Skip to Content
ReferenceAPI referenceAnalytics

List the client IPs with the most requests

GET
/api/v1/analytics/top-ips

Returns client IPs ordered by hits, with error hits, bytes and the IP's country and city. A country, city or IP filter reads the per-IP aggregates, so unlike the URL and user agent lists it reaches past ANALYTICS_RAW_RETENTION_DAYS. An ASN filter makes it read the raw access log rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

startDate?|

Start of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z. Requires endDate; omit with window.

endDate?|

End of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z. Requires startDate; omit with window.

window?|

A rolling window ending now, such as 15m, 24h or 7d, up to 365 days. Use positive whole minutes, hours or days. Cannot be combined with explicit time bounds.

limit?integer

How many IPs to return, from 1 to 100. Defaults to 25.

Range1 <= value <= 100
Default25
countryCode?array<string>|

Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.

city?array<string>|

Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.

ipAddress?array<string>|

Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

ipAddressNotIn?array<string>|

Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

asnIn?array<integer>|

Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.

asnNotIn?array<integer>|

Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.

Response Body

Request fulfilled, document follows

application/json
  1. response

Client IPs ordered by hits, most first.

endDate*string

The request's endDate, echoed as ISO 8601.

items*array<>
startDate*string

The request's startDate, echoed as ISO 8601.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/analytics/top-ips?startDate=2026-11-01T00%3A00%3A00Z&endDate=2026-11-02T00%3A00%3A00Z'
Example Response
{  "endDate": "string",  "items": [    {      "asOrganization": "string",      "asn": 0,      "city": "string",      "countryCode": "string",      "errorHits": 0,      "hits": 0,      "ipAddress": "string",      "totalBytes": 0    }  ],  "startDate": "string"}

List the countries with the most requests GET

Returns countries ordered by hits, with the number of distinct client IPs from each. Requests without a country are left out. An ASN filter makes it read the raw access log rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.

List the most requested URLs GET

Returns host and path pairs ordered by hits, with error hits, bytes and the average request time. Lines without a path are left out. A country, city, IP or ASN filter makes it read the raw access log rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.