---
title: Querying Cloudflare Network Firewall Samples with GraphQL
description: Query Network Firewall packet samples via GraphQL.
image: https://developers.cloudflare.com/core-services-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/analytics/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Querying Cloudflare Network Firewall Samples with GraphQL

In this example, we are going to use the GraphQL Analytics API to query for Cloudflare Network Firewall Samples over a specified time period.

The following API call will request Cloudflare Network Firewall Samples over a one hour period, and output the requested fields. Be sure to replace `<CLOUDFLARE_ACCOUNT_TAG>` and `<API_TOKEN>`[1](#user-content-fn-1) with your zone tag and API credentials, and adjust the `datetime_geg` and `datetime_leq` values to your liking.

## API Call

Terminal window

```
echo '{ "query":  "query MFWActivity {    viewer {      accounts(filter: { accountTag: $accountTag }) {        magicFirewallSamplesAdaptiveGroups(          filter: $filter          limit: 10          orderBy: [datetimeFiveMinute_DESC]        ) {          sum {            bits            packets          }          dimensions {            datetimeFiveMinute            ruleId          }        }      }    }  }",  "variables": {    "accountTag": "<CLOUDFLARE_ACCOUNT_TAG>",    "filter": {      "datetime_geq": "2022-07-24T11:00:00Z",      "datetime_leq": "2022-07-24T11:10:00Z"    }  }}' | tr -d '\n' | curl --silent \https://api.cloudflare.com/client/v4/graphql \--header "Authorization: Bearer <API_TOKEN>" \--header "Accept: application/json" \--header "Content-Type: application/json" \--data @-
```

The returned values represent the total number of packets and bits received during the five minute interval for a particular rule. The result will be in JSON (as requested), so piping the output to `jq` will make it easier to read, like in the following example:

Terminal window

```
... | curl --silent \https://api.cloudflare.com/client/v4/graphql \--header "Authorization: Bearer <API_TOKEN>" \--header "Accept: application/json" \--header "Content-Type: application/json" \--data @- | jq .
#=> {#=>   "data": {#=>     "viewer": {#=>       "accounts": [#=>         {#=>           "magicFirewallSamplesAdaptiveGroups": [#=>             {#=>               sum: { bits:  327680, packets: 16384 },#=>               dimensions: {#=>                 datetimeFiveMinute: '2021-05-12T22:00-00:00',#=>                 ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'#=>               }#=>             },#=>             {#=>               sum: { bits:  360448, packets: 8192 },#=>               dimensions: {#=>                 datetimeFiveMinute: '2021-05-12T22:05-00:00',#=>                 ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'#=>               }#=>             },#=>             {#=>               sum: { bits:  327680, packets: 8192 },#=>               dimensions: {#=>                 datetimeFiveMinute: '2021-05-12T22:05-00:00',#=>                 ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'#=>               }#=>             },#=>             {#=>               sum: { bits:  360448, packets: 8192 },#=>               dimensions: {#=>                 datetimeFiveMinute: '2021-05-12T22:20-00:00',#=>                 ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'#=>               }#=>             },#=>             {#=>               sum: { bits:  327680, packets: 8192 },#=>               dimensions: {#=>                 datetimeFiveMinute: '2021-05-12T22:20-00:00',#=>                 ruleId: 'bdfa8f8f0ae142b4a70ef15f6160e532'#=>               }#=>             }#=>           ]#=>         }#=>       ]#=>     }#=>   },#=>   "errors": null#=> }
```

## Footnotes

1. Refer to [Configure an Analytics API token](https://developers.cloudflare.com/analytics/graphql-api/getting-started/authentication/api-token-auth/) for more information on configuration and permissions. [↩](#user-content-fnref-1)

```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-network-firewall-samples/#page","headline":"Querying Cloudflare Network Firewall Samples with GraphQL · Cloudflare Analytics docs","description":"Query Network Firewall packet samples via GraphQL.","url":"https://developers.cloudflare.com/analytics/graphql-api/tutorials/querying-network-firewall-samples/","inLanguage":"en","image":"https://developers.cloudflare.com/core-services-preview.png","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/analytics/","name":"Analytics"}},{"@type":"ListItem","position":3,"item":{"@id":"/analytics/graphql-api/","name":"GraphQL Analytics API"}},{"@type":"ListItem","position":4,"item":{"@id":"/analytics/graphql-api/tutorials/","name":"Tutorials"}},{"@type":"ListItem","position":5,"item":{"@id":"/analytics/graphql-api/tutorials/querying-network-firewall-samples/","name":"Querying Cloudflare Network Firewall Samples with GraphQL"}}]}
```