Export Traffic Logs
Download traffic logs as a single CSV or JSON file for ETL into external systems (Splunk, Datadog, BigQuery, S3 archive). The platform sets Content-Disposition: attachment so browsers prompt to save. The export covers a trailing time window (in days) and is capped per request — slice by day for larger archives.
Plan-gated: requires the traffic_inspector entitlement. Callers without it receive 403 Forbidden.
Query parameters
format string
json (default) or csv.days int
Trailing window to export, in days. Range
1–365. Default 7.tunnel_id int
Optional. Restrict the export to a single tunnel.
limit int
Maximum rows to export. Range
1–5000. Default 5000.Response (200 OK)
Download (Content-Disposition: attachment).
format=csv:Content-Type: text/csv. Header row:ID, Tunnel ID, Tunnel Name, Method, Path, Query String, Remote Address, User Agent, Referer, Status Code, Response Size, Response Time, Bytes In, Bytes Out, Created At.format=json:Content-Type: application/json. A single object{exported_at, days, count, logs: [...]}where eachlogsentry is{id, tunnel_id, tunnel_name, method, path, query_string, remote_addr, user_agent, referer, status_code, response_size, response_time, bytes_in, bytes_out, created_at}.
Errors
400 Bad Request
Invalid
format (must be json or csv).401 Unauthorized
Missing auth.
403 Forbidden
Plan doesn't include the
traffic_inspector entitlement.Request — CSV, last 7 days
curl "https://api.ngris.com/v1/traffic/logs/export?format=csv&days=7" \
-H "X-API-KEY: <your_api_key>" \
-o logs.csv
Python — JSON export
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
export = client.traffic.export_logs(format="json", days=7)
print(f"{export['count']} rows over {export['days']} days")
for log in export["logs"]:
if log["status_code"] >= 500:
print(log)
Response — 200 OK (CSV excerpt)
ID,Tunnel ID,Tunnel Name,Method,Path,Query String,Remote Address,User Agent,Referer,Status Code,Response Size,Response Time,Bytes In,Bytes Out,Created At
1234,42,my-api,GET,/api/users,,203.0.113.42,curl/8.4.0,,500,234,1247,0,234,2026-04-29T13:01:23Z
1235,42,my-api,POST,/api/orders,?ref=email,203.0.113.42,Mozilla/5.0,,201,128,89,512,128,2026-04-29T13:01:24Z
Response — 200 OK (JSON)
{
"exported_at": "2026-04-29T13:05:00Z",
"days": 7,
"count": 2,
"logs": [
{
"id": 1234,
"tunnel_id": 42,
"tunnel_name": "my-api",
"method": "GET",
"path": "/api/users",
"query_string": "",
"remote_addr": "203.0.113.42",
"user_agent": "curl/8.4.0",
"referer": "",
"status_code": 500,
"response_size": 234,
"response_time": 1247,
"bytes_in": 0,
"bytes_out": 234,
"created_at": "2026-04-29T13:01:23Z"
}
]
}