Skip to content

Forensic Fields.

POST
/api/shape/bot/namespaces/{namespace}/v1/reporting/forensic/fields
curl --request POST \
--url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/shape/bot/namespaces/example/v1/reporting/forensic/fields \
--header 'Authorization: <Authorization>' \
--header 'Content-Type: application/json' \
--data '{ "end_time": "example", "fields": [ { "key": "TIMESTAMP", "limit": 1, "mode": "AGGREGATE", "sort": { "key": "example", "order": "DESCENDING" } } ], "filters": { "global_filters": [ { "key": "TIMESTAMP", "op": "IN", "values": [ "example" ] } ], "region_filter": "US" }, "namespace": "example", "start_time": "example" }'

GET

Examples of this operation.

namespace
required
string

Namespace

x-required namespace is used to scope the query. Only virtual_host in given namespace will be considered.

Media typeapplication/json
ForensicFieldsRequest

Request for Shape Bot Defense Forensic Fields.

object
end_time
End time

End time of the query period Format: unix_timestamp|RFC 3339

Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to

string
<= 1024 characters
fields
Fields

Additional fields for the query

Required: YES.

Array<object>
ForensicField

Forensic query field.

object
key
string
default: TIMESTAMP
Allowed values: TIMESTAMP USERNAME CLIENT_TOKEN IP_ADDRESS ASN AS_ORGANIZATION COUNTRY METHOD HOST PATH URL REFERER TRAFFIC_CHANNEL IS_ATTACK BOT_REASON TRAFFIC_TYPE THREAT_TYPE SDK_VERSION ACTION_TAKEN COOKIE_AGE BOT_COOKIE USER_AGENT USER_AGENT_OS_FAMILY USER_AGENT_FAMILY BROWSER_FINGERPRINT USER_FINGERPRINT HEADER_FINGERPRINT DEVICE_ID FLOW AGENT APPLICATION_NAME PROTECTED_APPLICATION RESPONSE_CODE SERVER_RESPONSE_CODE TRANSACTION_RESULT MOBILE_TRANSACTION_INSIGHT WEB_TRANSACTION_INSIGHT TRIGGERED_RULE FLOW_CATEGORY FLOW_LABEL
limit
Limit

Limits the number of transactions returned in the response Optional: If not specified, the first 500 transactions that matches the query will be returned in the response. The maximum value for limit is 500.

integer format: int64
mode
string
default: AGGREGATE
Allowed values: AGGREGATE SUGGEST
sort
object
key
Sort Key

Key to sort

Required: YES.

string
>= 7 characters <= 1024 characters
order
string
default: DESCENDING
Allowed values: DESCENDING ASCENDING
filters
object
global_filters
Filters

List of global filters

Required: YES.

Array<object>
Global Filter

Query Global Filter.

object
key
string
default: TIMESTAMP
Allowed values: TIMESTAMP USERNAME CLIENT_TOKEN IP_ADDRESS ASN AS_ORGANIZATION COUNTRY METHOD HOST PATH URL REFERER TRAFFIC_CHANNEL IS_ATTACK BOT_REASON TRAFFIC_TYPE THREAT_TYPE SDK_VERSION ACTION_TAKEN COOKIE_AGE BOT_COOKIE USER_AGENT USER_AGENT_OS_FAMILY USER_AGENT_FAMILY BROWSER_FINGERPRINT USER_FINGERPRINT HEADER_FINGERPRINT DEVICE_ID FLOW AGENT APPLICATION_NAME PROTECTED_APPLICATION RESPONSE_CODE SERVER_RESPONSE_CODE TRANSACTION_RESULT MOBILE_TRANSACTION_INSIGHT WEB_TRANSACTION_INSIGHT TRIGGERED_RULE FLOW_CATEGORY FLOW_LABEL
op
string
default: IN
Allowed values: IN NOT_IN MATCHES_REGEX DOES_NOT_MATCH_REGEX INCLUDES DOES_NOT_INCLUDE STARTS_WITH ENDS_WITH
values
Values

An unordered list of filter strings Required: YES.

Array<string>
>= 1 items <= 64 items
region_filter
string
default: US
Allowed values: US EU ASIA CA
namespace
Namespace

Namespace is used to scope the query. Only virtual_host in given namespace will be considered. Required: YES.

string
>= 6 characters <= 1024 characters
start_time
Start time

Start time of the query period Format: unix_timestamp|RFC 3339

Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.

string
<= 1024 characters

A successful response.

Media typeapplication/json
ForensicFieldsResponse

Response for Shape Bot Defense Forensic Fields.

object
fields
Response for Forensic Fields

Required: YES.

Array<object>
ForensicData

Forensic Data.

object
aggregate
Forensic Aggregate

Optional Forensic Aggregate Type.

Array<object>
ForensicAggregateType

Forensic AggregateType fields.

object
count
Count

Forensic Aggregate Count

Required: YES.

string format: uint64
<= 1024 characters
percent
Percent

Forensic Aggregate Percent

Required: YES.

number format: double
value
Value

Forensic Aggregate Value

Required: YES.

string
>= 3 characters <= 1024 characters
errors
object
code
Forensic Error Code

Forensic Error Code

Required: YES.

string format: uint64
<= 1024 characters
message
Forensic Error Message

Forensic Error Message

Required: YES.

string
<= 1024 characters
key
string
default: TIMESTAMP
Allowed values: TIMESTAMP USERNAME CLIENT_TOKEN IP_ADDRESS ASN AS_ORGANIZATION COUNTRY METHOD HOST PATH URL REFERER TRAFFIC_CHANNEL IS_ATTACK BOT_REASON TRAFFIC_TYPE THREAT_TYPE SDK_VERSION ACTION_TAKEN COOKIE_AGE BOT_COOKIE USER_AGENT USER_AGENT_OS_FAMILY USER_AGENT_FAMILY BROWSER_FINGERPRINT USER_FINGERPRINT HEADER_FINGERPRINT DEVICE_ID FLOW AGENT APPLICATION_NAME PROTECTED_APPLICATION RESPONSE_CODE SERVER_RESPONSE_CODE TRANSACTION_RESULT MOBILE_TRANSACTION_INSIGHT WEB_TRANSACTION_INSIGHT TRIGGERED_RULE FLOW_CATEGORY FLOW_LABEL
mode
string
default: AGGREGATE
Allowed values: AGGREGATE SUGGEST
suggest
Forensic Suggest

Optional Forensic Suggest Type.

Array<object>
ForensicSuggestType

Forensic SuggestType fields.

object
value
Value

Forensic Suggest Value

Required: YES.

string
>= 3 characters <= 1024 characters
Example
{
"fields": [
{
"key": "TIMESTAMP",
"mode": "AGGREGATE"
}
]
}

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example