Ownership
What counts as one of your addresses, and how far back their history goes.
The attack and firewall endpoints both work on your own address space, and mean the same thing by it. An address is yours when it is either:
- inside a prefix announced under one of your ASNs, or
- assigned to one of your active services.
The second is the one worth knowing: an address that reached you through a service is yours for these endpoints even though you announce nothing for it.
History starts when the address does
Attack history for an address covers the time it has been on your account. A
window reaching further back returns the part that exists rather than an error,
and says so: meta.from reports the window actually used and meta.from_clamped
is true.
Read both rather than assuming you received everything you asked for — see Attack history.
The prefix field
On each attack, prefix is your smallest prefix containing the attacked
address. It is null when the address reached you through a service rather than
a prefix you announce, so treat null as "arrived via a service", not as missing
data.
Malformed filters are still errors
A prefix that is not valid CIDR is a 422 rather than an empty result, so a
typo stays distinguishable from a query that genuinely matched nothing.