The traffic counters add up, per UTC day, everything the edge served for all the names of a zone.
| Counter | API field | Meaning |
|---|---|---|
| Requests | requests | Requests the edge received for the zone's proxied names. |
| Blocked | blocked_requests | Of those, the requests the edge blocked. The dashboard also shows them as a share of requests. |
| Bandwidth out | bytes_out | Bytes the edge sent to visitors. |
| — | bytes_in | Bytes the edge received from visitors. |
| DNS queries | dns_queries | Queries answered for the zone by the OpenWAF name servers (delegated zones). |
Read the counters
Go to Analytics › Traffic and pick a Period: last 7, 30 (default) or 90 days. The chart shows requests and blocked requests per day; the table below it has every counter per day.
curl -s "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/usage?from=2026-10-01&to=2026-10-27" \
-H "Authorization: Bearer $OPENWAF_TOKEN"from and to are YYYY-MM-DD (UTC days); without them the last 30 days are returned. The answer has one item per day with data:
{"items": [{"zone_id": "…", "day": "2026-10-26T00:00:00Z", "requests": 18234, "bytes_in": 5120394, "bytes_out": 912384112, "blocked_requests": 311, "dns_queries": 4402}]}Days without traffic are absent: fill them with zeros if you chart the data.
zone_usage with {"zone": "example.com"} returns the last 30 days; add from and to (YYYY-MM-DD) for another range.
Related
- Security events: the requests behind the Blocked counter.
- Real User Monitoring: how fast those requests feel to visitors.