--- title: Create PCAP request --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Magic Transit](https://developers.cloudflare.com/api/resources/magic_transit) [PCAPs](https://developers.cloudflare.com/api/resources/magic_transit/subresources/pcaps) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create PCAP request POST/accounts/{account\_id}/pcaps Create new PCAP request for account. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `Magic Firewall Packet Captures - Write PCAPs API` ##### P ath ParametersExpand Collapse account\_id: string Identifier. maxLength32 [Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20account_id%20%3E%20(schema)>) ##### Body ParametersJSONExpand Collapse

body: object {packet\_limit, system, time\_limit, 3 more } or object {colo\_name, destination\_conf, system, 5 more }

One of the following:

MagicVisibilityPCAPsPCAPsRequestSimple object {packet\_limit, system, time\_limit, 3 more }

packet\_limit: number The limit of packets contained in a packet capture. maximum10000 minimum1 Link to this property system: "magic-transit" The system used to collect packet captures. Link to this property time\_limit: number The packet capture duration in seconds. maximum300 minimum1 Link to this property

type: "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

destination\_address: optional string The destination IP address of the packet. Link to this property destination\_port: optional number The destination port of the packet. Link to this property protocol: optional number The protocol number of the packet. Link to this property source\_address: optional string The source IP address of the packet. Link to this property source\_port: optional number The source port of the packet. Link to this property

Link to this property offset\_time: optional string The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request. formatdate-time Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsRequestFull object {colo\_name, destination\_conf, system, 5 more }

colo\_name: string The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures. Link to this property destination\_conf: string The full URI for the bucket. This field only applies to full packet captures. Link to this property system: "magic-transit" The system used to collect packet captures. Link to this property time\_limit: number The packet capture duration in seconds. maximum86400 minimum1 Link to this property

type: "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property byte\_limit: optional number The maximum number of bytes to capture. This field only applies to full packet captures. maximum1000000000 minimum1 Link to this property

filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

Link to this property packet\_limit: optional number The limit of packets contained in a packet capture. maximum10000 minimum1 Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(params)%200%20%3E%20(param)%20body%20%3E%20(schema)>) ##### ReturnsExpand Collapse

errors: array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20errors>)

messages: array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20messages>)

result: PCAP { id, filter\_v1, offset\_time, 5 more } or object {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP object {id, filter\_v1, offset\_time, 5 more }

id: optional string The ID for the packet capture. maxLength32 minLength32 Link to this property

filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

One of the following: "unknown" Link to this property "success" Link to this property "pending" Link to this property "running" Link to this property "conversion\_pending" Link to this property "conversion\_running" Link to this property "complete" Link to this property "failed" Link to this property

Link to this property submitted: optional string The RFC 3339 timestamp when the packet capture was created. Link to this property system: optional "magic-transit" The system used to collect packet captures. Link to this property time\_limit: optional number The packet capture duration in seconds. maximum300 minimum1 Link to this property

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull object {id, byte\_limit, colo\_name, 10 more }

id: optional string The ID for the packet capture. maxLength32 minLength32 Link to this property byte\_limit: optional number The maximum number of bytes to capture. This field only applies to full packet captures. maximum1000000000 minimum1 Link to this property colo\_name: optional string The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures. Link to this property destination\_conf: optional string The full URI for the bucket. This field only applies to full packet captures. Link to this property error\_message: optional string An error message that describes why the packet capture failed. This field only applies to full packet captures. Link to this property

filter\_v1: optional PCAPFilter { destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

Link to this property packets\_captured: optional number The number of packets captured. Link to this property

status: optional "unknown"or "success"or "pending"or 5 more The status of the packet capture request.

Link to this property stop\_requested: optional string The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures. formatdate-time Link to this property submitted: optional string The RFC 3339 timestamp when the packet capture was created. Link to this property system: optional "magic-transit" The system used to collect packet captures. Link to this property time\_limit: optional number The packet capture duration in seconds. maximum86400 minimum1 Link to this property

type: optional "simple"or "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20result>) success: true Whether the API call was successful. [Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(method)%20create%20%3E%20(network%20schema)%20%3E%20(property)%20success>) ### Create PCAP request HTTP HTTPTypeScriptPythonGoTerraform ``` curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/pcaps \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{ "packet_limit": 10000, "system": "magic-transit", "time_limit": 300, "type": "simple", "offset_time": "2020-01-01T08:00:00Z" }' ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "66802ca5668e47a2b82c2e6746e45037", "filter_v1": { "destination_address": "1.2.3.4", "destination_port": 80, "protocol": 6, "source_address": "1.2.3.4", "source_port": 123 }, "offset_time": "2020-01-01T08:00:00Z", "status": "success", "submitted": "2020-01-01T08:00:00Z", "system": "magic-transit", "time_limit": 300, "type": "simple" }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": { "id": "66802ca5668e47a2b82c2e6746e45037", "filter_v1": { "destination_address": "1.2.3.4", "destination_port": 80, "protocol": 6, "source_address": "1.2.3.4", "source_port": 123 }, "offset_time": "2020-01-01T08:00:00Z", "status": "success", "submitted": "2020-01-01T08:00:00Z", "system": "magic-transit", "time_limit": 300, "type": "simple" }, "success": true } ```