Retrieve Flow Logs by destination

Beta

GET

https://cdn.emnify.net/api/v1/endpoint/:endpointId/flowlogs/destination

GET

/api/v1/endpoint/:endpointId/flowlogs/destination

$ curl https://cdn.emnify.net/api/v1/endpoint/12345/flowlogs/destination \
>      -H "Authorization: Bearer <token>"

1 [
2   {
3     "destination_hostname": "api.example.com",
4     "destination_ip": "93.184.216.34",
5     "destination_port": 443,
6     "protocol": "TCP",
7     "started_on": "2026-05-11T13:42:17.000Z",
8     "completed_on": "2026-05-11T13:58:04.000Z",
9     "bytes_up": 18432,
10     "bytes_down": 245760,
11     "flow_count": 27
12   },
13   {
14     "destination_hostname": null,
15     "destination_ip": "203.0.113.45",
16     "destination_port": 53,
17     "protocol": "UDP",
18     "started_on": "2026-05-11T13:40:02.000Z",
19     "completed_on": "2026-05-11T13:55:11.000Z",
20     "bytes_up": 1840,
21     "bytes_down": 5120,
22     "flow_count": 12
23   }
24 ]

Retrieves Flow Log activity for an endpoint, grouped by destination hostname, IP address, port, and protocol.

By default, the response covers the last hour. Use started_from in the q parameter to look back up to 30 days.

Filters follow the standard q=<field>:<criteria> syntax:

Combine multiple filters on different fields with , (AND).
Combine multiple values for the same field with || (OR).

Use sort to order the results and page / per_page to paginate.

Retrieves Flow Log activity for an endpoint, grouped by destination hostname, IP address, port, and protocol. By default, the response covers the last hour. Use `started_from` in the `q` parameter to look back up to **30 days**. Filters follow the standard `q=<field>:<criteria>` syntax: - Combine multiple filters on different fields with `,` (AND). - Combine multiple values for the same field with `||` (OR). Use `sort` to order the results and `page` / `per_page` to paginate.

Authentication

AuthorizationBearer

An auth_token should be provided to authenticate a session.

To obtain an auth_token, see the /api/v1/authenticate POST request.

Path parameters

endpointIddoubleRequired

Query parameters

per_pageintegerOptional1-100Defaults to 25

Number of destination groups to return per page.

pageintegerOptional>=1Defaults to 1

Page number to retrieve. Starts at 1.

sortstringOptional

format: "(^-?(destination_hostname|
destination_ip|
destination_port|
protocol|
started_on|
completed_on|
bytes_up|
bytes_down)),?"

Defaults to -started_on

Sorts destination groups by field value. Use <operator><field> format. Operators: - descending, + ascending.

You can also combine multiple sort fields with commas (for example, -started_on,destination_hostname).

Sorts destination groups by field value. Use `<operator><field>` format. Operators: `-` descending, `+` ascending. <Tip> You can also combine multiple sort fields with commas (for example, `-started_on,destination_hostname`). </Tip>

qstringOptional

format: "(destination_hostname|
destination_ip|
destination_port|
protocol|
started_from|
started_until|
completed_from|
completed_until):.+"

Filters destination groups by field value. Use <field>:<criteria> format.

Combine multiple filters with commas (for example, protocol:TCP,destination_hostname:api.example.com). Use || within one field for multiple values (for example, protocol:TCP||UDP).

Time window (optional, each as <field>:<ISO-8601 UTC>):

started_from - Lower bound on flow start
- Defaults to 1 hour ago
- Maximum look-back 30 days.
started_until - Upper bound on flow start
- Defaults to now.
completed_from / completed_until - Bounds on flow completion time.

Window fields must use : only (no other operators).

Filters destination groups by field value. Use `<field>:<criteria>` format. Combine multiple filters with commas (for example, `protocol:TCP,destination_hostname:api.example.com`). Use `||` within one field for multiple values (for example, `protocol:TCP||UDP`). Time window (optional, each as `<field>:<ISO-8601 UTC>`): - `started_from` - Lower bound on flow start - Defaults to 1 hour ago - Maximum look-back 30 days. - `started_until` - Upper bound on flow start - Defaults to now. - `completed_from` / `completed_until` - Bounds on flow completion time. <Warning> Window fields must use `:` only (no other operators). </Warning>

Response headers

X-SortstringOptional

Applied sort field from the sort parameter.

X-FilterstringOptional

Applied filter criteria from the q parameter.

x-current-pageinteger

Current page number.

x-count-per-pageinteger

Number of destination groups per page.

x-total-pagesinteger

Total number of pages.

x-total-countinteger

Total number of destination groups matching the query.

Response

Destination groups for the requested window.

destination_hostnamestring or nullOptional

Hostname of the destination, if resolved.

destination_ipstringOptional

IP address of the destination.

destination_portintegerOptional

Destination port number.

protocolstringOptional

Transport protocol (for example, TCP, UDP).

started_onstringOptionalformat: "date-time"

Earliest start time across the aggregated flows.

completed_onstringOptionalformat: "date-time"

Latest completion time across the aggregated flows.

bytes_upintegerOptional

Total bytes uploaded to the destination.

bytes_downintegerOptional

Total bytes downloaded from the destination.

flow_countintegerOptional

Number of flows aggregated into this destination group.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error