Sign in

v1

latestOpenAPI 3.0.42026-07-26263457588.1 KB
Logging v2

Query CDN access logs for a pull zone.

Authenticate with either an Authorization bearer JWT or an AccessKey header. Filter pushdown happens in ClickHouse where possible; country and free-text search are applied in-process after fetch.

get/v2/pullzones/{pullZoneId}/logs

Path parameters

pullZoneIdinteger required

Query parameters

fromstring date-time

Inclusive start of the time range (UTC). Defaults to To - 24h. Must fall within the 3-day log retention window. The total range (To - From) cannot exceed 3 days.

tostring date-time

Exclusive end of the time range (UTC). Defaults to now.

statusstring

Comma-separated list of HTTP status filters. Each entry can be an exact code (e.g. 200, 404) or a status class (e.g. 2xx, 5xx). Multiple entries are combined with OR.

cacheStatusstring

Comma-separated list of cache statuses to match exactly (e.g. HIT,MISS,EXPIRED).

countrystring

ISO 3166 alpha-2 country code (e.g. EE). Multiple values can be comma-separated.

edgeLocationstring

Edge location / server zone (exact match).

remoteIpstring

Client IP address filter (IPv4 or IPv6). The match width adapts to the zone's IP anonymization setting so the filter can never reveal information beyond what the API returns: exact match when anonymization is disabled, /24 (IPv4) or /64 (IPv6) when last-octet anonymization is enabled, and ignored when full anonymization is enabled.

urlContainsstring

Case-insensitive substring match against the request URL (host + path).

userAgentContainsstring

Case-insensitive substring match against the User-Agent header.

refererContainsstring

Case-insensitive substring match against the Referer header.

searchstring

Free-text, case-insensitive token search. Tokens are space-separated; a row matches if ANY token appears in ANY of the searched columns: cache status, request ID, edge location, host, path, user agent, referer, and (for zones with extended logging) content range. Remote IP, country code, and the authorization header are not searched. use the dedicated filters for those, or note that the authorization header is encrypted at rest. Limited to 16 tokens of at most 128 characters each.

requestIdstring

Exact request ID (UUID) to look up a single log entry.

includeOriginShieldboolean

Include origin-shield (edge → shield) requests. Defaults to false to match v1.

limitinteger

Maximum entries to return. Defaults to 100. Capped at 10000.

offsetinteger

Number of entries to skip. Defaults to 0.

orderstring

Sort order by timestamp: asc or desc (default).

Response

Successful query with paginated results.

Example response

{
  "data": [
    {
      "logId": "a6a6b755-b6a4-46be-b523-aa82a17d4bc5",
      "timestamp": 1728952065848,
      "log": "{\"RequestUrl\":\"/apikey\",\"PullZoneId\":308006,\"Message\":\"Origin DNS lookup failed...\",\"ErrorCode\":\"dns_lookup\",\"StatusCode\":502}",
      "labels": {
        "ErrorCode": "dns_lookup",
        "StatusCode": "502",
        "ServerZone": "CA"
      }
    }
  ]
}