--- title: Get time series distribution of HTTP authentication requests by dimension. --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Radar](https://developers.cloudflare.com/api/go/resources/radar) [Leaked Credentials](https://developers.cloudflare.com/api/go/resources/radar/subresources/leaked_credentials) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Get time series distribution of HTTP authentication requests by dimension. client.Radar.LeakedCredentials.TimeseriesGroupsV2(ctx, dimension, query) (\*[LeakedCredentialTimeseriesGroupsV2Response](), error) GET/radar/leaked\_credential\_checks/timeseries\_groups/{dimension} Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `User Details Write``User Details Read` ##### ParametersExpand Collapse

dimension LeakedCredentialTimeseriesGroupsV2ParamsDimension Specifies the attribute by which to group the results.

One of the following: const LeakedCredentialTimeseriesGroupsV2ParamsDimensionCompromised LeakedCredentialTimeseriesGroupsV2ParamsDimension = "COMPROMISED" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsDimensionBotClass LeakedCredentialTimeseriesGroupsV2ParamsDimension = "BOT\_CLASS" Link to this property

[Link to this property](<#(resource)%20radar.leaked_credentials%20%3E%20(method)%20timeseries_groups_v2%20%3E%20(params)%20default%20%3E%20(param)%20dimension%20%3E%20(schema)>)

query LeakedCredentialTimeseriesGroupsV2Params

AggInterval param.Field\[LeakedCredentialTimeseriesGroupsV2ParamsAggInterval]Optional Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals. When omitted, the interval is auto-selected from the requested date range; finer intervals are only available for shorter ranges. If the requested interval is too granular for the date range, the request is rejected.

Link to this property ASN param.Field\[\[]string]Optional Filters results by Autonomous System. Specify one or more Autonomous System Numbers (ASNs) as a comma-separated list. Prefix with - to exclude ASNs from results. For example, -174, 3356 excludes results from AS174, but includes results from AS3356. Link to this property

BotClass param.Field\[\[]LeakedCredentialTimeseriesGroupsV2ParamsBotClass]Optional Filters results by bot class. Refer to Bot classes.

const LeakedCredentialTimeseriesGroupsV2ParamsBotClassLikelyAutomated LeakedCredentialTimeseriesGroupsV2ParamsBotClass = "LIKELY\_AUTOMATED" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsBotClassLikelyHuman LeakedCredentialTimeseriesGroupsV2ParamsBotClass = "LIKELY\_HUMAN" Link to this property

Link to this property

CheckResult param.Field\[\[]LeakedCredentialTimeseriesGroupsV2ParamsCheckResult]Optional Filters results by leaked credential check result.

const LeakedCredentialTimeseriesGroupsV2ParamsCheckResultClean LeakedCredentialTimeseriesGroupsV2ParamsCheckResult = "CLEAN" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsCheckResultUsernameLeaked LeakedCredentialTimeseriesGroupsV2ParamsCheckResult = "USERNAME\_LEAKED" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsCheckResultUsernamePasswordSimilar LeakedCredentialTimeseriesGroupsV2ParamsCheckResult = "USERNAME\_PASSWORD\_SIMILAR" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsCheckResultUsernameAndPasswordLeaked LeakedCredentialTimeseriesGroupsV2ParamsCheckResult = "USERNAME\_AND\_PASSWORD\_LEAKED" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsCheckResultPasswordLeaked LeakedCredentialTimeseriesGroupsV2ParamsCheckResult = "PASSWORD\_LEAKED" Link to this property

Link to this property

Compromised param.Field\[\[]LeakedCredentialTimeseriesGroupsV2ParamsCompromised]Optional Filters results by compromised credential status (clean vs. compromised).

const LeakedCredentialTimeseriesGroupsV2ParamsCompromisedClean LeakedCredentialTimeseriesGroupsV2ParamsCompromised = "CLEAN" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsCompromisedCompromised LeakedCredentialTimeseriesGroupsV2ParamsCompromised = "COMPROMISED" Link to this property

Link to this property Continent param.Field\[\[]string]Optional Filters results by continent. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude continents from results. For example, -EU,NA excludes results from EU, but includes results from NA. Link to this property DateEnd param.Field\[\[]Time]Optional End of the date range (inclusive). Alternative to dateRange; provide together with dateStart. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected. Link to this property DateRange param.Field\[\[]string]Optional Filters results by relative date range ending at the current time, with each value producing a separate series. Use <n>d for days (up to 364d) or <n>w for weeks (up to 52w). Append control to request the equivalent previous period for comparison: the comparison window is shifted back by the current window’s length rounded up to a whole number of weeks, so it keeps the same weekday alignment and does not overlap the current window (e.g. 7dcontrol covers days -14 to -7, 10dcontrol covers days -24 to -14). For example, pass 7d and 7dcontrol to compare this week with the previous week. All series must resolve to the same duration as the main series; relative ranges (including control) satisfy this automatically. Use this parameter or set specific start and end dates (dateStart and dateEnd parameters). Link to this property DateStart param.Field\[\[]Time]Optional Start of the date range. Alternative to dateRange; provide together with dateEnd. When requesting comparison series, every series must resolve to the same duration as the main series. Each dateStart/dateEnd is floored to the nearest 15 minutes before evaluation, so windows whose durations match only before alignment may be rejected. Link to this property

Format param.Field\[LeakedCredentialTimeseriesGroupsV2ParamsFormat]Optional Format in which results will be returned.

const LeakedCredentialTimeseriesGroupsV2ParamsFormatJson LeakedCredentialTimeseriesGroupsV2ParamsFormat = "JSON" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsFormatCsv LeakedCredentialTimeseriesGroupsV2ParamsFormat = "CSV" Link to this property

Link to this property LimitPerGroup param.Field\[int64]Optional Limits the number of objects per group to the top items within the specified time range. When item count exceeds the limit, extra items appear grouped under an “other” category. Only supported on high-cardinality dimensions; otherwise the request is rejected. Minimum value is 2. Link to this property Location param.Field\[\[]string]Optional Filters results by location. Specify a comma-separated list of alpha-2 codes. Prefix with - to exclude locations from results. For example, -US,PT excludes results from the US, but includes results from PT. Link to this property Name param.Field\[\[]string]Optional Array of names used to label the series in the response. Link to this property

Normalization param.Field\[LeakedCredentialTimeseriesGroupsV2ParamsNormalization]Optional Normalization method applied to the results. Refer to Normalization methods. PERCENTAGE_CHANGE requires exactly one comparison series (e.g. a control date range).

const LeakedCredentialTimeseriesGroupsV2ParamsNormalizationPercentageChange LeakedCredentialTimeseriesGroupsV2ParamsNormalization = "PERCENTAGE\_CHANGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ParamsNormalizationMin0Max LeakedCredentialTimeseriesGroupsV2ParamsNormalization = "MIN0\_MAX" Link to this property

Link to this property

[Link to this property](<#(resource)%20radar.leaked_credentials%20%3E%20(method)%20timeseries_groups_v2%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse

type LeakedCredentialTimeseriesGroupsV2Response struct{…}

Meta LeakedCredentialTimeseriesGroupsV2ResponseMeta Metadata for the results.

AggInterval LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval Aggregation interval of the results (e.g., in 15 minutes or 1 hour intervals). Refer to Aggregation intervals.

One of the following: const LeakedCredentialTimeseriesGroupsV2ResponseMetaAggIntervalFifteenMinutes LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval = "FIFTEEN\_MINUTES" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaAggIntervalOneHour LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval = "ONE\_HOUR" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaAggIntervalOneDay LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval = "ONE\_DAY" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaAggIntervalOneWeek LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval = "ONE\_WEEK" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaAggIntervalOneMonth LeakedCredentialTimeseriesGroupsV2ResponseMetaAggInterval = "ONE\_MONTH" Link to this property

Link to this property

ConfidenceInfo LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfo

Annotations \[]LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotation

DataSource LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource Data source for annotations.

One of the following: const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAll LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "ALL" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAIBots LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "AI\_BOTS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceAIGateway LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "AI\_GATEWAY" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceBGP LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "BGP" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceBots LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "BOTS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceConnectionAnomaly LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "CONNECTION\_ANOMALY" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceCT LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "CT" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNS LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNSMagnitude LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS\_MAGNITUDE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDNSAS112 LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DNS\_AS112" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceDos LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "DOS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceEmailRouting LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL\_ROUTING" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceEmailSecurity LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "EMAIL\_SECURITY" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceFw LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "FW" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceFwPg LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "FW\_PG" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTP LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPControl LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP\_CONTROL" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPCrawlerReferer LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP\_CRAWLER\_REFERER" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceHTTPOrigins LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "HTTP\_ORIGINS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceIQI LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "IQI" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceLeakedCredentials LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "LEAKED\_CREDENTIALS" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceNet LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "NET" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceRobotsTXT LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "ROBOTS\_TXT" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceSpeed LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "SPEED" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSourceWorkersAI LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsDataSource = "WORKERS\_AI" Link to this property

Link to this property Description string Link to this property EndDate Time formatdate-time Link to this property

EventType LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType Event type for annotations.

One of the following: const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeGeneral LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "GENERAL" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeOutage LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "OUTAGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypePartialProjection LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "PARTIAL\_PROJECTION" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypePipeline LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "PIPELINE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventTypeTrafficAnomaly LeakedCredentialTimeseriesGroupsV2ResponseMetaConfidenceInfoAnnotationsEventType = "TRAFFIC\_ANOMALY" Link to this property

Link to this property IsInstantaneous bool Whether event is a single point in time or a time range. Link to this property LinkedURL string formaturi Link to this property StartDate Time formatdate-time Link to this property Tags \[]stringOptional Link to this property

Link to this property Level int64 Provides an indication of how much confidence Cloudflare has in the data. Link to this property

Link to this property

DateRange \[]LeakedCredentialTimeseriesGroupsV2ResponseMetaDateRange

EndTime Time Adjusted end of date range. formatdate-time Link to this property StartTime Time Adjusted start of date range. formatdate-time Link to this property

Link to this property LastUpdated Time Timestamp of the last dataset update. formatdate-time Link to this property

Normalization LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization Normalization method applied to the results. Refer to Normalization methods.

One of the following: const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationPercentage LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "PERCENTAGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationMin0Max LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "MIN0\_MAX" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationMinMax LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "MIN\_MAX" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationRawValues LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "RAW\_VALUES" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationPercentageChange LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "PERCENTAGE\_CHANGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationRollingAverage LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "ROLLING\_AVERAGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationOverlappedPercentage LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "OVERLAPPED\_PERCENTAGE" Link to this property const LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalizationRatio LeakedCredentialTimeseriesGroupsV2ResponseMetaNormalization = "RATIO" Link to this property

Link to this property

Units \[]LeakedCredentialTimeseriesGroupsV2ResponseMetaUnit Measurement units for the results.

Name string Link to this property Value string Link to this property

Link to this property

Serie0 LeakedCredentialTimeseriesGroupsV2ResponseSerie0

Timestamps \[]Time Link to this property

Link to this property

[Link to this property](<#(resource)%20radar.leaked_credentials%20%3E%20(model)%20LeakedCredentialTimeseriesGroupsV2Response%20%3E%20(schema)>) ### Get time series distribution of HTTP authentication requests by dimension. Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/radar" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.Radar.LeakedCredentials.TimeseriesGroupsV2( context.TODO(), radar.LeakedCredentialTimeseriesGroupsV2ParamsDimensionCompromised, radar.LeakedCredentialTimeseriesGroupsV2Params{ }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.Meta) } ``` 200 example ``` { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "GENERAL", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z", "tags": [ "BOT_CLASS" ] } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ``` ##### Returns Examples 200 example ``` { "result": { "meta": { "aggInterval": "FIFTEEN_MINUTES", "confidenceInfo": { "annotations": [ { "dataSource": "ALL", "description": "Cable cut in Tonga", "endDate": "2019-12-27T18:11:19.117Z", "eventType": "GENERAL", "isInstantaneous": true, "linkedUrl": "https://example.com", "startDate": "2019-12-27T18:11:19.117Z", "tags": [ "BOT_CLASS" ] } ], "level": 0 }, "dateRange": [ { "endTime": "2022-09-17T10:22:57.555Z", "startTime": "2022-09-16T10:22:57.555Z" } ], "lastUpdated": "2019-12-27T18:11:19.117Z", "normalization": "PERCENTAGE", "units": [ { "name": "*", "value": "requests" } ] }, "serie_0": { "timestamps": [ "2023-08-08T10:15:00Z" ] } }, "success": true } ```