--- title: PCAPs --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Magic Transit](https://developers.cloudflare.com/api/resources/magic_transit) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # PCAPs ##### [List packet capture requests](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/methods/list) GET/accounts/{account\_id}/pcaps ##### [Get PCAP request](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/methods/get) GET/accounts/{account\_id}/pcaps/{pcap\_id} ##### [Create PCAP request](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/methods/create) POST/accounts/{account\_id}/pcaps ##### [Stop full PCAP](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/methods/stop) PUT/accounts/{account\_id}/pcaps/{pcap\_id}/stop ##### ModelsExpand Collapse

PCAP object {id, filter\_v1, offset\_time, 5 more }

id: optional string The ID for the packet capture. maxLength32 minLength32 Link to this property filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured. Link to this property offset\_time: optional string The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request. formatdate-time Link to this property

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

One of the following: "unknown" Link to this property "success" Link to this property "pending" Link to this property "running" Link to this property "conversion\_pending" Link to this property "conversion\_running" Link to this property "complete" Link to this property "failed" Link to this property

Link to this property submitted: optional string The RFC 3339 timestamp when the packet capture was created. Link to this property system: optional "magic-transit" The system used to collect packet captures. Link to this property time\_limit: optional number The packet capture duration in seconds. maximum300 minimum1 Link to this property

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap%20%3E%20(schema)>)

PCAPFilter object {destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

destination\_address: optional string The destination IP address of the packet. Link to this property destination\_port: optional number The destination port of the packet. Link to this property protocol: optional number The protocol number of the packet. Link to this property source\_address: optional string The source IP address of the packet. Link to this property source\_port: optional number The source port of the packet. Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_filter%20%3E%20(schema)>)

PCAPListResponse = PCAP { id, filter\_v1, offset\_time, 5 more } or object {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP object {id, filter\_v1, offset\_time, 5 more }

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull object {id, byte\_limit, colo\_name, 10 more }

id: optional string The ID for the packet capture. maxLength32 minLength32 Link to this property byte\_limit: optional number The maximum number of bytes to capture. This field only applies to full packet captures. maximum1000000000 minimum1 Link to this property colo\_name: optional string The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures. Link to this property destination\_conf: optional string The full URI for the bucket. This field only applies to full packet captures. Link to this property error\_message: optional string An error message that describes why the packet capture failed. This field only applies to full packet captures. Link to this property filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured. Link to this property packets\_captured: optional number The number of packets captured. Link to this property

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

Link to this property stop\_requested: optional string The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures. formatdate-time Link to this property submitted: optional string The RFC 3339 timestamp when the packet capture was created. Link to this property system: optional "magic-transit" The system used to collect packet captures. Link to this property time\_limit: optional number The packet capture duration in seconds. maximum86400 minimum1 Link to this property

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_list_response%20%3E%20(schema)>)

PCAPGetResponse = PCAP { id, filter\_v1, offset\_time, 5 more } or object {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP object {id, filter\_v1, offset\_time, 5 more }

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull object {id, byte\_limit, colo\_name, 10 more }

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_get_response%20%3E%20(schema)>)

PCAPCreateResponse = PCAP { id, filter\_v1, offset\_time, 5 more } or object {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP object {id, filter\_v1, offset\_time, 5 more }

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull object {id, byte\_limit, colo\_name, 10 more }

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_create_response%20%3E%20(schema)>) #### PCAPsOwnership ##### [List PCAPs Bucket Ownership](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/get) GET/accounts/{account\_id}/pcaps/ownership ##### [Add buckets for full packet captures](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/create) POST/accounts/{account\_id}/pcaps/ownership ##### [Delete buckets for full packet captures](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/delete) DELETE/accounts/{account\_id}/pcaps/ownership/{ownership\_id} ##### [Validate buckets for full packet captures](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/validate) POST/accounts/{account\_id}/pcaps/ownership/validate ##### ModelsExpand Collapse

Ownership object {id, destination\_conf, filename, 3 more }

id: string The bucket ID associated with the packet captures API. maxLength32 minLength32 Link to this property destination\_conf: string The full URI for the bucket. This field only applies to full packet captures. Link to this property filename: string The ownership challenge filename stored in the bucket. Link to this property

status: "pending"or "success"or "failed" The status of the ownership challenge. Can be pending, success or failed.

One of the following: "pending" Link to this property "success" Link to this property "failed" Link to this property

Link to this property submitted: string The RFC 3339 timestamp when the bucket was added to packet captures API. Link to this property validated: optional string The RFC 3339 timestamp when the bucket was validated. Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps.ownership%20%3E%20(model)%20ownership%20%3E%20(schema)>) #### PCAPsDownload ##### [Download Simple PCAP](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps/subresources/download/methods/get) GET/accounts/{account\_id}/pcaps/{pcap\_id}/download