Skip to Content
ReferenceAPI referenceGeo Events

List geo events

GET
/api/v1/geo-events

Returns one event per logged request whose client IP has a GeoIP location, newest first, with the location embedded. Page with currentPage and pageSize, and sort with orderBy and sortOrder. fromTimestamp and toTimestamp are optional here, and both ends of the range are inclusive.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

currentPage?integer

The page to return, counted from 1. Defaults to 1.

Range1 <= value
Default1
pageSize?integer

Rows per page, from 1 to 500. Defaults to 50.

Range1 <= value <= 500
Default50
orderBy?string

The field to sort by, one of timestamp, id, ip_address, server, location_id, autonomous_system_number, autonomous_system_organization. Defaults to timestamp, and any other value gets a 400.

Default"timestamp"
sortOrder?string

asc or desc. Defaults to desc.

Default"desc"
Value in"asc""desc"
fromTimestamp?|

Keep only events at or after this time, as ISO 8601 with a timezone.

toTimestamp?|

Keep only events at or before this time, as ISO 8601 with a timezone.

ipAddressIn?array<string>|

Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

ipAddressNotIn?array<string>|

Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

serverIn?array<string>|

Keep only rows recorded under these server names. Repeat the parameter to pass more than one.

Response Body

Request fulfilled, document follows

application/json
  1. response

One page of results. total counts the matches on every page, limit is the page size and offset is how many matches come before this page.

items?array<>
limit?integer

Maximal number of items to send.

offset?integer

Offset from the beginning of the query.

total?integer

Total number of items.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/geo-events?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'
Example Response
{  "items": [    {      "autonomousSystemNumber": 0,      "autonomousSystemOrganization": "string",      "id": 0,      "ipAddress": "string",      "location": {        "city": "string",        "countryCode": "string",        "countryName": "string",        "createdAt": "2019-08-24T14:15:22Z",        "geographicPoint": "string",        "geohash": "string",        "id": 0,        "lastHit": "2019-08-24T14:15:22Z",        "latitude": 0,        "longitude": 0,        "postalCode": "string",        "state": "string",        "stateCode": "string",        "timezone": "string",        "updatedAt": "2019-08-24T14:15:22Z"      },      "locationId": 0,      "server": "string",      "timestamp": "2019-08-24T14:15:22Z"    }  ],  "limit": 0,  "offset": 0,  "total": 0}

List the Spamhaus DROP networks and ASNs GET

Returns every network and ASN on the Spamhaus DROP lists, with the download state of each feed. The scheduler downloads the lists every DROP_REFRESH_HOURS hours, 24 by default. With DROP_ENABLED=false the lists are empty and `enabled` is false. The answer carries `Cache-Control: private, max-age=300`.

List the values the geo event filters accept GET

Returns every country, city, server and ASN in the stored data, to fill filter dropdowns. It takes no time range, and the values outlast the raw retention.