Get geo events and unique IPs, countries and cities per hour or day
Returns events and unique IPs, countries and cities for each bucket that has events, oldest first. Unfiltered ranges over 24 hours read the aggregates, which count whole hours or UTC days, from the one that holds fromTimestamp through the last one that starts before toTimestamp, and their unique counts are estimates. With granularity=daily and a tz other than UTC on a range of 30 days or less, those reads count local days instead. They start at the local midnight of the day holding fromTimestamp and run through the last hour that starts before toTimestamp. A server filter reads the raw rows, and so does any other filter with hourly buckets on a range over 30 days. Raw reads go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default, and a server filter with daily buckets applies tz at any range length.
session<token>Session cookie authentication.
countryCodeIn?array<string>|Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.
cityIn?array<string>|Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.
ipAddressIn?array<string>|Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
ipAddressNotIn?array<string>|Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
serverIn?array<string>|Keep only rows recorded under these server names. Repeat the parameter to pass more than one.
asnIn?array<integer>|Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.
asnNotIn?array<integer>|Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.
fromTimestamp*stringStart of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z.
date-timetoTimestamp*stringEnd of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z.
date-timegranularity?|hourly or daily buckets. Leave it out to get hourly buckets for ranges up to 30 days and daily buckets for longer ones.
"hourly""daily"nulltz?|An IANA timezone such as Europe/Oslo. Daily buckets then start at midnight in that zone for ranges of 30 days or less, and longer ranges keep UTC days unless the endpoint's description says otherwise. Hourly buckets ignore it, so on ranges that get hourly buckets it changes nothing. An unknown zone gets a 400. Defaults to UTC.
Request fulfilled, document follows
application/json- response
Geo events and unique IPs, countries and cities per bucket, oldest first. Buckets without events are left out.
data*array<>endDate*stringThe request's toTimestamp, echoed as ISO 8601.
granularity*stringThe bucket size used, hourly or daily.
startDate*stringThe request's fromTimestamp, echoed as ISO 8601.
curl -X GET 'https://geometrikks.example.com/api/v1/geo-events/time-series?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z&tz=Europe%2FOslo'{ "data": [ { "timestamp": "2019-08-24T14:15:22Z", "totalEvents": 0, "uniqueCities": 0, "uniqueCountries": 0, "uniqueIps": 0 } ], "endDate": "string", "granularity": "string", "startDate": "string"}Get geo event totals for a time range GET
Returns the event count and the unique IPs, countries and cities for the range. With `comparePrevious` it adds the period of the same length that ends at `fromTimestamp`, and both comparison fields stay null when that period has no events. Unfiltered ranges over 24 hours read the hourly or daily aggregates, which count whole hours or UTC days, from the one that holds `fromTimestamp` through the last one that starts before `toTimestamp`, and their unique counts are estimates. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.
List the networks with the most geo events GET
Returns autonomous systems ordered by event count, with the distinct IPs and the category of each. Events without ASN data are left out. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.