List Flow Log details

Beta

GET

https://cdn.emnify.net/api/v1/endpoint/:endpointId/flowlogs/detail

GET

/api/v1/endpoint/:endpointId/flowlogs/detail

curl https://cdn.emnify.net/api/v1/endpoint/12345/flowlogs/detail \
     -H "Authorization: Bearer <token>"

[
  {
    "flow_id": "7a3f1c9e84b2d05f6e1a8c47b9d23e60",
    "organisation_id": 100,
    "endpoint_id": 1,
    "started_on": "2026-05-11T13:42:17.000Z",
    "completed_on": "2026-05-11T13:58:04.000Z",
    "duration_seconds": 947,
    "event_type": "flow_start",
    "direction": "ingress",
    "source_ip": "10.0.0.5",
    "source_port": 51234,
    "destination_ip": "192.0.2.10",
    "destination_port": 443,
    "protocol": "TCP",
    "bytes_up": 18432,
    "bytes_down": 245760,
    "destination_hostname": "api.example.com",
    "destination_hostname_source": "TLS_SNI",
    "nat_details": {
      "public_ip": "203.0.113.4"
    },
    "pdp_context": {
      "mcc": "262",
      "mnc": "01",
      "apn": "em",
      "imsi": "262011234567890",
      "country": {
        "name": "Germany",
        "country_code": "49",
        "iso_code": "de",
        "id": 74
      },
      "operator": {
        "id": "26201",
        "name": "Telekom Deutschland"
      }
    },
    "release_details": {
      "release_side": "server",
      "release_reason": "tcp_fin"
    },
    "session_id": "pdp-9f3c1b27",
    "last_loaded_at": "2026-05-11T14:00:00.000Z"
  }
]

Endpoint.FlowLogs.Detail + List

Roles: Administrator

Returns individual (non-aggregated) Flow Log rows for a device, with pagination, filtering, and sorting. Each row includes information such as destination_ip, destination_port, protocol, bytes_up, and bytes_down, and, when available, the destination_hostname, pdp_context, country, and network.

By default, the response covers the last hour. Use started_from in the q parameter to look back up to 30 days.

Filters follow the standard q=<field>:<criteria> syntax:

Combine multiple filters on different fields with , (AND).
Combine multiple values for the same field with || (OR).

Use sort to order the results and page / per_page to paginate.

<Info icon="fa-light fa-lock" className="permission-callout"> <div className="permission-callout__header"><span className="permission-callout__title"><span className="permission-callout__label">Required permissions</span> <span className="fern-docs-badge small blue subtle rounded-full permission-callout__beta">Beta</span></span> <span className="permission-callout__learn-more">[Learn more](/developers/api-guidelines/permissions#how-permissions-work)</span></div> `Endpoint.FlowLogs.Detail` + `List` <div className="permission-callout__roles"><span className="permission-callout__roles-label">Roles:</span> <Badge intent="info">Administrator</Badge></div> </Info> Returns individual (non-aggregated) Flow Log rows for a device, with pagination, filtering, and sorting. Each row includes information such as `destination_ip`, `destination_port`, `protocol`, `bytes_up`, and `bytes_down`, and, when available, the `destination_hostname`, `pdp_context`, country, and network. By default, the response covers the last hour. Use `started_from` in the `q` parameter to look back up to **30 days**. Filters follow the standard `q=<field>:<criteria>` syntax: - Combine multiple filters on different fields with `,` (AND). - Combine multiple values for the same field with `||` (OR). Use `sort` to order the results and `page` / `per_page` to paginate.

Authentication

AuthorizationBearer

An auth_token should be provided to authenticate a session.

To obtain an auth_token, see the /api/v1/authenticate POST request.

Path parameters

endpointIddoubleRequired

Query parameters

per_pageintegerOptional1-1000Defaults to 25

Number of detail rows to return per page.

pageintegerOptional>=1Defaults to 1

Page number to retrieve. Starts at 1.

sortstringOptional

format: "(^-?(destination_hostname|
destination_ip|
destination_port|
protocol|
started_on|
completed_on|
bytes_up|
bytes_down)),?"

Defaults to -started_on

Sorts detail rows by field value. Use <operator><field> format. Operators: - descending, + ascending.

You can also combine multiple sort fields with commas (for example, -started_on,destination_hostname).

Sorts detail rows by field value. Use `<operator><field>` format. Operators: `-` descending, `+` ascending. <Tip> You can also combine multiple sort fields with commas (for example, `-started_on,destination_hostname`). </Tip>

qstringOptional

format: "(destination_hostname|
destination_ip|
destination_port|
protocol|
flow_id|
event_type|
started_from|
started_until|
completed_from|
completed_until):.+"

Filters detail rows by field value. Use <field>:<criteria> format.

Combine multiple filters with commas (for example, protocol:TCP,destination_hostname:api.example.com). Use || within one field for multiple values (for example, protocol:TCP||UDP).

Supported keys: destination_hostname, destination_ip, destination_port, protocol, flow_id, event_type.

Time window (optional, each as <field>:<ISO-8601 UTC>):

started_from - Lower bound on flow start
- Defaults to 1 hour ago
- Maximum look-back 30 days.
started_until - Upper bound on flow start
- Defaults to now.
completed_from / completed_until - Bounds on flow completion time.

Window fields must use : only (no other operators).

Filters detail rows by field value. Use `<field>:<criteria>` format. Combine multiple filters with commas (for example, `protocol:TCP,destination_hostname:api.example.com`). Use `||` within one field for multiple values (for example, `protocol:TCP||UDP`). Supported keys: `destination_hostname`, `destination_ip`, `destination_port`, `protocol`, `flow_id`, `event_type`. Time window (optional, each as `<field>:<ISO-8601 UTC>`): - `started_from` - Lower bound on flow start - Defaults to 1 hour ago - Maximum look-back 30 days. - `started_until` - Upper bound on flow start - Defaults to now. - `completed_from` / `completed_until` - Bounds on flow completion time. <Warning> Window fields must use `:` only (no other operators). </Warning>

Response headers

X-SortstringOptional

Applied sort field from the sort parameter.

X-FilterstringOptional

Applied filter criteria from the q parameter.

x-current-pageintegerOptional

Current page number.

x-count-per-pageintegerOptional

Number of detail rows per page.

x-total-pagesintegerOptional

Total number of pages.

x-total-countintegerOptional

Total number of detail rows matching the query.

Response

Detail rows for the requested filter window.

flow_idstringOptional

Unique identifier of the flow.

organisation_idintegerOptional

Identifier of the organization that owns the endpoint.

endpoint_idintegerOptional

Identifier of the endpoint the flow belongs to.

started_onstringOptionalformat: "date-time"

Start time of the flow.

completed_onstringOptionalformat: "date-time"

Completion time of the flow.

duration_secondsintegerOptional

Duration of the flow in seconds.

event_typestringOptional

Type of flow event (for example, flow_start, flow_update).

directionstringOptional

Direction of the flow (for example, ingress, egress).

source_ipstringOptional

Source IP address of the flow.

source_portintegerOptional

Source port of the flow.

destination_ipstringOptional

IP address of the destination.

destination_portintegerOptional

Destination port number.

protocolstringOptional

Transport protocol (for example, TCP, UDP).

bytes_upintegerOptional

Total bytes uploaded to the destination.

bytes_downintegerOptional

Total bytes downloaded from the destination.

destination_hostnamestring or nullOptional

Hostname of the destination, if resolved.

destination_hostname_sourcestring or nullOptional

Source used to resolve the destination hostname (for example, TLS_SNI, reverse_dns).

nat_detailsobject or nullOptional

Network address translation details, if available.

pdp_contextobject or nullOptional

PDP context information for the flow, if available.

release_detailsobject or nullOptional

Details about how the flow was released, if available.

session_idstringOptional

Identifier of the PDP session the flow belongs to.

last_loaded_atstringOptionalformat: "date-time"

Time the flow record was last loaded.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error