Get Log Entry
Fetch the full traffic-log record for one request. Includes everything the platform observed: request and response headers, body samples (truncated to retention limits), latency breakdown, hit traffic policies, hit firewall rules, OAuth/RBAC client identity (if authenticated), and the agent that handled the request.
Body samples are truncated at the platform's body-capture limit (typically first 64 KB) and stored encrypted at rest. PII filters can mask known credential-shaped fields before storage; check your account settings.
Path parameters
uuid string (uuid) Req
The log entry's
uuid from /traffic/logs.Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.
Response (200 OK)
Every field below is always present; a field with no value for this entry is null (unlike the list, which omits it).
uuid string (uuid)
The entry's public id.
endpoint_uuid string (uuid) | null
The endpoint that received the request.
tunnel_uuid, tunnel_name, tunnel_type string | null
The tunnel that carried the request: its uuid, name and type (e.g.
http, tcp, udp). null when no tunnel was involved (agentless or managed hosting, or a deleted tunnel).public_url string | null
That tunnel's public address.
null when no tunnel was involved.timestamp datetime
When the entry was recorded (RFC 3339, UTC).
region string | null
The edge region that served the request.
http_version string | null
HTTP/1.1, HTTP/2 or HTTP/3. null on TCP/UDP sessions and older entries.connection_id string | null
Session id of a TCP/UDP session entry;
null for HTTP requests.request_id string | null
The edge's id for this request: the
X-Request-Id response header the client got. Look an entry up by it with GET /v1/traffic/logs?request_id=…. null on TCP/UDP sessions, entries from before request ids were recorded, and some edge-generated error responses.method, path, request_url string | null
Request line components. There is no separate
query field — the query string is part of request_url.host string
The requested host (empty string when unknown).
client_ip string
The client's IP address.
destination_ip string | null
The address the request was sent to, when recorded.
user_agent string | null
The client's
User-Agent.status_code, edge_status int | null
Status the client got from the edge (the two fields carry the same value).
origin_status int | null
Status your origin returned;
null when the origin wasn't reached.request_headers, response_headers object | null
Header maps. Credential-shaped values (e.g.
Authorization, Cookie, API keys) are masked.request_cookies, response_cookies object | null
Cookie maps (sensitive values masked).
request_body, response_body string | null
Body samples (truncated).
null when capture was disabled or PII filter scrubbed everything.bytes_in, bytes_out int64 | null
Bandwidth used by this request.
duration_ms, response_time int | null
Full request time in ms — from when the edge received the request to when the client got the complete response (the two fields carry the same value). Equals
edge_ms + origin_ttfb_ms + transfer_ms.edge_ms, origin_ttfb_ms, transfer_ms int | null
The three sequential timing phases (ms) that sum to
duration_ms. edge_ms: edge pipeline (firewall / rate-limit / auth + framing) before your origin is contacted. origin_ttfb_ms: wait for the origin's first response byte (= TTFB / latency_ms). transfer_ms: response-body streaming after the first byte. A field is null when the phase doesn't apply (an edge-blocked request has no origin/transfer; TCP/UDP sessions have none).latency_ms int | null
Time-to-first-byte (TTFB) in ms — identical to
origin_ttfb_ms.firewall_action string | null
What the edge did with the request:
no_match, allowed or blocked by a firewall policy, or the traffic-policy outcome when one answered at the edge (e.g. redirect, cache_hit, edge_function).firewall_policy, firewall_rule string | null
The matched firewall policy's id and name, when a firewall policy matched.
rate_limit_action string | null
The rate-limit verdict:
allowed, throttled or blocked.rate_limit_rule_uuid string (uuid) | null
The matched rate-limit rule, when one matched.
is_replay boolean
true when this entry is a replay.original_request_uuid string (uuid) | null
For a replay, the entry it replayed.
analysis string | null
The stored AI analysis text, if one was run.
geo_info object | null
Where the client IP is: string values
country (ISO code) and, when known, asn, asn_org, continent, timezone, latitude, longitude.spam_score, ip_health int | null, string | null
Reputation of the client IP: a 0–100 score (higher is worse) and a verdict (
clean, suspect, malicious, blocked, allowlisted). null when the reputation check didn't run.bot_score int | null
The edge's bot score for the request, 1–99; low means likely automated.
null when the request wasn't scored (TCP/UDP, older entries).bot_class string | null
The client class behind the score:
browser, automation, crawler or unknown.bot_reasons string[]
The signals that moved the score, as reason codes. Always a list, never
null: [] when the request wasn't scored or recorded no reason.verified_bot boolean | null
true when the request came from a verified crawler (its user agent names a crawler and the IP is in that operator's published ranges).ja4 string | null
The client's JA4 TLS fingerprint.
null on plain HTTP, HTTP/3 and TCP/UDP.Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
400 Bad Request
An integer id after the sunset (
integer_id_unsupported).401 Unauthorized
Missing auth.
404 Not Found
Log doesn't exist (expired beyond retention) or isn't in your active account (another account's uuid reads exactly like an unknown one).
Request
curl "https://api.ngris.com/v1/traffic/logs/019ba303-954b-796c-bf40-f33a26697f74" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
log = client.traffic.get_log("019ba303-954b-796c-bf40-f33a26697f74")
print(log["status_code"], log["duration_ms"])
if log.get("firewall_action"):
print("Firewall:", log["firewall_action"], log.get("firewall_rule"))
Response — 200 OK
{
"uuid": "019ba303-954b-796c-bf40-f33a26697f74",
"timestamp": "2026-04-29T13:01:23.456Z",
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"tunnel_uuid": "019ab73a-b951-7031-aea5-1435da834122",
"tunnel_name": "api",
"tunnel_type": "http",
"public_url": "api.example.com",
"region": "eu-fi",
"http_version": "HTTP/2",
"connection_id": null,
"request_id": "4f9c2b7e1d0a8c3b6e5f7a9d2c1b0e8f",
"method": "GET",
"path": "/api/users",
"host": "api.example.com",
"request_url": "https://api.example.com/api/users?limit=10",
"client_ip": "203.0.113.42",
"destination_ip": null,
"user_agent": "curl/8.0",
"status_code": 500,
"edge_status": 500,
"origin_status": 500,
"request_headers": {"user-agent": "curl/8.0", "accept": "*/*"},
"request_cookies": null,
"request_body": null,
"response_headers": {"content-type": "text/plain"},
"response_cookies": null,
"response_body": "Internal Server Error\n",
"bytes_in": 0,
"bytes_out": 22,
"duration_ms": 1247,
"response_time": 1247,
"latency_ms": 1243,
"edge_ms": 2,
"origin_ttfb_ms": 1243,
"transfer_ms": 2,
"firewall_action": "no_match",
"firewall_policy": null,
"firewall_rule": null,
"rate_limit_action": "allowed",
"rate_limit_rule_uuid": null,
"is_replay": false,
"original_request_uuid": null,
"analysis": null,
"geo_info": {"country": "DE", "asn": "AS64496", "asn_org": "Example Hosting"},
"spam_score": 0,
"ip_health": "clean",
"bot_score": 12,
"bot_class": "automation",
"bot_reasons": ["automation_ua"],
"verified_bot": false,
"ja4": "t13d1516h2_8daaf6152771_02713d6af862"
}
Was this helpful?