NetBird Full API Reference + Read-Only MCP Prototype
GET/api/events/network-traffic

List network traffic events

Lists network traffic events and supports filtering by user, endpoints, protocol, event type, connection type, direction, search text, and date range. Use page and page_size to paginate the results; page_size defaults to 1000 and is limited to 50000.

13 parameters
pageintegeroptional
Page number, starting at 1. Defaults to 1 when omitted.
Default:1
page_sizeintegeroptional
Number of events per page. Must be between 1 and 50000. Defaults to 1000 when omitted.
Default:1000
user_idstringoptional
Filter events by user ID.
reporter_idstringoptional
Filter events by reporter ID.
source_idstringoptional
Filter events by source endpoint ID.
destination_idstringoptional
Filter events by destination endpoint ID.
protocolintegeroptional
Filter events by protocol number.
typestringoptional
Filter by event type: TYPE_UNKNOWN, TYPE_START, TYPE_END, or TYPE_DROP.
Allowed:TYPE_UNKNOWNTYPE_STARTTYPE_ENDTYPE_DROP
connection_typestringoptional
Filter by connection type: P2P or ROUTED.
Allowed:P2PROUTED
directionstringoptional
Filter by direction: INGRESS, EGRESS, or DIRECTION_UNKNOWN.
Allowed:INGRESSEGRESSDIRECTION_UNKNOWN
searchstringoptional
Case-insensitive partial match against user email, source or destination names, and source or destination addresses.
start_datestringoptional
Start of the event date range in ISO 8601 date-time format.
end_datestringoptional
End of the event date range in ISO 8601 date-time format.

5 status codes
200Returns a paginated response containing network traffic events in `data` and pagination metadata: `page`, `page_size`, `total_records`, and `total_pages`.
dataarray<object>required
List of network traffic events
pageintegerrequired
Current page number
page_sizeintegerrequired
Number of items per page
total_pagesintegerrequired
Total number of pages available
total_recordsintegerrequired
Total number of event records available
400Returned when a parameter fails validation, such as an out-of-range page value, an unsupported enum value, or an invalid date-time format.
401Returned when authentication is required but missing or invalid.
403Returned when access to network traffic events is forbidden.
500Returned when an internal server error occurs.

Error handling

A 400 is returned when page or page_size is below 1, page_size exceeds 50000, a filter value is outside its allowed enum, or a date filter is not a valid ISO 8601 date-time. A 401 is returned when authentication is required but missing or invalid; a 403 indicates access is forbidden, and a 500 indicates an internal server error.