> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/using-link11/api/network-ddos/ip-accounting-reporting.md).

# IP Accounting / Reporting

IP Accounting provides Network DDoS customers with traffic metric information. This API can be used to view the total bytes sent and received by Link11 for a given destination network. Data can be returned in either JSON or CSV format.

{% hint style="info" %}
The information below assumes you have already the [Introduction to the Link11 API](/using-link11/api/introduction.md).
{% endhint %}

## Service Key definition

`apikey=l11ddosflow`

## Domain Key definition <a href="#id-customerapi-webddos-webddoscommands" id="id-customerapi-webddos-webddoscommands"></a>

For the commands that include a Domain Key (referred to below as $DOMAINKEY), use the [API Key for the instance from WebGUI](broken://pages/VUDuLHzvFgR0480bepBo).

***

## API commands <a href="#id-customerapi-infrastructureddos-infrastructureddosapicommands" id="id-customerapi-infrastructureddos-infrastructureddosapicommands"></a>

### **Get Statistics**

`https://api.link11.de/?apikey=l11ddosflow&format=csv&key=[$DOMAINKEY]&from=[Epoch Timestamp]&to=[Epoch Timestamp]&timeaggregate=[Time in Seconds]&prefixaggregate=[Prefix Mask]&prefix=[Customer Prefix]`

<table><thead><tr><th width="185">Parameter</th><th width="200">Example</th><th>Description</th></tr></thead><tbody><tr><td>apikey</td><td>l11ddosflow</td><td>Identifies IP Accounting as the target for this command.</td></tr><tr><td>key</td><td>ed76dd7e490f3f2e5afb9ddd848301ef</td><td>The Domain Key described <a href="#id-customerapi-webddos-webddoscommands">above</a>.</td></tr><tr><td>format</td><td>json</td><td>The format of the returned data. Can be either json or csv</td></tr><tr><td>from</td><td>1693551600</td><td>Unix timestamp in UTC determining the start time/date of the query</td></tr><tr><td>to</td><td>1696143600</td><td>Unix timestamp in UTC determining the end time/date of the query</td></tr><tr><td>timeaggregate</td><td>3600</td><td><p>The bucket size for the returned records in seconds. To return data in one-hour buckets, set the value to 3600 (seconds in an hour)</p><p><strong>Note:</strong> the maximum supported timeaggregate value is 86400 (24 hours)</p></td></tr><tr><td>type</td><td>clientbytes</td><td><p><code>clientbytes</code></p><ul><li>returns statistics between the requestor (client) and the Link11 proxies</li></ul><p><code>serverbytes</code></p><ul><li>returns statistics between the Link11 proxies and the customer origin</li></ul><p><code>total</code></p><ul><li>returns the combined statistics for clientbytes and serverbytes</li></ul></td></tr><tr><td>prefixaggregate</td><td>32</td><td>Determines the grouping of IPs within the range. To see IP Accounting data for individual destination IPs use a /32; to see aggregate IP Accounting data for the whole range set this value to the Prefix mask for the range.</td></tr><tr><td>prefix</td><td>31.214.215.0/24</td><td>The relevant customer prefix. The format for this field is prefix/mask (eg. xxx.xxx.xxx.xxx/24)</td></tr><tr><td>skipheader</td><td></td><td>Used to remove the “200 OK” message from the response</td></tr></tbody></table>

<br>