Attack history

Returns the same events the Protection → Events page shows, filterable by address, prefix, ASN and time.

Requires attacks.read, and the Attack History API flag on your organisation — see Activation.

The default window is 24 hours

With no from or to, you get the last day. Ask for more explicitly:

curl -G https://one.terabit.io/api/v1/attacks \
  -H "Authorization: Bearer tbk_..." \
  -d prefix=192.0.2.0/24 \
  -d from=2026-08-01T00:00:00Z \
  -d per_page=50

{
  "data": [
    {
      "id": 4821,
      "destination_ip": "192.0.2.10",
      "prefix": "192.0.2.0/24",
      "attack_type": "UDP Flood",
      "peak_bps": 10000000000,
      "peak_bps_formatted": "10 Gbps",
      "peak_pps": 1000000,
      "peak_pps_formatted": "1,000,000 pps",
      "started_at": "2026-08-19T14:02:11+00:00",
      "mitigated_at": "2026-08-19T14:02:14+00:00",
      "ended_at": null,
      "duration_seconds": 412,
      "status": "ongoing"
    }
  ],
  "links": { "first": "…", "last": "…", "prev": null, "next": "…" },
  "meta": { "current_page": 1, "per_page": 25, "total": 1, "from": "…", "to": "…", "from_clamped": false }
}

This is the only paginated endpoint — see Conventions.

The window you ask for is not always the window you get

Attack history for an address covers the time it has been on your account, so a window reaching further back is silently raised to the earliest date available for it. When that happens:

meta.from reports the date actually used, not the one you sent
meta.from_clamped is true

{
  "meta": {
    "from": "2026-05-01T00:00:00+00:00",
    "to": "2026-08-22T09:00:00+00:00",
    "from_clamped": true
  }
}

Read meta.from and meta.from_clamped rather than assuming you received everything you asked for. A report that says "90 days" while the API served 30 is worse than one that says it only had 30.

What counts as one of your addresses, and the date bound that comes with it, is in Ownership.

Fields worth reading twice

Field	Notes
`prefix`	Your smallest prefix containing the address, or `null` if it reached you through a service
`peak_bps` / `peak_pps`	For an ongoing attack these are the peak so far and may rise
`mitigated_at`	When filtering engaged, or `null`
`ended_at`	`null` while the attack is ongoing
`duration_seconds`	Measured to `ended_at`, or to now for an ongoing attack
`attack_type`	The primary IP protocol observed — `UDP Flood`, `TCP Flood`, `ICMP Flood`, `GRE Flood` or `Unknown`

?ongoing=true restricts to attacks that have not ended. This is the query for an alerting integration — note that peaks on these rows are still moving, so a value you read now may be lower than the one recorded when it finishes.

The default window is 24 hours

The window you ask for is not always the window you get

Fields worth reading twice

Ongoing attacks

On this page