--- title: PCAPs --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Magic Transit](https://developers.cloudflare.com/api/typescript/resources/magic_transit) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # PCAPs ##### [List packet capture requests](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/methods/list) client.magicTransit.pcaps.list(PCAPListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [PCAPListResponse]()> GET/accounts/{account\_id}/pcaps ##### [Get PCAP request](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/methods/get) client.magicTransit.pcaps.get(stringpcapID, PCAPGetParams {account\_id } params, RequestOptionsoptions?): [PCAPGetResponse]() GET/accounts/{account\_id}/pcaps/{pcap\_id} ##### [Create PCAP request](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/methods/create) client.magicTransit.pcaps.create(PCAPCreateParamsparams, RequestOptionsoptions?): [PCAPCreateResponse]() POST/accounts/{account\_id}/pcaps ##### [Stop full PCAP](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/methods/stop) client.magicTransit.pcaps.stop(stringpcapID, PCAPStopParams {account\_id } params, RequestOptionsoptions?): void PUT/accounts/{account\_id}/pcaps/{pcap\_id}/stop ##### ModelsExpand Collapse

PCAP {id, filter\_v1, offset\_time, 5 more }

id?: string The ID for the packet capture. maxLength32 minLength32 Link to this property filter\_v1?: PCAPFilter {destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured. Link to this property offset\_time?: string The RFC 3339 offset timestamp from which to query backwards for packets. Must be within the last 24h. When this field is empty, defaults to time of request. formatdate-time Link to this property

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

One of the following: "unknown" Link to this property "success" Link to this property "pending" Link to this property "running" Link to this property "conversion\_pending" Link to this property "conversion\_running" Link to this property "complete" Link to this property "failed" Link to this property

Link to this property submitted?: string The RFC 3339 timestamp when the packet capture was created. Link to this property system?: "magic-transit" The system used to collect packet captures. Link to this property time\_limit?: number The packet capture duration in seconds. maximum300 minimum1 Link to this property

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap%20%3E%20(schema)>)

PCAPFilter {destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured.

destination\_address?: string The destination IP address of the packet. Link to this property destination\_port?: number The destination port of the packet. Link to this property protocol?: number The protocol number of the packet. Link to this property source\_address?: string The source IP address of the packet. Link to this property source\_port?: number The source port of the packet. Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_filter%20%3E%20(schema)>)

PCAPListResponse = PCAP {id, filter\_v1, offset\_time, 5 more } | MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP {id, filter\_v1, offset\_time, 5 more }

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

id?: string The ID for the packet capture. maxLength32 minLength32 Link to this property byte\_limit?: number The maximum number of bytes to capture. This field only applies to full packet captures. maximum1000000000 minimum1 Link to this property colo\_name?: string The name of the data center used for the packet capture. This can be a specific colo (ord02) or a multi-colo name (ORD). This field only applies to full packet captures. Link to this property destination\_conf?: string The full URI for the bucket. This field only applies to full packet captures. Link to this property error\_message?: string An error message that describes why the packet capture failed. This field only applies to full packet captures. Link to this property filter\_v1?: PCAPFilter {destination\_address, destination\_port, protocol, 2 more } The packet capture filter. When this field is empty, all packets are captured. Link to this property packets\_captured?: number The number of packets captured. Link to this property

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

Link to this property stop\_requested?: string The RFC 3339 timestamp when stopping the packet capture was requested. This field only applies to full packet captures. formatdate-time Link to this property submitted?: string The RFC 3339 timestamp when the packet capture was created. Link to this property system?: "magic-transit" The system used to collect packet captures. Link to this property time\_limit?: number The packet capture duration in seconds. maximum86400 minimum1 Link to this property

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_list_response%20%3E%20(schema)>)

PCAPGetResponse = PCAP {id, filter\_v1, offset\_time, 5 more } | MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP {id, filter\_v1, offset\_time, 5 more }

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_get_response%20%3E%20(schema)>)

PCAPCreateResponse = PCAP {id, filter\_v1, offset\_time, 5 more } | MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

One of the following:

PCAP {id, filter\_v1, offset\_time, 5 more }

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

MagicVisibilityPCAPsPCAPsResponseFull {id, byte\_limit, colo\_name, 10 more }

status?: "unknown"| "success"| "pending"| 5 more The status of the packet capture request.

type?: "simple"| "full" The type of packet capture. Simple captures sampled packets, and full captures entire payloads and non-sampled packets.

One of the following: "simple" Link to this property "full" Link to this property

Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps%20%3E%20(model)%20pcap_create_response%20%3E%20(schema)>) #### PCAPsOwnership ##### [List PCAPs Bucket Ownership](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/get) client.magicTransit.pcaps.ownership.get(OwnershipGetParams {account\_id } params, RequestOptionsoptions?): SinglePage< [Ownership]() {id, destination\_conf, filename, 3 more } > GET/accounts/{account\_id}/pcaps/ownership ##### [Add buckets for full packet captures](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/create) client.magicTransit.pcaps.ownership.create(OwnershipCreateParams {account\_id, destination\_conf } params, RequestOptionsoptions?): [Ownership]() {id, destination\_conf, filename, 3 more } POST/accounts/{account\_id}/pcaps/ownership ##### [Delete buckets for full packet captures](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/delete) client.magicTransit.pcaps.ownership.delete(stringownershipID, OwnershipDeleteParams {account\_id } params, RequestOptionsoptions?): void DELETE/accounts/{account\_id}/pcaps/ownership/{ownership\_id} ##### [Validate buckets for full packet captures](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/subresources/ownership/methods/validate) client.magicTransit.pcaps.ownership.validate(OwnershipValidateParams {account\_id, destination\_conf, ownership\_challenge } params, RequestOptionsoptions?): [Ownership]() {id, destination\_conf, filename, 3 more } POST/accounts/{account\_id}/pcaps/ownership/validate ##### ModelsExpand Collapse

Ownership {id, destination\_conf, filename, 3 more }

id: string The bucket ID associated with the packet captures API. maxLength32 minLength32 Link to this property destination\_conf: string The full URI for the bucket. This field only applies to full packet captures. Link to this property filename: string The ownership challenge filename stored in the bucket. Link to this property

status: "pending"| "success"| "failed" The status of the ownership challenge. Can be pending, success or failed.

One of the following: "pending" Link to this property "success" Link to this property "failed" Link to this property

Link to this property submitted: string The RFC 3339 timestamp when the bucket was added to packet captures API. Link to this property validated?: string The RFC 3339 timestamp when the bucket was validated. Link to this property

[Link to this property](<#(resource)%20magic_transit.pcaps.ownership%20%3E%20(model)%20ownership%20%3E%20(schema)>) #### PCAPsDownload ##### [Download Simple PCAP](https://developers.cloudflare.com/api/typescript/resources/magic_transit/subresources/pcaps/subresources/download/methods/get) client.magicTransit.pcaps.download.get(stringpcapID, DownloadGetParams {account\_id } params, RequestOptionsoptions?): Response GET/accounts/{account\_id}/pcaps/{pcap\_id}/download