{"_id":"5a0f7cdd8662de0012254f66","project":"5615790c0f5ed00d00483dd1","version":{"_id":"5615790d0f5ed00d00483dd4","__v":6,"project":"5615790c0f5ed00d00483dd1","createdAt":"2015-10-07T19:57:01.307Z","releaseDate":"2015-10-07T19:57:01.307Z","categories":["5615790d0f5ed00d00483dd5","56157b2af432910d0000f9fe","56157cfb0f5ed00d00483ddb","562684d95db46b1700fd4f48","573b7ea9ef164e2900a2b8ff","582e285d8373c20f00810608"],"is_deprecated":false,"is_hidden":false,"is_beta":false,"is_stable":true,"codename":"","version_clean":"1.0.0","version":"1.0"},"category":{"_id":"5615790d0f5ed00d00483dd5","__v":19,"pages":["5615790e0f5ed00d00483dd7","561d48e46386060d00e06003","561d48fe31d9630d001eb5bd","561d49b657165b0d00aa5d8b","561d4a879463520d00cd11e2","561d67f48ca8b90d00210234","561d6a0bf0cff80d00ca22c3","561d6c5b071cd60d000d3221","562f9c2543c5570d001fe6bd","56311c99eae7ef0d00270e3d","56311d6702aff217007dba23","56311f96f1c0580d00fac719","563120b7242cda1900198b79","5631229bf1c0580d00fac721","563131559ead230d00a188f6","563134a324014b0d00bd9a4f","5631392082d96a0d00b0fb1d","56313c584b36120d00fdebfb","5642658ef424a10d00118360"],"project":"5615790c0f5ed00d00483dd1","version":"5615790d0f5ed00d00483dd4","sync":{"url":"","isSync":false},"reference":false,"createdAt":"2015-10-07T19:57:01.871Z","from_sync":false,"order":0,"slug":"opendns-investigate-rest-api","title":"Umbrella Investigate REST API"},"user":"560b40145148ba0d009bd0b5","__v":0,"parentDoc":null,"updates":[],"next":{"pages":[],"description":""},"createdAt":"2017-11-18T00:20:45.903Z","link_external":false,"link_url":"","githubsync":"","sync_unique":"","hidden":false,"api":{"settings":"","results":{"codes":[]},"auth":"required","params":[],"url":""},"isReference":false,"order":8,"body":"The domain volume endpoint shows the number of DNS queries made per hour to the specified domain by users of Umbrella's recursive DNS servers.\n\nThis endpoint only supports domains and the most recent hour or two will be blank as the data is still being collected and compiled.  The data extends for the last 30 days.\n\nIf there is no information about the domain, a blank array is returned. There is no bulk (post request) option at this time. Only get requests are supported.\n\nsample query:\n[block:code]\n{\n  \"codes\": [\n    {\n      \"code\": \"curl -H \\\"Authorization: Bearer %YourToken%\\\" \\\"https://investigate.api.umbrella.com/domains/volume/domain.com?start=-2days&stop=now&match=component\\\"\",\n      \"language\": \"text\"\n    }\n  ]\n}\n[/block]\n### Parameter for input ###\n[block:parameters]\n{\n  \"data\": {\n    \"h-0\": \"Field\",\n    \"h-1\": \"Type\",\n    \"h-2\": \"Description\",\n    \"0-0\": \"domain\",\n    \"0-1\": \"string\",\n    \"0-2\": \"domain name only. This parameter is required.\",\n    \"1-0\": \"start\",\n    \"1-1\": \"string\",\n    \"1-2\": \"point in time in the past, either in english or a timestamp in milliseconds. start=-2days, start=-2hours, start=1509332100000 are all valid. Note the negative sign.  The max is 30 days.\",\n    \"2-0\": \"stop\",\n    \"2-2\": \"point in time in the past, or now. stop=-1days, stop=now, stop=1509642000000 are all valid. Again note the negative sign. The max is 30 days.\",\n    \"2-1\": \"string\",\n    \"3-0\": \"match\",\n    \"3-1\": \"string\",\n    \"3-2\": \"valid options are: **exact, component, or all (default).**\\n\\nUsing \\\"cisco.com\\\" as an example, **\\\"exact\\\"** only gives results for cisco.com. \\n\\n**\\\"Component\\\"** gives results for every component of cisco.com, **but not** cisco.com. Examples are www.cisco.com, mail.cisco.com, wwwin.cisco.com, something.else.cisco.com. \\n\\n**\\\"All\\\"** returns the sum of component and exact, this is the default.\"\n  },\n  \"cols\": 3,\n  \"rows\": 4\n}\n[/block]\n### Returned value for output if Success 200 ###\n[block:parameters]\n{\n  \"data\": {\n    \"h-0\": \"Field\",\n    \"h-1\": \"Type\",\n    \"h-2\": \"Description\",\n    \"0-0\": \"dates\",\n    \"1-0\": \"queries\",\n    \"0-1\": \"array of integers\",\n    \"0-2\": \"dates for which the data is returned in Unix epoch time.\",\n    \"1-1\": \"array of integers\",\n    \"1-2\": \"number of DNS queries per hour, in ascending order, to the specified domain.\"\n  },\n  \"cols\": 3,\n  \"rows\": 2\n}\n[/block]\nIn this example, the volume for the domain is for the previous day up to the current time.  The last two hours are 0 because the data set has not yet been counted.\n[block:html]\n{\n  \"html\": \"<div class=\\\"api-code-block\\\">\\n  <div class=\\\"api-code-block__header\\\">\\n    <span class=\\\"api-code-block__header__label\\\">GET</span> https://investigate.api.umbrella.com/domains/volume/{domain.com}?start=-1days&stop=now&match=component\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">REQUEST</div>\\n    <pre>curl --include \\\\\\n     --header \\\"Authorization: Bearer %YourToken%\\\" \\\\\\nhttps://investigate.api.umbrella.com/domains/volume/{domain.com}?start=-1days&stop=now&match=component\\n    </pre>\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">RESPONSE <em>(HTTP 200, Content-Type: application/json)</em>\\n    </div>\\n    <pre>\\n{\\n\\tdates: [\\n\\t\\t1510873200000,\\n\\t\\t1510959600000\\n\\t]\\n\\tqueries: [\\n\\t\\t1378426,\\n\\t\\t1361934,\\n\\t\\t1308188,\\n\\t\\t1238823,\\n\\t\\t1245126,\\n\\t\\t1215994,\\n\\t\\t1256917,\\n\\t\\t1200190,\\n\\t\\t1245963,\\n\\t\\t1355719,\\n\\t\\t1332685,\\n\\t\\t1319825,\\n\\t\\t1362464,\\n\\t\\t1457174,\\n\\t\\t1695448,\\n\\t\\t1863652,\\n\\t\\t1928007,\\n\\t\\t2000451,\\n\\t\\t1903316,\\n\\t\\t1853935,\\n\\t\\t1814257,\\n\\t\\t1738478,\\n\\t\\t1601848,\\n\\t\\t0,\\n\\t\\t0\\n\\t]\\n}\\n    </pre>\\n  </div>\"\n}\n[/block]","excerpt":"","slug":"domain-volume","type":"basic","title":"Domain Volume"}
The domain volume endpoint shows the number of DNS queries made per hour to the specified domain by users of Umbrella's recursive DNS servers. This endpoint only supports domains and the most recent hour or two will be blank as the data is still being collected and compiled. The data extends for the last 30 days. If there is no information about the domain, a blank array is returned. There is no bulk (post request) option at this time. Only get requests are supported. sample query: [block:code] { "codes": [ { "code": "curl -H \"Authorization: Bearer %YourToken%\" \"https://investigate.api.umbrella.com/domains/volume/domain.com?start=-2days&stop=now&match=component\"", "language": "text" } ] } [/block] ### Parameter for input ### [block:parameters] { "data": { "h-0": "Field", "h-1": "Type", "h-2": "Description", "0-0": "domain", "0-1": "string", "0-2": "domain name only. This parameter is required.", "1-0": "start", "1-1": "string", "1-2": "point in time in the past, either in english or a timestamp in milliseconds. start=-2days, start=-2hours, start=1509332100000 are all valid. Note the negative sign. The max is 30 days.", "2-0": "stop", "2-2": "point in time in the past, or now. stop=-1days, stop=now, stop=1509642000000 are all valid. Again note the negative sign. The max is 30 days.", "2-1": "string", "3-0": "match", "3-1": "string", "3-2": "valid options are: **exact, component, or all (default).**\n\nUsing \"cisco.com\" as an example, **\"exact\"** only gives results for cisco.com. \n\n**\"Component\"** gives results for every component of cisco.com, **but not** cisco.com. Examples are www.cisco.com, mail.cisco.com, wwwin.cisco.com, something.else.cisco.com. \n\n**\"All\"** returns the sum of component and exact, this is the default." }, "cols": 3, "rows": 4 } [/block] ### Returned value for output if Success 200 ### [block:parameters] { "data": { "h-0": "Field", "h-1": "Type", "h-2": "Description", "0-0": "dates", "1-0": "queries", "0-1": "array of integers", "0-2": "dates for which the data is returned in Unix epoch time.", "1-1": "array of integers", "1-2": "number of DNS queries per hour, in ascending order, to the specified domain." }, "cols": 3, "rows": 2 } [/block] In this example, the volume for the domain is for the previous day up to the current time. The last two hours are 0 because the data set has not yet been counted. [block:html] { "html": "<div class=\"api-code-block\">\n <div class=\"api-code-block__header\">\n <span class=\"api-code-block__header__label\">GET</span> https://investigate.api.umbrella.com/domains/volume/{domain.com}?start=-1days&stop=now&match=component\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">REQUEST</div>\n <pre>curl --include \\\n --header \"Authorization: Bearer %YourToken%\" \\\nhttps://investigate.api.umbrella.com/domains/volume/{domain.com}?start=-1days&stop=now&match=component\n </pre>\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">RESPONSE <em>(HTTP 200, Content-Type: application/json)</em>\n </div>\n <pre>\n{\n\tdates: [\n\t\t1510873200000,\n\t\t1510959600000\n\t]\n\tqueries: [\n\t\t1378426,\n\t\t1361934,\n\t\t1308188,\n\t\t1238823,\n\t\t1245126,\n\t\t1215994,\n\t\t1256917,\n\t\t1200190,\n\t\t1245963,\n\t\t1355719,\n\t\t1332685,\n\t\t1319825,\n\t\t1362464,\n\t\t1457174,\n\t\t1695448,\n\t\t1863652,\n\t\t1928007,\n\t\t2000451,\n\t\t1903316,\n\t\t1853935,\n\t\t1814257,\n\t\t1738478,\n\t\t1601848,\n\t\t0,\n\t\t0\n\t]\n}\n </pre>\n </div>" } [/block]