Get geo event totals for a time range
Returns the event count and the unique IPs, countries and cities for the range. With comparePrevious it adds the period of the same length that ends at fromTimestamp, and both comparison fields stay null when that period has no events. Unfiltered ranges over 24 hours read the hourly or daily aggregates, which count whole hours or UTC days, from the one that holds fromTimestamp through the last one that starts before toTimestamp, and their unique counts are estimates. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.
session<token>Session cookie authentication.
countryCodeIn?array<string>|Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.
cityIn?array<string>|Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.
ipAddressIn?array<string>|Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
ipAddressNotIn?array<string>|Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
serverIn?array<string>|Keep only rows recorded under these server names. Repeat the parameter to pass more than one.
asnIn?array<integer>|Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.
asnNotIn?array<integer>|Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.
fromTimestamp*stringStart of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z.
date-timetoTimestamp*stringEnd of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z.
date-timecomparePrevious?booleanAlso return the period of the same length just before the range, and the percent change from it. Defaults to false.
falseRequest fulfilled, document follows
application/json- response
Geo event totals for a time range, and optionally for the period of the same length before it.
currentPeriod*Geo event totals for one period.
endDate*stringThe request's toTimestamp, echoed as ISO 8601.
percentChanges*|Null whenever previousPeriod is null.
previousPeriod*|Null unless comparePrevious is true and the previous period has events.
startDate*stringThe request's fromTimestamp, echoed as ISO 8601.
curl -X GET 'https://geometrikks.example.com/api/v1/geo-events/summary?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'{ "currentPeriod": { "totalEvents": 0, "uniqueCities": 0, "uniqueCountries": 0, "uniqueIps": 0 }, "endDate": "string", "percentChanges": { "totalEvents": 0, "uniqueCities": 0, "uniqueCountries": 0, "uniqueIps": 0 }, "previousPeriod": { "totalEvents": 0, "uniqueCities": 0, "uniqueCountries": 0, "uniqueIps": 0 }, "startDate": "string"}List geo events grouped by location and IP GET
Returns one row per location and IP pair with its event count, last event, ASN and the servers that recorded it, paged with `currentPage` and `pageSize`. Rows with a null sort value come last in both directions. Ranges over 24 hours read the per-IP aggregates, so `lastSeen` can be the start of the hour or UTC day of the last event. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.
Get geo events and unique IPs, countries and cities per hour or day GET
Returns events and unique IPs, countries and cities for each bucket that has events, oldest first. Unfiltered ranges over 24 hours read the aggregates, which count whole hours or UTC days, from the one that holds `fromTimestamp` through the last one that starts before `toTimestamp`, and their unique counts are estimates. With `granularity=daily` and a `tz` other than UTC on a range of 30 days or less, those reads count local days instead. They start at the local midnight of the day holding `fromTimestamp` and run through the last hour that starts before `toTimestamp`. A server filter reads the raw rows, and so does any other filter with hourly buckets on a range over 30 days. Raw reads go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default, and a server filter with daily buckets applies `tz` at any range length.