# Traffic

> Daily counters of a zone at the edge, requests, blocked requests, bytes and DNS queries, from the dashboard, the API or MCP.

The traffic counters add up, per UTC day, everything the edge served for all the names of a zone.

| Counter | API field | Meaning |
|---|---|---|
| Requests | `requests` | Requests the edge received for the zone's proxied names. |
| Blocked | `blocked_requests` | Of those, the requests the edge blocked. The dashboard also shows them as a share of requests. |
| Bandwidth out | `bytes_out` | Bytes the edge sent to visitors. |
| — | `bytes_in` | Bytes the edge received from visitors. |
| DNS queries | `dns_queries` | Queries answered for the zone by the OpenWAF name servers (delegated zones). |

## Read the counters

**Dashboard**

Go to **Analytics › Traffic** and pick a **Period**: last 7, 30 (default) or 90 days. The chart shows requests and blocked requests per day; the table below it has every counter per day.

**API**

```sh
curl -s "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/usage?from=2026-10-01&to=2026-10-27" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```

`from` and `to` are `YYYY-MM-DD` (UTC days); without them the last 30 days are returned. The answer has one item per day with data:

```json
{"items": [{"zone_id": "…", "day": "2026-10-26T00:00:00Z", "requests": 18234, "bytes_in": 5120394, "bytes_out": 912384112, "blocked_requests": 311, "dns_queries": 4402}]}
```

Days without traffic are absent: fill them with zeros if you chart the data.

**MCP**

`zone_usage` with `{"zone": "example.com"}` returns the last 30 days; add `from` and `to` (`YYYY-MM-DD`) for another range.


## Related

- [Security events](https://developers.openwaf.dev/analytics/security-events/): the requests behind the *Blocked* counter.
- [Real User Monitoring](https://developers.openwaf.dev/analytics/real-user-monitoring/): how fast those requests feel to visitors.