMALY"`

        - `isInstantaneous: boolean`

          Whether event is a single point in time or a time range.

        - `linkedUrl: string`

        - `startDate: string`

        - `tags: optional array of string`

      - `level: number`

        Provides an indication of how much confidence Cloudflare has in the data.

    - `dateRange: array of object { endTime, startTime }`

      - `endTime: string`

        Adjusted end of date range.

      - `startTime: string`

        Adjusted start of date range.

    - `lastUpdated: string`

      Timestamp of the last dataset update.

    - `normalization: "PERCENTAGE" or "MIN0_MAX" or "MIN_MAX" or 5 more`

      Normalization method applied to the results. Refer to [Normalization methods](https://edgetunnel-b2h.pages.dev/radar/concepts/normalization/).

      - `"PERCENTAGE"`

      - `"MIN0_MAX"`

      - `"MIN_MAX"`

      - `"RAW_VALUES"`

      - `"PERCENTAGE_CHANGE"`

      - `"ROLLING_AVERAGE"`

      - `"OVERLAPPED_PERCENTAGE"`

      - `"RATIO"`

    - `units: array of object { name, value }`

      Measurement units for the results.

      - `name: string`

      - `value: string`

  - `serie_0: object { gt_15m_lte_1h, gt_1d_lte_1w, gt_1h_lte_1d, 4 more }`

    - `gt_15m_lte_1h: array of string`

    - `gt_1d_lte_1w: array of string`

    - `gt_1h_lte_1d: array of string`

    - `gt_1m_lte_5m: array of string`

    - `gt_1w: array of string`

    - `gt_5m_lte_15m: array of string`

    - `lte_1m: array of string`