Skip to Content
ReferenceAPI referenceGeo Events

List geo events grouped by location and IP

GET
/api/v1/geo-events/logs

Returns one row per location and IP pair with its event count, last event, ASN and the servers that recorded it, paged with currentPage and pageSize. Rows with a null sort value come last in both directions. Ranges over 24 hours read the per-IP aggregates, so lastSeen can be the start of the hour or UTC day of the last event. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

countryCodeIn?array<string>|

Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.

cityIn?array<string>|

Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.

ipAddressIn?array<string>|

Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

ipAddressNotIn?array<string>|

Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

serverIn?array<string>|

Keep only rows recorded under these server names. Repeat the parameter to pass more than one.

asnIn?array<integer>|

Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.

asnNotIn?array<integer>|

Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.

fromTimestamp*string

Start of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z.

Formatdate-time
toTimestamp*string

End of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z.

Formatdate-time
currentPage?integer

The page to return, counted from 1. Defaults to 1.

Range1 <= value
Default1
pageSize?integer

Rows per page, from 1 to 500. Defaults to 50.

Range1 <= value <= 500
Default50
orderBy?string

The column to sort by: event_count, last_seen, ip_address, city, postal_code, state, country_code, country_name, latitude, longitude or asn. Defaults to event_count. Any other value gets a 400.

Default"event_count"
sortOrder?string

asc or desc. Defaults to desc.

Default"desc"
Value in"asc""desc"

Response Body

Request fulfilled, document follows

application/json
  1. response

One page of results. total counts the matches on every page, limit is the page size and offset is how many matches come before this page.

items?array<>
limit?integer

Maximal number of items to send.

offset?integer

Offset from the beginning of the query.

total?integer

Total number of items.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/geo-events/logs?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'
Example Response
{  "items": [    {      "asOrganization": "string",      "asn": 0,      "city": "string",      "countryCode": "string",      "countryName": "string",      "eventCount": 0,      "ipAddress": "string",      "lastSeen": "2019-08-24T14:15:22Z",      "latitude": 0,      "locationId": 0,      "longitude": 0,      "postalCode": "string",      "servers": [        "string"      ],      "state": "string",      "stateCode": "string"    }  ],  "limit": 0,  "offset": 0,  "total": 0}

List the values the geo event filters accept GET

Returns every country, city, server and ASN in the stored data, to fill filter dropdowns. It takes no time range, and the values outlast the raw retention.

Get geo event totals for a time range GET

Returns the event count and the unique IPs, countries and cities for the range. With `comparePrevious` it adds the period of the same length that ends at `fromTimestamp`, and both comparison fields stay null when that period has no events. Unfiltered ranges over 24 hours read the hourly or daily aggregates, which count whole hours or UTC days, from the one that holds `fromTimestamp` through the last one that starts before `toTimestamp`, and their unique counts are estimates. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.