action threatjammer_query_origin_traffic_analysis_v1_origin_traffic_analysis_get {
  label: "Get the traffic analysis of the origin."
  description: "### What\nObtain the traffic analysis of the origin in the specified time range and interval. Theanalysis will return the number of requests and the anomalies detected like:\n\n- number of requests\n- overall score\n- malicious synthetic traffic (bad bot traffic)\n- IP in a denylist\n- IP in a datacenter\n- user uses a headless webdriver\n- Autonomous System (ASN) of the IP is risky\n- The location of the IP address and the ASN is different\n\nThe origin is a combination of protocol and domain (Ex: https://example.com) and the origin token is a special key used in conjunction with javascript library used for abuse detection. This key is owned by the user and is used to identify the origin of the request.\n Hence, the protocol and domain of the origin must be the one where the javascript is loaded.\n\n### Parameters\nIn the querystring of the request, add the origin of the user to the `query` parameter with the following format:1. Protocol: Can be ``http`` or ``https``.\n2. Domain: The domain of the origin.\n\nThen, the origin must be urlencoded. Example:\n```\nhttps://example.com\n```\n\n```\nhttps%3A%2F%2Fexample.com\n```\n\nThe querystring must be like this:\n```\n?query=https%3A%2F%2Fexample.com\n```\n\nTo restrict the analysis to a specific time range, add the following parameters to the querystring:\n- ``from_timestamp``: the start date and time of the analysis in UNIX timestamp in milliseconds.\n- ``to_timestamp``: (Optional) the end date and time of the analysis in UNIX timestamp in milliseconds.\n- ``interval``: (Optional) the interval of the analysis in minutes. The default value is 60 minutes (HOURLY). Possible values are: ``HOURLY``.\n\n### Result\nThe result is a JSON object with the following fields:\n- ``self``: the URI to the request to obtain the traffic analysis for the origin.\n- ``from_timestamp``: the start date and time of the analysis in UNIX timestamp in milliseconds.\n- ``to_timestamp``: the end date and time of the analysis in UNIX timestamp in milliseconds.\n- ``interval``: the interval of the analysis. Possible values are: ``HOURLY``.\n- ``data``: a JSON list with the following elements each one with the following fields:\n    - ``timestamp``: the date and time of the analysis in UNIX timestamp in milliseconds.\n    - ``total``: the total number of requests.\n    - ``score_high``: the number of requests with a high score (bad traffic).\n    - ``bots``: the number of requests from bad bots.\n    - ``denylists``: the number of requests from IPs in a denylist.\n    - ``datacenters``: the number of requests from IPs in a datacenter.\n    - ``webdrivers``: the number of requests from IPs using a headless webdriver.\n    - ``asn_risky``: the number of requests from IPs with a risky ASN.\n    - ``network_country_mismatches``: the number of requests from IPs with a different location than the ASN.\n\n### Errors\n- a `404 Not Found` error if the origin token is not found.\n- a `400 Bad Request` error if the origin does not have the correct format.\n\nIt will return the API Global errors described in the API description."
  provider: threatjammer
  method: GET
  path: "/v1/origin/traffic/analysis"
  encoding: json
  input: {
    type: "object"
    properties: {
      from_timestamp: {
        type: "integer"
        description: "A UNIX timestamp in milliseconds to restrict the results of the query to entries logged after or equal to this value."
      }
      interval: {
        type: "string"
        description: "The data inteval to aggregate the result dataset"
        enum: ["HOURLY"]
      }
      query: {
        type: "string"
        description: "The origin site to query"
      }
      to_timestamp: {
        type: "integer"
        description: "A UNIX timestamp in milliseconds to restrict the results of the query to entries logged before this value."
      }
    }
    required: ["from_timestamp", "interval", "query"]
    additionalProperties: false
  }
  output: {
    type: "object"
    required: ["data", "from_timestamp", "interval", "self", "to_timestamp"]
    properties: {
      data: {
        type: "array"
        items: {
          type: "object"
          required: ["timestamp", "total", "score_high", "bots", "denylists", "datacenters", "webdrivers", "asn_risky", "network_country_mismatches"]
          properties: {
            asn_risky: {
              type: "integer"
            }
            bots: {
              type: "integer"
            }
            datacenters: {
              type: "integer"
            }
            denylists: {
              type: "integer"
            }
            network_country_mismatches: {
              type: "integer"
            }
            score_high: {
              type: "integer"
            }
            timestamp: {
              type: "integer"
            }
            total: {
              type: "integer"
            }
            webdrivers: {
              type: "integer"
            }
          }
        }
      }
      from_timestamp: {
        type: "integer"
      }
      interval: {
        type: "string"
      }
      self: {
        type: "string"
      }
      to_timestamp: {
        type: "integer"
      }
    }
  }
}