Get geo event counts per hour or day
Returns geo events and unique IPs, countries and cities for each bucket that has events, oldest first. It reads the hourly or daily aggregates at any range length, so the unique counts are estimates, and those reads count whole hours or UTC days, from the one that holds startDate through the last one that starts before endDate. With granularity=daily and a tz other than UTC on a range of 30 days or less, those reads count local days instead. They start at the local midnight of the day holding startDate and run through the last hour that starts before endDate.
session<token>Session cookie authentication.
startDate?|Start of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z. Requires endDate; omit with window.
endDate?|End of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z. Requires startDate; omit with window.
window?|A rolling window ending now, such as 15m, 24h or 7d, up to 365 days. Use positive whole minutes, hours or days. Cannot be combined with explicit time bounds.
granularity?|hourly or daily buckets. Leave it out to get hourly buckets for ranges up to 30 days and daily buckets for longer ones.
"hourly""daily"nulltz?|An IANA timezone such as Europe/Oslo. Daily buckets then start at midnight in that zone for ranges of 30 days or less, and longer ranges keep UTC days unless the endpoint's description says otherwise. Hourly buckets ignore it, so on ranges that get hourly buckets it changes nothing. An unknown zone gets a 400. Defaults to UTC.
Request fulfilled, document follows
application/json- response
Geo event counts per bucket, oldest first. Buckets without events are left out.
data*array<>endDate*stringThe request's endDate, echoed as ISO 8601.
granularity*stringThe bucket size used, hourly or daily.
startDate*stringThe request's startDate, echoed as ISO 8601.
curl -X GET 'https://geometrikks.example.com/api/v1/analytics/geo-time-series?startDate=2026-11-01T00%3A00%3A00Z&endDate=2026-11-02T00%3A00%3A00Z&tz=Europe%2FOslo'{ "data": [ { "timestamp": "string", "totalGeoEvents": 0, "uniqueCities": 0, "uniqueCountries": 0, "uniqueIps": 0 } ], "endDate": "string", "granularity": "string", "startDate": "string"}List the filter values in the access logs GET
Returns every country, city, host, server name, log format and ASN the access logs hold, to fill the list filters. It reads the daily aggregates, so values stay listed after their raw lines are gone.
Get the access log profile of one IP GET
Returns totals, status classes, latency, first and last seen, the top 5 hosts and paths, the top 3 user agents and a hit series for one client IP. The series has hourly buckets for ranges up to 7 days and daily buckets above, and `tz` sets local days at any range length. It reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default. An IP without requests in the range gets zero request counts and empty lists, not a 404.