> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-hunner-patch-1.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # List Egress Traffic Events > Lists egress traffic events for this Edge in the requested time window. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/apps/{app_id}/edges/{id}/egress/traffic openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/apps/{app_id}/edges/{id}/egress/traffic: get: tags: - Edge summary: List Egress Traffic Events description: Lists egress traffic events for this Edge in the requested time window. operationId: c1.api.edge.v1.EdgeService.ListEgressTrafficEvents parameters: - in: path name: app_id required: true schema: description: The appId field. type: string - in: path name: id required: true schema: description: The id field. type: string - in: query name: bucket schema: description: The bucket field. enum: - TB_TIME_BUCKET_UNSPECIFIED - TB_TIME_BUCKET_HOUR - TB_TIME_BUCKET_DAY type: string x-speakeasy-unknown-values: allow - in: query name: dimension schema: description: The dimension field. enum: - TB_USAGE_ATTRIBUTION_DIMENSION_UNSPECIFIED - TB_USAGE_ATTRIBUTION_DIMENSION_TEAM - TB_USAGE_ATTRIBUTION_DIMENSION_APPLICATION - TB_USAGE_ATTRIBUTION_DIMENSION_AGENT - TB_USAGE_ATTRIBUTION_DIMENSION_COST_CENTER - TB_USAGE_ATTRIBUTION_DIMENSION_USER - TB_USAGE_ATTRIBUTION_DIMENSION_PROVIDER - TB_USAGE_ATTRIBUTION_DIMENSION_MODEL type: string x-speakeasy-unknown-values: allow - in: query name: page_size schema: description: The pageSize field. format: int32 type: integer - in: query name: page_token schema: description: The pageToken field. type: string - in: query name: since schema: description: The since field. format: int64 type: string - in: query name: until schema: description: The until field. format: int64 type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.edge.v1.EdgeServiceListEgressTrafficEventsResponse description: Successful response components: schemas: c1.api.edge.v1.EdgeServiceListEgressTrafficEventsResponse: description: The EdgeServiceListEgressTrafficEventsResponse message. properties: events: description: The events field. items: $ref: '#/components/schemas/c1.api.edge.v1.TBTrafficEvent' type: - array - 'null' nextPageToken: description: The nextPageToken field. type: string title: Edge Service List Egress Traffic Events Response type: object x-speakeasy-name-override: EdgeServiceListEgressTrafficEventsResponse c1.api.edge.v1.TBTrafficEvent: description: >- TBTrafficEvent is a curated projection of one ClickHouse audit row -- only the columns the Traffic UI needs. dest_host/dest_port/request_authority (egress-shaped) and model_route/model_target/logical_model (LLM-shaped) are separate raw fields rather than one pre-formatted "target" string, since which fields apply depends on `capability` and that formatting choice belongs to the UI layer, not this API. properties: applicationOperation: description: |- The HTTP operation the Edge listener served for this row, e.g. "GET /v1/models". Lets a row with no upstream dest_host (a request the Edge answered locally) still say what it was. Empty on rows written before Time Bandit recorded it and on non-application flows. type: string attemptOrdinal: description: >- One-based provider attempt; 0 on the listener-flow row. A retried call bills once per attempt. format: uint64 type: string cacheReadTokens: description: The cacheReadTokens field. format: uint64 type: string cacheWriteTokens: description: The cacheWriteTokens field. format: uint64 type: string callRole: description: >- answer | auxiliary. An auxiliary call bills on top of the answer call. type: string capability: description: The capability field. enum: - TB_TRAFFIC_CAPABILITY_UNSPECIFIED - TB_TRAFFIC_CAPABILITY_EGRESS - TB_TRAFFIC_CAPABILITY_LLM type: string x-speakeasy-unknown-values: allow configGeneration: description: |- Time Bandit's own sha256 content hash of its daemon config -- not an Edge/C1 policy generation. Set on LLM rows only; empty on every egress row. type: string costLookup: description: The costLookup field. enum: - TB_COST_LOOKUP_UNSPECIFIED - TB_COST_LOOKUP_PRICED - TB_COST_LOOKUP_UNPRICED - TB_COST_LOOKUP_UNMATCHED - TB_COST_LOOKUP_ROUTE type: string x-speakeasy-unknown-values: allow costNanoUsd: description: >- Computed on read from the token counts above via pkg/inferenceprice; 0 and not a real price unless cost_lookup is PRICED. format: int64 type: string counterLatencyMs: description: The counterLatencyMs field. format: uint64 type: string counterRequestBytes: description: The counterRequestBytes field. format: uint64 type: string counterResponseBytes: description: The counterResponseBytes field. format: uint64 type: string destHost: description: >- Egress-shaped destination fields; empty when capability is LLM and no egress connection underlies the call. type: string destPort: description: The destPort field. format: uint32 type: integer egressEnforcementMode: description: >- observe | enforce -- the Edge mode the egress access policy ran under for this row. Empty when no Edge egress-policy decision was made (every LLM/ingress row, and an Edge whose egress rules were never configured). type: string egressPolicyVerdict: description: >- allow | deny -- what the Edge egress access policy decided, which is NOT always what was acted on. Under egress_enforcement_mode = "observe" a deny here rides a row whose outcome is allowed: the policy would have refused the CONNECT, and observe let it through anyway. Reading outcome alone cannot tell that row apart from one no rule objected to. Empty alongside egress_enforcement_mode. type: string eventId: description: Deterministic over tenant+flow+event_time. type: string eventTime: format: date-time type: - string - 'null' federatedSession: oneOf: - $ref: '#/components/schemas/c1.api.edge.v1.TBFederatedSession' - type: 'null' flowId: description: The flowId field. type: string ingressEnforcementMode: description: enforce | ...; empty alongside ingress_scope. type: string ingressScope: description: |- The direct-listener scope this call authenticated through, e.g. "squire-idjag-llm"; empty on capture/legacy ingress with no listener scope. type: string inputTokens: description: >- LLM token counts; zero on egress rows and on a listener-flow row that never reached a provider (see attempt_ordinal). format: uint64 type: string logicalModel: description: The logicalModel field. type: string modelName: description: >- The provider-native served model, e.g. "claude-opus-5" -- what cost is priced against. logical_model is only the caller-facing alias. type: string modelRoute: description: LLM-shaped fields; empty when capability is EGRESS. type: string modelTarget: description: The modelTarget field. type: string observationStatus: description: |- observed | over_limit | malformed. Anything but "observed" means the audit body wasn't fully parsed, so the token counts above are a floor, not a total. type: string outcome: description: The outcome field. enum: - TB_TRAFFIC_OUTCOME_UNSPECIFIED - TB_TRAFFIC_OUTCOME_ALLOWED - TB_TRAFFIC_OUTCOME_DENIED type: string x-speakeasy-unknown-values: allow outputTokens: description: The outputTokens field. format: uint64 type: string parsedVerdictReasons: description: >- Structured parse of verdict_reasons, one entry per verdict_reasons entry in the same order. Populated only when the request asked for it (include_parsed_verdict_reasons); verdict_reasons itself is unchanged. items: $ref: '#/components/schemas/c1.api.edge.v1.TBVerdictReason' type: - array - 'null' principalUserId: description: |- The C1 user id source_principal resolves to, when it's an OIDC principal whose subject is a real C1 user; empty for a service/agent principal or one c1 couldn't resolve to a user. type: string requestAuthority: description: The requestAuthority field. type: string routingRunId: description: >- Joins the listener-flow row and its provider-attempt child row -- one LLM request writes both; empty on non-LLM rows. type: string sourceConfidence: description: A | B | C | D | "" (unresolved). type: string sourcePrincipal: description: |- Caller identity. source_principal_kind and source_confidence qualify how source_principal was resolved (see AuditSource in the TB sink). type: string sourcePrincipalKind: description: The sourcePrincipalKind field. type: string verdictFromFallback: description: >- True when this row's verdict is the fail-closed default rather than an explicit rule match, so an empty verdict_reasons isn't a missing-data gap. type: boolean verdictReasons: description: >- Why `outcome` resolved as it did. Can be legitimately empty even on a DENY -- see verdict_from_fallback. items: type: string type: - array - 'null' verdictResolvedRaw: description: The verdictResolvedRaw field. type: string title: Tb Traffic Event type: object x-speakeasy-name-override: TBTrafficEvent c1.api.edge.v1.TBFederatedSession: description: >- TBFederatedSession is TB's secret-free hosted OAuth session lineage for a cryptographically attested call (see AuditFederatedSession in the TB sink). grant_jti_hash and proof_key_thumbprint are a hash and a public key thumbprint, not secrets. properties: clientId: description: The clientId field. type: string grantJtiHash: description: The grantJtiHash field. type: string issuerName: description: The issuerName field. type: string proofKeyThumbprint: description: The proofKeyThumbprint field. type: string resource: description: The resource field. type: string scopes: description: The scopes field. items: type: string type: - array - 'null' sessionId: description: The sessionId field. type: string tenantId: description: The tenantId field. type: string title: Tb Federated Session type: object x-speakeasy-name-override: TBFederatedSession c1.api.edge.v1.TBVerdictReason: description: >- TBVerdictReason is the structured parse of one Time Bandit verdict reason string. The raw string is the matching verdict_reasons entry. properties: blockingKinds: description: Credential kinds of the classes that were not exempted. items: type: string type: - array - 'null' classes: description: Content-inspection class labels, e.g. "high-entropy", "jwt". items: type: string type: - array - 'null' clean: description: True for a content-inspection scan that found nothing. type: boolean context: description: |- The content-inspection location (e.g. "request_header", "streaming_response"); empty for stages other than content and response_body. type: string exemptedKinds: description: >- Credential kinds (Time Bandit spelling, e.g. "ApiKey") the matching rule already exempts. items: type: string type: - array - 'null' response: description: True for a response-side finding. type: boolean stage: description: >- rule_deny | ssrf | body_cap | encoding | content | response_body | other. type: string title: Tb Verdict Reason type: object x-speakeasy-name-override: TBVerdictReason securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````