---
title: "List network health insights"
method: GET
path: "/api/v2/network-health-insights"
tags: ["Network Health Insights"]
---

# List network health insights

`GET /api/v2/network-health-insights`

Return network health insights for the organization within the given time window.
Insights are produced by analyzing DNS failures pre-classified by `network-dns-logger`,
TLS certificate metrics, and denied security group connections. Each insight
identifies the client and server services involved, the type of issue, and the
magnitude of the failure observed during the query window.

## Query parameters

- `from` string
- `to` string

## Response `200`

OK

- NetworkHealthInsightsResponse — Response containing a list of network health insights for the organization.
  - `data` NetworkHealthInsight[], required — Array of network health insights returned for the query window.
    - `attributes` NetworkHealthInsightAttributes, required — Detailed attributes of a network health insight.
      - `account_id` string — AWS account identifier where the certificate is located. Only set for `tls-cert` insights.
      - `certificate_id` string — ARN or identifier of the certificate. Only set for `tls-cert` insights.
      - `certificate_lifetime_percent` number, double — Percentage of the certificate's validity period that has elapsed, ranging from 0 to 100. Only set for `tls-cert` insights.
      - `client_region` string — AWS region where the client is located. Only set for `tls-cert` insights.
      - `client_service` string — Name of the service making the request (DNS query or TLS-secured connection). Set to `N/A` when the client service cannot be determined.
      - `days_until_expiration` integer — Number of days remaining until the certificate expires. Negative values indicate the certificate has already expired. Only set for `tls-cert` insights.
      - `dns_query` string — Domain name that was being resolved when the DNS failure occurred. Only set for `dns` insights.
      - `dns_server` string — DNS server that received the failing query. Only set for `dns` insights.
      - `domain_name` string — Domain name covered by the certificate. Only set for `tls-cert` insights.
      - `failure_magnitude` integer — Count of failed events observed during the query window. Only set for `dns`, `tcp`, and `security-group` insights.
      - `failure_rate` number, double — Percentage of requests that failed during the query window, ranging from 0 to 100. Only set for `dns`, `tcp`, and `security-group` insights.
      - `failure_type` 'timeout' | 'nxdomain' | 'servfail' | 'general_failure' | 'expired' | 'expiring_soon' | 'denied' — Specific failure type within the insight category. For DNS insights: `timeout`, `nxdomain`, `servfail`, or `general_failure`. For TLS certificate insights: `expired` or `expiring_soon`. For security group insights: `denied`.
      - `loadbalancer_id` string — ARN of the load balancer using the certificate. Only set for `tls-cert` insights.
      - `server_region` string — AWS region where the server or load balancer is located. Only set for `tls-cert` insights.
      - `server_service` string — Name of the target service the client was trying to reach.
      - `total_requests` integer — Total number of requests observed during the query window. Provides context for `failure_magnitude` and `failure_rate`. Only set for `dns`, `tcp`, and `security-group` insights.
      - `traffic_volume` NetworkHealthInsightTrafficVolume — Network traffic volume metrics between the client and server services during the query window.
        - `bytes_read` integer — Total bytes read from the server to the client during the query window.
        - `bytes_written` integer — Total bytes written from the client to the server during the query window.
        - `total_traffic` integer — Sum of bytes written and bytes read across the query window.
      - `type` 'dns' | 'tcp' | 'tls-cert' | 'security-group' — Category of network health insight. Indicates whether the insight relates to a DNS issue (`dns`), a TCP issue (`tcp`), a TLS certificate issue (`tls-cert`), or a security group denial (`security-group`).
    - `id` string, required — Unique identifier for this network health insight.
    - `type` 'network-health-insights', required — The resource type for network health insights. Always `network-health-insights`.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `429` — Too many requests
- `500` — Internal Server Error

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)