List the networks with the most geo events
Returns autonomous systems ordered by event count, with the distinct IPs and the category of each. Events without ASN data are left out. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.
session<token>Session cookie authentication.
countryCodeIn?array<string>|Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.
cityIn?array<string>|Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.
ipAddressIn?array<string>|Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
ipAddressNotIn?array<string>|Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.
serverIn?array<string>|Keep only rows recorded under these server names. Repeat the parameter to pass more than one.
asnIn?array<integer>|Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.
asnNotIn?array<integer>|Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.
fromTimestamp*stringStart of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z.
date-timetoTimestamp*stringEnd of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z.
date-timelimit?integerHow many ASNs to return, from 1 to 50. Defaults to 10.
1 <= value <= 5010Request fulfilled, document follows
application/json- response
Autonomous systems ordered by geo event count, most first.
items*array<>curl -X GET 'https://geometrikks.example.com/api/v1/geo-events/top-asns?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'{ "items": [ { "asn": 0, "category": "drop", "eventCount": 0, "organization": "string", "uniqueIps": 0 } ]}Get geo events and unique IPs, countries and cities per hour or day GET
Returns events and unique IPs, countries and cities for each bucket that has events, oldest first. Unfiltered ranges over 24 hours read the aggregates, which count whole hours or UTC days, from the one that holds `fromTimestamp` through the last one that starts before `toTimestamp`, and their unique counts are estimates. With `granularity=daily` and a `tz` other than UTC on a range of 30 days or less, those reads count local days instead. They start at the local midnight of the day holding `fromTimestamp` and run through the last hour that starts before `toTimestamp`. A server filter reads the raw rows, and so does any other filter with hourly buckets on a range over 30 days. Raw reads go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default, and a server filter with daily buckets applies `tz` at any range length.
List the cities with the most geo events GET
Returns cities ordered by event count, with the distinct IPs from each. Events without a city are left out, and cities with the same name in different countries count as one. A server filter reads the raw rows, which go back only ANALYTICS_RAW_RETENTION_DAYS days, 180 by default.