> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get HTTP traffic timeline by IP

> Returns HTTP traffic analytics grouped by IP address with IPs ranked by impact (response time × request count). Use limit parameter to control total items returned (default: 200, max: 300) and top_hits_count to control the upper cap on items tracked in timelines (default: 15, max: 15). At least _breakdown_top_hits.min_quantity IPs are always tracked, plus additional IPs up to top_hits_count while cumulative impact is below _breakdown_top_hits.max_percentage. Items have a top_hit boolean indicating whether they appear in timeline data.



## OpenAPI

````yaml https://meta.upsun.com/openapi-spec get /projects/{projectId}/environments/{environmentId}/observability/http/breakdown/ips
openapi: 3.0.1
info:
  title: Upsun.com Rest API
  version: '1.0'
  contact:
    name: Support
    url: https://upsun.com/contact-us/
  termsOfService: https://upsun.com/trust-center/legal/tos/
  description: >
    # Introduction


    Upsun, formerly Platform.sh, is a container-based Platform-as-a-Service. Our
    main API

    is simply Git. With a single `git push` and a couple of YAML files in

    your repository you can deploy an arbitrarily complex cluster.

    Every [**Project**](#tag/Project) can have multiple applications (PHP,

    Node.js, Python, Ruby, Go, etc.) and managed, automatically

    provisioned services (databases, message queues, etc.).


    Each project also comes with multiple concurrent

    live staging/development [**Environments**](#tag/Environment).

    These ephemeral development environments

    are automatically created every time you push a new branch or create a

    pull request, and each has a full copy of the data of its parent branch,

    which is created on-the-fly in seconds.


    Our Git implementation supports integrations with third party Git

    providers such as GitHub, Bitbucket, or GitLab, allowing you to simply

    integrate Upsun into your existing workflow.


    ## Using the REST API


    In addition to the Git API, we also offer a REST API that allows you to
    manage

    every aspect of the platform, from managing projects and environments,

    to accessing accounts and subscriptions, to creating robust workflows

    and integrations with your CI systems and internal services.


    These API docs are generated from a standard **OpenAPI (Swagger)**
    Specification document

    which you can find here in [YAML](openapispec-upsun.yaml) and in
    [JSON](openapispec-upsun.json) formats.


    This RESTful API consumes and produces HAL-style JSON over HTTPS,

    and any REST library can be used to access it. On GitHub, we also host

    a few API libraries that you can use to make API access easier, such as our

    [PHP API client](https://github.com/upsun/upsun-sdk-php).


    In order to use the API you will first need to have an [Upsun
    account](https://auth.upsun.com/register/) 

    and [create an API Token](https://docs.upsun.com/anchors/cli/api-token/).


    # Authentication


    ## OAuth2


    API authentication is done with OAuth2 access tokens.


    ### API tokens


    You can use an API token as one way to get an OAuth2 access token. This

    is particularly useful in scripts, e.g. for CI pipelines.


    To create an API token, go to the "API Tokens" section

    of the "Account Settings" tab on the [Console](https://console.upsun.com).


    To exchange this API token for an access token, a `POST` request

    must be made to `https://auth.upsun.com/oauth2/token`.


    The request will look like this in cURL:


    <pre>

    curl -u platform-api-user: \
        -d 'grant_type=api_token&amp;api_token=<em><b>API_TOKEN</b></em>' \
        https://auth.upsun.com/oauth2/token
    </pre>


    This will return a "Bearer" access token that

    can be used to authenticate further API requests, for example:


    <pre>

    {
        "access_token": "<em><b>abcdefghij1234567890</b></em>",
        "expires_in": 900,
        "token_type": "bearer"
    }

    </pre>


    ### Using the Access Token


    To authenticate further API requests, include this returned bearer token

    in the `Authorization` header. For example, to retrieve a list of

    [Projects](#tag/Project)

    accessible by the current user, you can make the following request

    (substituting the dummy token for your own):


    <pre>

    curl -H "Authorization: Bearer <em><b>abcdefghij1234567890</b></em>" \
        https://api.upsun.com/projects
    </pre>


    # HAL Links


    Most endpoints in the API return fields which defines a HAL

    (Hypertext Application Language) schema for the requested endpoint.

    The particular objects returns and their contents can vary by endpoint.

    The payload examples we give here for the requests do not show these

    elements. These links can allow you to create a fully dynamic API client

    that does not need to hardcode any method or schema.


    Unless they are used for pagination we do not show the HAL links in the

    payload examples in this documentation for brevity and as their content

    is contextual (based on the permissions of the user).


    ## _links Objects


    Most endpoints that respond to `GET` requests will include a `_links` object

    in their response. The `_links` object contains a key-object pair labelled
    `self`, which defines

    two further key-value pairs:


    * `href` - A URL string referring to the fully qualified name of the
    returned object. For many endpoints, this will be the direct link to the API
    endpoint on the region gateway, rather than on the general API gateway. This
    means it may reference a host of, for example, `eu-2.platform.sh` rather
    than `api.upsun.com`.

    * `meta` - An object defining the OpenAPI Specification (OAS) [schema
    object](https://swagger.io/specification/#schemaObject) of the component
    returned by the endpoint.


    There may be zero or more other fields in the `_links` object resembling
    fragment identifiers

    beginning with a hash mark, e.g. `#edit` or `#delete`. Each of these keys

    refers to a JSON object containing two key-value pairs:


    * `href` - A URL string referring to the path name of endpoint which can
    perform the action named in the key.

    * `meta` - An object defining the OAS schema of the endpoint. This consists
    of a key-value pair, with the key defining an HTTP method and the value
    defining the [operation
    object](https://swagger.io/specification/#operationObject) of the endpoint.


    To use one of these HAL links, you must send a new request to the URL
    defined

    in the `href` field which contains a body defined the schema object in the
    `meta` field.


    For example, if you make a request such as `GET
    /projects/abcdefghij1234567890`, the `_links`

    object in the returned response will include the key `#delete`. That object

    will look something like this fragment:


    ```

    "#delete": {
        "href": "/api/projects/abcdefghij1234567890",
        "meta": {
            "delete": {
                "responses": {
                    . . . // Response definition omitted for space
                },
                "parameters": []
            }
        }
    }

    ```


    To use this information to delete a project, you would then send a `DELETE`

    request to the endpoint
    `https://api.upsun.com/api/projects/abcdefghij1234567890`

    with no body or parameters to delete the project that was originally
    requested.


    ## _embedded Objects


    Requests to endpoints which create or modify objects, such as `POST`,
    `PATCH`, or `DELETE`

    requests, will include an `_embedded` key in their response. The object

    represented by this key will contain the created or modified object. This

    object is identical to what would be returned by a subsequent `GET` request

    for the object referred to by the endpoint.
  x-logo:
    url: https://docs.upsun.com/images/upsun-api.svg
    href: https://upsun.com/#section/Introduction
    altText: Upsun logo
servers:
  - url: '{schemes}://api.upsun.com'
    description: The Upsun.com API gateway
    variables:
      schemes:
        default: https
security:
  - BearerAuth: []
tags:
  - name: Cert Management
    description: >
      User-supplied SSL/TLS certificates can be managed using these

      endpoints. You can now list and modify certificate provisioners

      using the `/projects/{projectId}/provisioners` and

      `/projects/{projectId}/provisioners/{certificateProvisionerDocumentId}`

      endpoints. For more information, see our

      [Third-party TLS
      certificate](https://docs.upsun.com/anchors/domains/custom/custom-certificates/)

      documentation. These endpoints are not for managing certificates

      that are automatically supplied by Upsun via Let's Encrypt.
  - name: Environment
    description: |
      On Upsun, an environment encompasses a single instance of your
      entire application stack, the services used by the application,
      the application's data storage, and the environment's backups.

      In general, an environment represents a single branch or merge request
      in the Git repository backing a project. It is a virtual cluster
      of read-only application and service containers with read-write
      mounts for application and service data.

      On Upsun, the default branch is your production environment—thus,
      merging changes to this branch will put those changes to production.
  - name: Environment Type
    description: >
      Environment Types is the way Upsun manages access. We currently have 3
      environment types:

      * Development

      * Staging

      * Production


      Each environment type will contain a group of users and their accesses. We
      manage access,

      adding, updating and removing users and their roles, here.


      Each environment will have a type, pointing to one of these 3 environment
      types.

      See `type` in [Environments](#tag/Environment).


      In general:

      * Production will be reserved for the default branch, and cannot be set
      manually.

      * An environment can be set to be type `staging` or development manually
      and when branching.


      Dedicated Generation 2 projects have different rules for environment
      types. If your project

      contains at least one of those Dedicated Generation 2 environments, the
      rules are slightly different:

      * All non-dedicated environments in your project can be `development` or
      `staging`, but never `production`.

      * Dedicated Generation 2 environments can be set either to `staging` or
      `production`, but never `development`.

      * The default branch is not considered to be a special case.
  - name: Environment Backups
    description: |
      A snapshot is a complete backup of an environment, including all the
      persistent data from all services running in an environment and all
      files present in mounted volumes.

      These endpoints can be used to trigger the creation of new backups,
      get information about existing backups, delete existing backups or
      restore a backup.
      More information about backups can be found in our
      [documentation](https://docs.upsun.com/anchors/environments/backup/).
  - name: Environment Variables
    description: >
      These endpoints manipulate user-defined variables which are bound to a

      specific environment, as well as (optionally) the children of an

      environment. These variables can be made available at both build time

      and runtime. For more information on environment variables,

      see the
      [Variables](https://docs.upsun.com/anchors/variables/set/environment/create/)

      section of the documentation.
  - name: Autoscaling
    description: >
      Upsun provides native support for autoscaling, allowing your applications
      to automatically adjust based on resource usage.

      This ensures that your apps remain responsive under load while helping you
      optimize costs.

      You can configure thresholds for metrics such as CPU, RAM, and request
      latency.  

      Resources will automatically scale to meet demand.

      Each container profile assigned to an application or service provides a
      specific combination of CPU and RAM, which you can select via the Upsun UI
      or CLI.


      These endpoints manage autoscaling configurations that are tied to a

      specific environment, and optionally to its child environments.

      You can define scaling rules based on metrics like CPU, memory, or

      request latency, and these rules will be applied at both build time

      and runtime. For more information on configuring autoscaling for your

      environments, see the
      [Autoscaling](https://docs.upsun.com/manage-resources/autoscaling.html)
      section

      of the documentation.
  - name: Project
    description: >
      ## Project Overview


      On Upsun, a Project is backed by a single Git repository

      and encompasses your entire application stack, the services

      used by your application, the application's data storage,

      the production and staging environments, and the backups of those

      environments.


      When you create a new project, you start with a single

      [Environment](#tag/Environment) called *Master*,

      corresponding to the master branch in the Git repository of

      the project—this will be your production environment.


      If you connect your project to an external Git repo

      using one of our [Third-Party Integrations](#tag/Third-Party-Integrations)

      a new development environment can be created for each branch

      or pull request created in the repository. When a new development

      environment is created, the production environment's data

      will be cloned on-the-fly, giving you an isolated, production-ready

      test environment.


      This set of API endpoints can be used to retrieve a list of projects

      associated with an API key, as well as create and update the parameters

      of existing projects.


      > **Note**:

      >

      > To list projects or to create a new project, use
      [`/subscriptions`](#tag/Subscriptions).
  - name: Project Variables
    description: >
      These endpoints manipulate user-defined variables which are bound to an

      entire project. These variables are accessible to all environments

      within a single project, and they can be made available at both build

      time and runtime. For more information on project variables,

      see the
      [Variables](https://docs.upsun.com/anchors/variables/set/project/create/)

      section of the documentation.
  - name: Project Settings
    description: >
      These endpoints can be used to retrieve and manipulate project-level

      settings. Only the `initialize` property can be set by end users. It is
      used

      to initialize a project from an existing Git repository.


      The other properties can only be set by a privileged user.
  - name: Repository
    description: >
      The Git repository backing projects hosted on Upsun can be

      accessed in a **read-only** manner through the
      `/projects/{projectId}/git/*`

      family of endpoints. With these endpoints, you can retrieve objects from

      the Git repository in the same way that you would in a local environment.
  - name: Domain Management
    description: |
      These endpoints can be used to add, modify, or remove domains from
      a project. For more information on how domains function on
      Upsun, see the [Domains](https://docs.upsun.com/anchors/domains/custom/)
      section of our documentation.
  - name: Routing
    description: >
      These endpoints modify an environment's `routes:` section of the
      `.upsun/config.yaml` file.

      For routes to propagate to child environments, the child environments

      must be synchronized with their parent.


      More information about routing can be found in the
      [Routes](https://docs.upsun.com/anchors/routes/)

      section of the documentation.
  - name: Source Operations
    description: >
      These endpoints interact with source code operations as defined in the
      `source.operations`

      key in a project's `.upsun/config.yaml` configuration. More information

      on source code operations is

      [available in our user
      documentation](https://docs.upsun.com/anchors/app/source-operations/).
  - name: Deployment Target
    description: |
      Upsun is capable of deploying the production environments of
      projects in multiple topologies: both in clusters of containers, and
      as dedicated virtual machines. This is an internal API that can
      only be used by privileged users.
  - name: Deployments
    description: |
      The deployments endpoints gives detailed information about the actual
      deployment of an active environment. Currently, it returns the _current_
      deployment with information about the different apps, services, and
      routes contained within.
  - name: Third-Party Integrations
    description: |
      Upsun can easily integrate with many third-party services, including
      Git hosting services (GitHub, GitLab, and Bitbucket),
      health notification services (email, Slack, PagerDuty),
      performance analytics platforms (New Relic, Blackfire, Tideways),
      and webhooks.

      For clarification about what information each field requires, see the
      [External Integrations](https://docs.upsun.com/anchors/integrations/)
      documentation. NOTE: The names of the CLI arguments listed in the
      documentation are not always named exactly the same as the
      required body fields in the API request.
  - name: MFA
    description: >
      Multi-factor authentication (MFA) requires the user to present two (or
      more) types of evidence (or factors) to prove their identity.


      For example, the evidence might be a password and a device-generated code,
      which show the user has the knowledge factor ("something you know") 

      as well as the possession factor ("something you have"). In this way MFA
      offers good protection against the compromise of any single factor, 

      such as a stolen password.


      Using the MFA API you can set up time-based one-time passcodes (TOTP),
      which can be generated on a single registered device ("something you
      have") such as a mobile phone.
  - name: Subscriptions
    description: >
      Each project is represented by a subscription that holds the plan
      information.

      These endpoints can be used to go to a larger plan, add more storage, or
      subscribe to

      optional features.
  - name: Orders
    description: |
      These endpoints can be used to retrieve order information from our billing
      system. Here you can view information about your bill for our services,
      include the billed amount and a link to a PDF of the bill.
  - name: Invoices
    description: >
      These endpoints can be used to retrieve invoices from our billing system.

      An invoice of type "invoice" is generated automatically every month, if
      the customer has active projects.

      Invoices of type "credit_memo" are a result of manual action when there
      was a refund or an invoice correction.
  - name: Vouchers
    description: >
      These endpoints can be used to retrieve vouchers associated with a
      particular

      user as well as apply a voucher to a particular user.
  - name: Records
    description: >
      These endpoints retrieve information about which plans were assigned to a
      particular

      project at which time.
  - name: Support
    description: >
      These endpoints can be used to retrieve information about support ticket
      priority

      and allow you to submit new ticket to the Upsun Support Team.
  - name: System Information
    description: >
      These endpoints can be used to retrieve low-level information and interact
      with the

      core component of Upsun infrastructure.


      This is an internal API that can only be used by privileged users.
paths:
  /projects/{projectId}/environments/{environmentId}/observability/http/breakdown/ips:
    get:
      tags:
        - Http Traffic
      summary: Get HTTP traffic timeline by IP
      description: >-
        Returns HTTP traffic analytics grouped by IP address with IPs ranked by
        impact (response time × request count). Use limit parameter to control
        total items returned (default: 200, max: 300) and top_hits_count to
        control the upper cap on items tracked in timelines (default: 15, max:
        15). At least _breakdown_top_hits.min_quantity IPs are always tracked,
        plus additional IPs up to top_hits_count while cumulative impact is
        below _breakdown_top_hits.max_percentage. Items have a top_hit boolean
        indicating whether they appear in timeline data.
      operationId: http_metrics_timeline_ips
      parameters:
        - name: projectId
          in: path
          description: The unique identifier of the Upsun project
          required: true
          schema:
            type: string
            pattern: '[a-z0-9]+'
            example: abc123def456
        - name: environmentId
          in: path
          description: The environment identifier
          required: true
          schema:
            type: string
            pattern: .+
            example: main
        - name: from
          in: query
          description: Start timestamp for the time range (Unix timestamp in seconds)
          required: true
          schema:
            type: integer
            format: int64
            example: 1704067200
        - name: to
          in: query
          description: End timestamp for the time range (Unix timestamp in seconds)
          required: true
          schema:
            type: integer
            format: int64
            example: 1704153600
        - name: limit
          in: query
          description: 'Maximum number of items to return (default: 200, max: 300)'
          required: false
          schema:
            type: integer
            default: null
            maximum: 300
            minimum: 1
        - name: top_hits_count
          in: query
          description: >-
            Upper cap on items tracked in timeline (default: 15, max: 15). When
            set below the default _breakdown_top_hits.min_quantity floor, the
            response min_quantity is reduced to match this cap.
          required: false
          schema:
            type: integer
            default: null
            maximum: 15
            minimum: 1
        - name: applications[]
          in: query
          description: >-
            Filter by application. Can be specified multiple times for multiple
            values (e.g., ?applications[]=app1&applications[]=app2). Use
            applications_mode to control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: app
        - name: applications_mode
          in: query
          description: >-
            Filter mode for applications parameter. "1" (additive) includes only
            specified applications. "-1" (subtractive, default) excludes
            specified applications and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
        - name: methods[]
          in: query
          description: >-
            Filter by HTTP methods. Can be specified multiple times for multiple
            values (e.g., ?methods[]=GET&methods[]=POST). Use methods_mode to
            control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: GET
              enum:
                - GET
                - POST
                - PUT
                - PATCH
                - DELETE
                - HEAD
                - OPTIONS
        - name: methods_mode
          in: query
          description: >-
            Filter mode for methods parameter. "1" (additive) includes only
            specified methods. "-1" (subtractive, default) excludes specified
            methods and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
        - name: domains[]
          in: query
          description: >-
            Filter by request domains/hosts. Can be specified multiple times for
            multiple values (e.g.,
            ?domains[]=api.example.com&domains[]=www.example.com). Use
            domains_mode to control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: api.example.com
        - name: domains_mode
          in: query
          description: >-
            Filter mode for domains parameter. "1" (additive) includes only
            specified domains. "-1" (subtractive, default) excludes specified
            domains and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
        - name: code_slots[]
          in: query
          description: >-
            Filter by HTTP status code groups. Can be specified multiple times
            for multiple values (e.g., ?code_slots[]=4XX&code_slots[]=5XX). Use
            code_slots_mode to control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: 2XX
              enum:
                - 1XX
                - 2XX
                - 3XX
                - 4XX
                - 5XX
        - name: code_slots_mode
          in: query
          description: >-
            Filter mode for code_slots parameter. "1" (additive) includes only
            specified code groups. "-1" (subtractive, default) excludes
            specified code groups and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
        - name: codes[]
          in: query
          description: >-
            Filter by specific HTTP status codes. Can be specified multiple
            times for multiple values (e.g., ?codes[]=200&codes[]=404). Use
            codes_mode to control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: '200'
        - name: codes_mode
          in: query
          description: >-
            Filter mode for codes parameter. "1" (additive) includes only
            specified codes. "-1" (subtractive, default) excludes specified
            codes and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
        - name: request_duration_slots[]
          in: query
          description: >-
            Filter by response time ranges (in milliseconds). Can be specified
            multiple times for multiple values (e.g.,
            ?request_duration_slots[]=0-50&request_duration_slots[]=1600+). Use
            request_duration_slots_mode to control inclusion/exclusion behavior.
          required: false
          style: form
          explode: true
          schema:
            type: array
            items:
              type: string
              example: 0-50
              enum:
                - 0-50
                - 50-100
                - 100-200
                - 200-400
                - 400-800
                - 800-1600
                - 1600+
        - name: request_duration_slots_mode
          in: query
          description: >-
            Filter mode for request_duration_slots parameter. "1" (additive)
            includes only specified duration ranges. "-1" (subtractive, default)
            excludes specified duration ranges and includes all others.
          required: false
          schema:
            type: string
            example: '1'
            default: null
            enum:
              - '1'
              - '-1'
      responses:
        '200':
          description: HTTP traffic timeline by IP retrieved successfully
          content:
            application/json:
              schema:
                required:
                  - _grain
                  - _from
                  - _to
                  - _project_id
                  - _environment_id
                  - _environment_type
                  - _branch_machine_name
                  - _breakdown_limit
                  - _breakdown_top_hits
                  - breakdown
                  - top_hits_timeline
                properties:
                  _grain:
                    description: Data granularity in seconds
                    type: integer
                    example: 5
                  _from:
                    description: Query start timestamp
                    type: integer
                    example: 1704067200
                  _to:
                    description: Query end timestamp
                    type: integer
                    example: 1704153600
                  _project_id:
                    description: Project identifier
                    type: string
                    example: abc123def456
                  _environment_id:
                    description: Environment identifier
                    type: string
                    example: main
                  _environment_type:
                    description: Environment type
                    type: string
                    example: production
                    enum:
                      - production
                      - staging
                      - development
                  _branch_machine_name:
                    description: Branch machine name
                    type: string
                    example: main-bvxea6i
                  _breakdown_limit:
                    description: Maximum number of items returned
                    type: integer
                    example: 200
                  _breakdown_top_hits:
                    description: >-
                      Configuration for top hits selection. At least
                      min_quantity items are tracked, up to max_quantity,
                      stopping early once max_percentage of total impact is
                      covered.
                    required:
                      - min_quantity
                      - max_quantity
                      - max_percentage
                    properties:
                      min_quantity:
                        description: >-
                          Minimum number of top hit items always tracked in
                          timeline, regardless of cumulative impact
                        type: integer
                        example: 10
                      max_quantity:
                        description: Maximum number of top hit items tracked in timeline
                        type: integer
                        example: 15
                      max_percentage:
                        description: >-
                          Cumulative impact percentage at which top hit
                          selection stops (above min_quantity)
                        type: number
                        format: float
                        example: 98
                    type: object
                    additionalProperties: false
                  _applications:
                    description: Applied application filter values
                    type: array
                    items:
                      type: string
                      example: app
                    nullable: true
                  _applications_mode:
                    description: Application filter mode (1=additive, -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  _methods:
                    description: Applied method filter values
                    type: array
                    items:
                      type: string
                      example: GET
                    nullable: true
                  _methods_mode:
                    description: Method filter mode (1=additive, -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  _domains:
                    description: Applied domain filter values
                    type: array
                    items:
                      type: string
                      example: example.com
                    nullable: true
                  _domains_mode:
                    description: Domain filter mode (1=additive, -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  _code_slots:
                    description: Applied code slot filter values
                    type: array
                    items:
                      type: string
                      example: 2XX
                    nullable: true
                  _code_slots_mode:
                    description: Code slot filter mode (1=additive, -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  _codes:
                    description: Applied HTTP status code filter values
                    type: array
                    items:
                      type: string
                      example: '200'
                    nullable: true
                  _codes_mode:
                    description: Code filter mode (1=additive, -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  _request_duration_slots:
                    description: Applied request duration slot filter values
                    type: array
                    items:
                      type: string
                      example: 0-100
                    nullable: true
                  _request_duration_slots_mode:
                    description: >-
                      Request duration slot filter mode (1=additive,
                      -1=subtractive)
                    type: string
                    nullable: true
                    enum:
                      - '1'
                      - '-1'
                  breakdown:
                    description: IP addresses ranked by impact
                    required:
                      - kind
                      - total
                      - data
                    properties:
                      kind:
                        description: The kind of grouping
                        type: string
                        example: ip
                        enum:
                          - ip
                      total:
                        description: Total request count across all IPs
                        type: integer
                        example: 396519
                      data:
                        description: >-
                          List of items ranked by impact. At least
                          _breakdown_top_hits.min_quantity items are tracked in
                          top_hits_timeline, up to
                          _breakdown_top_hits.max_quantity, stopping early once
                          _breakdown_top_hits.max_percentage of total impact is
                          covered.
                        type: array
                        items:
                          required:
                            - name
                            - impact
                            - average
                            - p_50
                            - p_96
                            - count
                            - top_hit
                          properties:
                            name:
                              description: The IP address
                              type: string
                              example: 192.168.1.1
                            impact:
                              description: >-
                                Impact score as percentage of total wall time
                                consumed
                              type: number
                              format: float
                              example: 15.67
                            average:
                              description: Average request duration in seconds
                              type: number
                              format: float
                              example: 0.234
                            p_50:
                              description: >-
                                50th percentile (median) request duration in
                                seconds
                              type: number
                              format: float
                              example: 0.156
                            p_96:
                              description: 96th percentile request duration in seconds
                              type: number
                              format: float
                              example: 0.892
                            count:
                              description: Total number of requests from this IP
                              type: integer
                              example: 62143
                            top_hit:
                              description: >-
                                Whether this item is tracked in
                                top_hits_timeline
                              type: boolean
                              example: true
                          type: object
                          additionalProperties: false
                        example:
                          - name: 192.168.1.1
                            impact: 15.67
                            average: 0.234
                            p_50: 0.156
                            p_96: 0.892
                            count: 62143
                            top_hit: true
                          - name: 10.0.0.5
                            impact: 12.34
                            average: 0.189
                            p_50: 0.123
                            p_96: 0.756
                            count: 48921
                            top_hit: true
                          - name: 172.16.0.10
                            impact: 8.45
                            average: 0.312
                            p_50: 0.201
                            p_96: 1.234
                            count: 33512
                            top_hit: false
                    type: object
                    additionalProperties: false
                  top_hits_timeline:
                    description: Time-series data for top hit items
                    required:
                      - data
                    properties:
                      data:
                        description: >-
                          Time-series HTTP traffic metrics for top hit IPs.
                          Fields are omitted for timestamps with no data.
                        type: array
                        items:
                          required:
                            - timestamp
                          properties:
                            timestamp:
                              description: Data point timestamp
                              type: integer
                              example: 1704067200
                            _total_consumed:
                              description: >-
                                Total wall-time consumed across all items at
                                this interval
                              type: number
                              format: float
                              example: 5678.9
                            _total_count:
                              description: >-
                                Total request count at this timestamp across all
                                IPs. Consider 0 if absent
                              type: integer
                              example: 4120
                            data:
                              description: >-
                                Per-IP metrics at this timestamp. Only includes
                                top hit items.
                              type: object
                              example:
                                192.168.1.1:
                                  count: 1543
                                  impact: 37.45
                                10.0.0.5:
                                  count: 1247
                                  impact: 30.26
                              additionalProperties:
                                required:
                                  - count
                                  - impact
                                properties:
                                  count:
                                    description: >-
                                      Request count from this IP at this
                                      timestamp
                                    type: integer
                                    example: 1543
                                  impact:
                                    description: >-
                                      Impact score as percentage of wall time
                                      consumed at this timestamp
                                    type: number
                                    format: float
                                    example: 37.45
                                    nullable: true
                                type: object
                                additionalProperties: false
                          type: object
                          additionalProperties: false
                        example:
                          - timestamp: 1704067200
                            _total_consumed: 5678.9
                            _total_count: 4120
                            data:
                              192.168.1.1:
                                count: 1543
                                impact: 37.45
                          - timestamp: 1704070800
                          - timestamp: 1704074400
                            _total_consumed: 4321.2
                            _total_count: 3891
                            data:
                              10.0.0.5:
                                count: 1247
                                impact: 30.26
                    type: object
                    additionalProperties: false
                type: object
                additionalProperties: false
        '400':
          description: >-
            Bad request - Invalid parameters. Please consult the API
            documentation to fix the request parameters.
          content:
            application/json:
              schema:
                required:
                  - type
                  - title
                  - status
                  - violations
                properties:
                  type:
                    description: RFC 2616 reference URL identifying the error type
                    type: string
                    format: uri
                    example: https://tools.ietf.org/html/rfc2616#section-1
                  title:
                    description: Human-readable summary of the validation error
                    type: string
                    example: Please ensure parameters are correct.
                  status:
                    description: HTTP status code
                    type: integer
                    example: 400
                  violations:
                    description: >-
                      Map of parameter names to their validation errors. Each
                      parameter can have multiple error messages.
                    type: object
                    example:
                      grain:
                        - Grain can not be larger than the selection windows.
                      from:
                        - The from timestamp must be in the past.
                      to:
                        - >-
                          The to timestamp must be greater than the from
                          timestamp.
                    additionalProperties:
                      type: array
                      items:
                        type: string
                        example: The from timestamp must be in the past.
                type: object
                additionalProperties: false
        '403':
          description: >-
            Forbidden - Access denied due to insufficient permissions, or the
            requested project/environment does not exist (to prevent information
            disclosure)
        '499':
          description: >-
            Too much data fetched - The query is attempting to retrieve too much
            data. Please narrow down the query by reducing the time range or
            adding more specific filters to retrieve less data.
          content:
            application/json:
              schema:
                required:
                  - error
                  - message
                properties:
                  error:
                    type: string
                    example: Too much data fetched
                  message:
                    type: string
                    example: >-
                      Please reduce the time range or add more filters to narrow
                      down the query
                type: object
                additionalProperties: false
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer

````