# Generated by API Evangelist (build-phrasing.py). Our phrasing, not observed demand. overlay: 1.0.0 info: title: API Evangelist conversational phrasing for Cloudflare Radar API version: 1.0.0 extends: openapi/cloudflare-radar-api-openapi.yml actions: - target: $.info update: x-apievangelist-phrasing: method: generated generated: '2026-09-26' generator: build-phrasing.py label: Generated by API Evangelist operations: 169 - target: $.paths['/radar/annotations/outages'].get update: x-apievangelist-phrasing: intent: List recent Internet outages and anomalies effect: read questions: - Where can I see the latest Internet outages Cloudflare Radar has recorded? - Can I list outage annotations for just one country or network? instructions: - text: List the latest Internet outages recorded in {location}. slots: location: query.location - text: Show outage annotations affecting AS{asn} over {dateRange}. slots: asn: query.asn dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/annotations/outages/locations'].get update: x-apievangelist-phrasing: intent: Count outages per location effect: read questions: - Which countries have had the most Internet outages lately? - Is there a ranking of locations by number of outages? instructions: - text: Rank locations by how many outages they had over {dateRange}. slots: dateRange: query.dateRange - text: Give me the top {limit} locations by outage count. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/dnssec'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS queries by DNSSEC support effect: read questions: - What share of queries reaching AS112 ask for DNSSEC? - How much AS112 DNS traffic is DNSSEC-aware versus not, overall? instructions: - text: Summarize the DNSSEC support split of AS112 queries for {location}. slots: location: query.location - text: Give me the overall AS112 DNSSEC share for {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/edns'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS queries by EDNS support effect: read questions: - What percentage of AS112 queries use EDNS? - Can I see the EDNS support breakdown of AS112 traffic for a single country? instructions: - text: Summarize EDNS support among AS112 queries in {location}. slots: location: query.location - text: Report the EDNS versus non-EDNS share of AS112 lookups over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/ip_version'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS queries by IP version effect: read questions: - How much AS112 DNS traffic arrives over IPv6 compared to IPv4? - What is the IPv4/IPv6 split of queries hitting AS112 in one network? instructions: - text: Summarize the IPv4 vs IPv6 share of AS112 queries from AS{asn}. slots: asn: query.asn - text: Show the AS112 IP version breakdown for {location}. slots: location: query.location method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/protocol'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS queries by transport protocol effect: read questions: - What share of AS112 lookups travel over UDP versus TCP? - Which transport protocols carry DNS queries to AS112? instructions: - text: Summarize AS112 query transport protocols for {location}. slots: location: query.location - text: Break down AS112 lookups by UDP, TCP and other protocols for {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/query_type'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS queries by record type effect: read questions: - Which DNS record types are most commonly queried at AS112? - What share of AS112 queries are PTR lookups compared to A or AAAA? instructions: - text: Summarize AS112 queries by record type for {location}. slots: location: query.location - text: Show the query type mix hitting AS112 over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/summary/response_codes'].get update: x-apievangelist-phrasing: intent: Summarize AS112 DNS responses by response code effect: read questions: - What share of AS112 answers are NXDOMAIN? - How are AS112 DNS responses distributed across response codes? instructions: - text: Summarize AS112 response codes for {location}. slots: location: query.location - text: Give me the NOERROR/NXDOMAIN split of AS112 replies over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries'].get update: x-apievangelist-phrasing: intent: Chart AS112 DNS query volume over time effect: read questions: - How has the volume of queries reaching AS112 changed over time? - Can I get AS112 query counts at hourly or daily intervals? instructions: - text: Chart AS112 DNS query volume for {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Plot AS112 query volume in {aggInterval} buckets. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/dnssec'].get update: x-apievangelist-phrasing: intent: Track AS112 DNSSEC support over time effect: read questions: - Is DNSSEC support among AS112 queries rising or falling over time? - Can I trend the DNSSEC-aware share of AS112 traffic day by day? instructions: - text: Trend the DNSSEC share of AS112 queries in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Plot AS112 DNSSEC support per {aggInterval} interval. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/edns'].get update: x-apievangelist-phrasing: intent: Track AS112 EDNS support over time effect: read questions: - How has EDNS usage in AS112 queries changed over the past months? - Can I see a time series of EDNS support for AS112 lookups? instructions: - text: Trend EDNS support in AS112 queries from {location} across {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the EDNS share of AS112 traffic at {aggInterval} granularity. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/ip_version'].get update: x-apievangelist-phrasing: intent: Track AS112 queries by IP version over time effect: read questions: - Is IPv6 growing as a share of AS112 DNS queries over time? - Can I trend the IPv4/IPv6 mix of AS112 traffic for one network? instructions: - text: Trend the IPv6 share of AS112 queries from AS{asn} over {dateRange}. slots: asn: query.asn dateRange: query.dateRange - text: Chart AS112 queries per IP version in {location} over time. slots: location: query.location method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/protocol'].get update: x-apievangelist-phrasing: intent: Track AS112 queries by transport protocol over time effect: read questions: - Has the TCP share of AS112 DNS traffic changed over time? - Can I get a time series of AS112 queries split by transport protocol? instructions: - text: Trend AS112 transport protocol usage in {location} across {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart AS112 UDP versus TCP usage per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/query_type'].get update: x-apievangelist-phrasing: intent: Track AS112 queries by record type over time effect: read questions: - How has the mix of record types queried at AS112 shifted over time? - Can I trend PTR versus other query types reaching AS112? instructions: - text: Trend AS112 query types for {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the AS112 record-type mix by {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/timeseries_groups/response_codes'].get update: x-apievangelist-phrasing: intent: Track AS112 response codes over time effect: read questions: - Has the NXDOMAIN rate at AS112 changed over time? - Can I get a time series of AS112 DNS response codes? instructions: - text: Trend AS112 response codes in {location} across {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart AS112 reply codes aggregated per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/top/locations'].get update: x-apievangelist-phrasing: intent: Rank locations by AS112 DNS queries effect: read questions: - Which countries send the most DNS queries to AS112? - What are the top locations by share of AS112 traffic? instructions: - text: List the top {limit} locations by AS112 query share. slots: limit: query.limit - text: Rank countries by AS112 DNS queries over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/top/locations/dnssec/{dnssec}'].get update: x-apievangelist-phrasing: intent: Rank locations by AS112 DNSSEC support effect: read questions: - Which countries send the most DNSSEC-supporting queries to AS112? - Where do AS112 queries without DNSSEC mostly come from? instructions: - text: Rank locations by AS112 queries with DNSSEC status {dnssec}. slots: dnssec: path.dnssec - text: List the top {limit} countries for AS112 DNSSEC value {dnssec}. slots: limit: query.limit dnssec: path.dnssec method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/top/locations/edns/{edns}'].get update: x-apievangelist-phrasing: intent: Rank locations by AS112 EDNS support effect: read questions: - Which countries send the most EDNS-enabled queries to AS112? - Where does AS112 traffic lacking EDNS originate? instructions: - text: Rank locations by AS112 queries with EDNS status {edns}. slots: edns: path.edns - text: Show the top {limit} countries for AS112 EDNS value {edns}. slots: limit: query.limit edns: path.edns method: generated generated: '2026-09-26' - target: $.paths['/radar/as112/top/locations/ip_version/{ip_version}'].get update: x-apievangelist-phrasing: intent: Rank locations by AS112 queries over an IP version effect: read questions: - Which countries send the most IPv6 queries to AS112? - Where does most IPv4 AS112 DNS traffic come from? instructions: - text: Rank locations by AS112 queries sent over {ip_version}. slots: ip_version: path.ip_version - text: List the top {limit} countries for AS112 lookups on {ip_version}. slots: limit: query.limit ip_version: path.ip_version method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by network protocol effect: read questions: - What share of network-layer DDoS attacks use UDP, TCP, ICMP or GRE? - Can I get an overall protocol breakdown of layer 3/4 attacks for a country? instructions: - text: Summarize layer 3/4 attacks by network protocol for {location}. slots: location: query.location - text: Give me the L3/4 attack protocol mix over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary/bitrate'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by bitrate effect: read questions: - How big are most network-layer DDoS attacks in bits per second? - What share of layer 3 attacks exceed high bitrate bands? instructions: - text: Summarize L3/4 attack sizes by bitrate for {location}. slots: location: query.location - text: Break down {protocol} layer 3 attacks by bitrate band. slots: protocol: query.protocol method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary/duration'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by duration effect: read questions: - How long do network-layer DDoS attacks usually last? - What share of layer 3 attacks run longer than an hour? instructions: - text: Summarize how long L3/4 attacks lasted in {location}. slots: location: query.location - text: Break down layer 3 attack durations for {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary/ip_version'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by IP version effect: read questions: - What share of network-layer attacks come over IPv6? - Are layer 3 attacks mostly IPv4? instructions: - text: Summarize L3/4 attacks by IPv4 vs IPv6 for {location}. slots: location: query.location - text: Show the IP version split of {protocol} layer 3 attacks. slots: protocol: query.protocol method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary/protocol'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by protocol used effect: read questions: - Which protocol do most layer 3 attacks on IPv6 use? - Can I filter the layer 3 attack protocol breakdown by attack direction? instructions: - text: Show the protocol share of L3/4 attacks in {direction} direction. slots: direction: query.direction - text: Summarize protocols used in {ipVersion} layer 3 attacks. slots: ipVersion: query.ipVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/summary/vector'].get update: x-apievangelist-phrasing: intent: Summarize layer 3/4 attacks by attack vector effect: read questions: - What are the most common network-layer attack vectors, like SYN floods? - Which DDoS vectors dominate layer 3 attacks against one country? instructions: - text: Summarize L3/4 attack vectors targeting {location}. slots: location: query.location - text: Break down layer 3 attack vectors over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries'].get update: x-apievangelist-phrasing: intent: Chart layer 3/4 attack volume over time effect: read questions: - How has network-layer DDoS attack volume changed over time? - Can I chart layer 3 attacks by bytes or by packets? instructions: - text: Chart L3/4 attack volume in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Plot layer 3 attack traffic measured by {metric}. slots: metric: query.metric method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attack protocols over time effect: read questions: - How has the network protocol mix of layer 3/4 attacks shifted over time? - Can I trend UDP versus TCP DDoS attacks week by week? instructions: - text: Trend the protocol mix of L3/4 attacks in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart layer 3 attack protocols per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/bitrate'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attack bitrates over time effect: read questions: - Are network-layer attacks getting bigger in bitrate over time? - Can I trend DDoS attack sizes by bitrate band? instructions: - text: Trend L3/4 attack bitrates in {location} across {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart {protocol} attack bitrate bands over time. slots: protocol: query.protocol method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/duration'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attack durations over time effect: read questions: - Are network-layer DDoS attacks getting longer or shorter over time? - Can I trend attack durations for a specific country? instructions: - text: Trend L3/4 attack durations in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart layer 3 attack length buckets per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/industry'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attacks by targeted industry effect: read questions: - Which industries have been hit hardest by network-layer DDoS over time? - Can I trend layer 3 attacks against gaming or finance industries? instructions: - text: Trend L3/4 attacks by target industry over {dateRange}. slots: dateRange: query.dateRange - text: Chart the top {limitPerGroup} industries hit by layer 3 attacks in {location}. slots: limitPerGroup: query.limitPerGroup location: query.location method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/ip_version'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attacks by IP version over time effect: read questions: - Is the IPv6 share of network-layer attacks growing? - Can I get a time series of layer 3 attacks split by IPv4 and IPv6? instructions: - text: Trend IPv4 vs IPv6 L3/4 attacks in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the IP version mix of {protocol} layer 3 attacks. slots: protocol: query.protocol method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/protocol'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attacks by protocol over time effect: read questions: - Which protocols have network attackers leaned on over the last quarter? - Can I trend attack protocol share for IPv6-only layer 3 attacks? instructions: - text: Trend protocols used in {ipVersion} L3/4 attacks over {dateRange}. slots: ipVersion: query.ipVersion dateRange: query.dateRange - text: Chart per-protocol layer 3 attack share with {direction} direction. slots: direction: query.direction method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/vector'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attack vectors over time effect: read questions: - How have DDoS attack vectors like SYN or DNS floods trended over time? - Can I see which network attack vectors are rising? instructions: - text: Trend L3/4 attack vectors against {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the top {limitPerGroup} layer 3 attack vectors over time. slots: limitPerGroup: query.limitPerGroup method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/timeseries_groups/vertical'].get update: x-apievangelist-phrasing: intent: Track layer 3/4 attacks by targeted vertical effect: read questions: - Which business verticals are network-layer attacks targeting over time? - Can I trend layer 3 DDoS by vertical for one country? instructions: - text: Trend L3/4 attacks by target vertical in {location}. slots: location: query.location - text: Chart the top {limitPerGroup} verticals hit by layer 3 attacks over {dateRange}. slots: limitPerGroup: query.limitPerGroup dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/top/attacks'].get update: x-apievangelist-phrasing: intent: Rank origin-to-target pairs of layer 3/4 attacks effect: read questions: - Which country pairs see the most network-layer attacks from one to the other? - Where do layer 3 attacks come from and where do they land? instructions: - text: List the top {limit} origin-target location pairs for L3/4 attacks. slots: limit: query.limit - text: Show layer 3 attack pairs involving {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/top/industry'].get update: x-apievangelist-phrasing: intent: Rank industries targeted by layer 3/4 attacks effect: read questions: - Which industry receives the most network-layer DDoS attacks? - What are the top industries targeted by layer 3 attacks in a country? instructions: - text: Rank industries by L3/4 attacks received in {location}. slots: location: query.location - text: List the top {limit} industries hit by layer 3 attacks. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/top/locations/origin'].get update: x-apievangelist-phrasing: intent: Rank source countries of layer 3/4 attacks effect: read questions: - Which countries launch the most network-layer DDoS attacks? - Where do most layer 3 attacks originate from? instructions: - text: List the top {limit} origin countries of L3/4 attacks. slots: limit: query.limit - text: Rank layer 3 attack sources for {protocol} traffic over {dateRange}. slots: protocol: query.protocol dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/top/locations/target'].get update: x-apievangelist-phrasing: intent: Rank target countries of layer 3/4 attacks effect: read questions: - Which countries are targeted most by network-layer attacks? - What locations receive the most layer 3 DDoS traffic? instructions: - text: List the top {limit} targeted countries for L3/4 attacks. slots: limit: query.limit - text: Rank layer 3 attack targets for {ipVersion} traffic over {dateRange}. slots: ipVersion: query.ipVersion dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer3/top/vertical'].get update: x-apievangelist-phrasing: intent: Rank verticals targeted by layer 3/4 attacks effect: read questions: - Which business verticals are most targeted by network-layer DDoS? - Can I rank layer 3 attack victims by vertical for one country? instructions: - text: Rank verticals by L3/4 attacks received in {location}. slots: location: query.location - text: List the top {limit} verticals hit by layer 3 attacks over {dateRange}. slots: limit: query.limit dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary'].get update: x-apievangelist-phrasing: intent: Summarize application-layer attacks by mitigation technique effect: read questions: - Which mitigation techniques stop most application-layer (layer 7) attacks? - What share of HTTP attacks are handled by the WAF versus DDoS rules? instructions: - text: Summarize layer 7 attacks by mitigation technique for {location}. slots: location: query.location - text: Give me the L7 mitigation technique split over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary/http_method'].get update: x-apievangelist-phrasing: intent: Summarize layer 7 attacks by HTTP method effect: read questions: - Do most HTTP attacks use GET or POST requests? - What is the HTTP method breakdown of application-layer attacks? instructions: - text: Summarize layer 7 attacks by HTTP method in {location}. slots: location: query.location - text: Break down HTTP methods in attacks caught by {mitigationProduct}. slots: mitigationProduct: query.mitigationProduct method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary/http_version'].get update: x-apievangelist-phrasing: intent: Summarize layer 7 attacks by HTTP version effect: read questions: - Are application-layer attacks mostly over HTTP/1.1, HTTP/2 or HTTP/3? - What share of web attacks use HTTP/2? instructions: - text: Summarize layer 7 attacks by HTTP version for {location}. slots: location: query.location - text: Break down {httpMethod} attacks by HTTP version. slots: httpMethod: query.httpMethod method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary/ip_version'].get update: x-apievangelist-phrasing: intent: Summarize layer 7 attacks by IP version effect: read questions: - What share of HTTP-layer attacks arrive over IPv6? - Is the IPv4/IPv6 mix of web attacks different for one mitigation product? instructions: - text: Summarize application-layer attacks by IPv4 vs IPv6 in {location}. slots: location: query.location - text: Show the IP version split of web attacks mitigated by {mitigationProduct}. slots: mitigationProduct: query.mitigationProduct method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary/managed_rules'].get update: x-apievangelist-phrasing: intent: Summarize layer 7 attacks by managed rule effect: read questions: - Which WAF managed rule categories catch the most web attacks? - What share of HTTP attacks are blocked by managed rules like SQL injection or XSS? instructions: - text: Summarize layer 7 attacks by managed rule for {location}. slots: location: query.location - text: Break down managed rule hits in attacks over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/summary/mitigation_product'].get update: x-apievangelist-phrasing: intent: Summarize layer 7 attacks by mitigation product effect: read questions: - Which Cloudflare product mitigates the largest share of HTTP attacks? - What percentage of web attacks are stopped by bot management versus the WAF? instructions: - text: Summarize layer 7 attacks by mitigation product in {location}. slots: location: query.location - text: Break down {httpMethod} attacks by the product that mitigated them. slots: httpMethod: query.httpMethod method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries'].get update: x-apievangelist-phrasing: intent: Chart application-layer attack volume over time effect: read questions: - How has the volume of HTTP-layer attacks changed over time? - Can I chart layer 7 attack requests normalized over a date range? instructions: - text: Chart layer 7 attack volume in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Plot application-layer attack requests using {normalization} normalization. slots: normalization: query.normalization method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups'].get update: x-apievangelist-phrasing: intent: Track layer 7 mitigation techniques over time effect: read questions: - How has the mix of layer 7 mitigation techniques changed over time? - Can I trend WAF versus DDoS mitigation of HTTP attacks? instructions: - text: Trend layer 7 mitigation techniques in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart L7 mitigation technique shares per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/http_method'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by HTTP method over time effect: read questions: - Has the share of POST-based web attacks grown over time? - Can I trend HTTP methods used in application attacks? instructions: - text: Trend HTTP methods in layer 7 attacks on {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart HTTP method usage over time in attacks on {httpVersion}. slots: httpVersion: query.httpVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/http_version'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by HTTP version over time effect: read questions: - Are attackers shifting to HTTP/2 or HTTP/3 over time? - Can I get a time series of web attacks split by HTTP version? instructions: - text: Trend HTTP versions in layer 7 attacks on {location} across {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart HTTP version share of {httpMethod} attacks over time. slots: httpMethod: query.httpMethod method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/industry'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by targeted industry effect: read questions: - Which industries have received the most web application attacks over time? - Can I trend HTTP attacks against specific industries? instructions: - text: Trend layer 7 attacks by target industry in {location}. slots: location: query.location - text: Chart the top {limitPerGroup} industries hit by application attacks over {dateRange}. slots: limitPerGroup: query.limitPerGroup dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/ip_version'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by IP version over time effect: read questions: - Is the IPv6 share of HTTP attacks changing over time? - Can I trend application-layer attacks split by IPv4 and IPv6? instructions: - text: Trend IPv4 vs IPv6 layer 7 attacks in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the IP version mix of web attacks caught by {mitigationProduct}. slots: mitigationProduct: query.mitigationProduct method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/managed_rules'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by managed rule over time effect: read questions: - Which WAF managed rule categories have been firing more over time? - Can I trend managed rule matches in HTTP attacks? instructions: - text: Trend managed rule hits in layer 7 attacks on {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart managed rule categories per {aggInterval} for web attacks. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/mitigation_product'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by mitigation product over time effect: read questions: - How has the share of HTTP attacks stopped by each Cloudflare product changed? - Can I trend which products mitigate web attacks week over week? instructions: - text: Trend mitigation products for layer 7 attacks in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the mitigating product share of {httpMethod} attacks over time. slots: httpMethod: query.httpMethod method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/timeseries_groups/vertical'].get update: x-apievangelist-phrasing: intent: Track layer 7 attacks by targeted vertical effect: read questions: - Which verticals have web application attacks focused on over time? - Can I trend HTTP attacks by business vertical? instructions: - text: Trend layer 7 attacks by target vertical in {location}. slots: location: query.location - text: Chart the top {limitPerGroup} verticals hit by HTTP attacks over {dateRange}. slots: limitPerGroup: query.limitPerGroup dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/ases/origin'].get update: x-apievangelist-phrasing: intent: Rank networks originating layer 7 attacks effect: read questions: - Which autonomous systems send the most application-layer attacks? - What networks are the top sources of HTTP attacks from a given country? instructions: - text: List the top {limit} source networks of layer 7 attacks. slots: limit: query.limit - text: Rank ASNs originating web attacks in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/attacks'].get update: x-apievangelist-phrasing: intent: Rank origin-to-target pairs of layer 7 attacks effect: read questions: - Which country pairs exchange the most HTTP attacks? - Can I rank layer 7 attack pairs by mitigated requests instead of attack count? instructions: - text: List the top {limit} origin-target pairs for layer 7 attacks. slots: limit: query.limit - text: Rank web attack pairs by {magnitude} over {dateRange}. slots: magnitude: query.magnitude dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/industry'].get update: x-apievangelist-phrasing: intent: Rank industries targeted by layer 7 attacks effect: read questions: - Which industry is targeted most by web application attacks? - What are the top industries hit by HTTP attacks in a given country? instructions: - text: Rank industries by layer 7 attacks received in {location}. slots: location: query.location - text: List the top {limit} industries hit by application attacks. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/locations/origin'].get update: x-apievangelist-phrasing: intent: Rank source countries of layer 7 attacks effect: read questions: - Which countries launch the most HTTP application attacks? - Where do layer 7 attacks come from on one continent? instructions: - text: List the top {limit} origin countries of layer 7 attacks. slots: limit: query.limit - text: Rank web attack source countries in {continent} over {dateRange}. slots: continent: query.continent dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/locations/target'].get update: x-apievangelist-phrasing: intent: Rank target countries of layer 7 attacks effect: read questions: - Which countries are targeted most by HTTP application attacks? - What locations on a continent receive the most web attacks? instructions: - text: List the top {limit} targeted countries for layer 7 attacks. slots: limit: query.limit - text: Rank web attack target countries in {continent} over {dateRange}. slots: continent: query.continent dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/attacks/layer7/top/vertical'].get update: x-apievangelist-phrasing: intent: Rank verticals targeted by layer 7 attacks effect: read questions: - Which business verticals receive the most HTTP application attacks? - Can I rank web attack targets by vertical for one country? instructions: - text: Rank verticals by layer 7 attacks received in {location}. slots: location: query.location - text: List the top {limit} verticals hit by application attacks over {dateRange}. slots: limit: query.limit dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/hijacks/events'].get update: x-apievangelist-phrasing: intent: List BGP hijack events effect: read questions: - Has my network's prefix been hijacked in BGP recently? - Can I list BGP hijack events above a certain confidence score? instructions: - text: List BGP hijack events where AS{victimAsn} was the victim. slots: victimAsn: query.victimAsn - text: Show BGP hijacks of prefix {prefix} with confidence at least {minConfidence}. slots: prefix: query.prefix minConfidence: query.minConfidence - text: Find hijack events caused by AS{hijackerAsn} over {dateRange}. slots: hijackerAsn: query.hijackerAsn dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/leaks/events'].get update: x-apievangelist-phrasing: intent: List BGP route leak events effect: read questions: - Were there any BGP route leaks involving my network? - Which route leaks have touched networks in a given country? instructions: - text: List route leak events caused by AS{leakAsn}. slots: leakAsn: query.leakAsn - text: Show BGP route leaks involving networks in {involvedCountry} over {dateRange}. slots: involvedCountry: query.involvedCountry dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/routes/moas'].get update: x-apievangelist-phrasing: intent: List multi-origin AS (MOAS) prefixes effect: read questions: - Which prefixes are announced by more than one origin AS? - Can I find only the invalid multi-origin prefixes in global routing tables? instructions: - text: List MOAS prefixes where AS{origin} is one of the origins. slots: origin: query.origin - text: Check whether prefix {prefix} has multiple origin ASes. slots: prefix: query.prefix method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/routes/pfx2as'].get update: x-apievangelist-phrasing: intent: Look up which AS originates a prefix effect: read questions: - Which autonomous system announces a given IP prefix? - Can I see the RPKI status of the prefixes a network originates? instructions: - text: Look up the origin AS for prefix {prefix}. slots: prefix: query.prefix - text: List prefixes originated by AS{origin} with RPKI status {rpkiStatus}. slots: origin: query.origin rpkiStatus: query.rpkiStatus method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/routes/stats'].get update: x-apievangelist-phrasing: intent: Get BGP routing table statistics effect: read questions: - How many routes and prefixes are in the global BGP table right now? - What are the routing table stats for one country or network? instructions: - text: Get BGP routing table stats for AS{asn}. slots: asn: query.asn - text: Show routing table statistics for {location}. slots: location: query.location method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/routes/timeseries'].get update: x-apievangelist-phrasing: intent: Chart announced IP address space over time effect: read questions: - How much IPv4 and IPv6 address space has a network announced over time? - Can I detect a drop in announced IP space for an ASN? instructions: - text: Chart announced IP space for AS{asn} over {dateRange}. slots: asn: query.asn dateRange: query.dateRange - text: Show the time series of announced IPv4 /24s and IPv6 /48s globally. method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/timeseries'].get update: x-apievangelist-phrasing: intent: Chart BGP update volume over time effect: read questions: - How many BGP updates has a network generated over time? - Can I chart only BGP announcements or only withdrawals for a prefix? instructions: - text: Chart BGP updates for AS{asn} over {dateRange}. slots: asn: query.asn dateRange: query.dateRange - text: Plot {updateType} updates for prefix {prefix}. slots: updateType: query.updateType prefix: query.prefix method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/top/ases'].get update: x-apievangelist-phrasing: intent: Rank networks by BGP announcements effect: read questions: - Which autonomous systems send the most BGP announcements? - What networks are noisiest in BGP updates this week? instructions: - text: List the top {limit} ASes by BGP update share. slots: limit: query.limit - text: Rank networks by BGP announcements over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/top/ases/prefixes'].get update: x-apievangelist-phrasing: intent: Rank networks by announced prefix count effect: read questions: - Which networks announce the most prefixes on the global routing table? - Can I rank a country's ASNs by how many prefixes they originate? instructions: - text: Rank ASNs in {country} by announced prefix count. slots: country: query.country - text: Give me the {limit} networks with the most announced prefixes. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/bgp/top/prefixes'].get update: x-apievangelist-phrasing: intent: Rank prefixes by BGP update activity effect: read questions: - Which IP prefixes generate the most BGP updates? - What are the most unstable prefixes for a given network? instructions: - text: List the top {limit} prefixes by BGP updates. slots: limit: query.limit - text: Rank AS{asn} prefixes by {updateType} activity. slots: asn: query.asn updateType: query.updateType method: generated generated: '2026-09-26' - target: $.paths['/radar/connection_tampering/summary'].get update: x-apievangelist-phrasing: intent: Summarize connection tampering types effect: read questions: - How common is connection tampering, like mid-handshake resets, in a country? - What types of TCP connection tampering does Radar observe? instructions: - text: Summarize connection tampering types seen in {location}. slots: location: query.location - text: Break down tampering signatures for AS{asn} over {dateRange}. slots: asn: query.asn dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/connection_tampering/timeseries_groups'].get update: x-apievangelist-phrasing: intent: Track connection tampering over time effect: read questions: - Has connection tampering in a country spiked recently? - Can I trend tampering types day by day to spot censorship events? instructions: - text: Trend connection tampering in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart tampering type shares per {aggInterval} for AS{asn}. slots: aggInterval: query.aggInterval asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/datasets'].get update: x-apievangelist-phrasing: intent: List downloadable Radar datasets effect: read questions: - What datasets does Cloudflare Radar publish for download? - Can I list only ranking bucket datasets? instructions: - text: List Radar datasets of type {datasetType}. slots: datasetType: query.datasetType - text: Show the first {limit} available datasets. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/datasets/{alias}'].get update: x-apievangelist-phrasing: intent: Download a dataset's CSV content effect: read questions: - How do I get the CSV contents of a Radar dataset by its alias? - Can I fetch an older version of a dataset for a specific date? instructions: - text: Download the CSV for dataset {alias}. slots: alias: path.alias - text: Get dataset {alias} as it was on {date}. slots: alias: path.alias date: query.date method: generated generated: '2026-09-26' - target: $.paths['/radar/datasets/download'].post update: x-apievangelist-phrasing: intent: Get a download URL for a dataset effect: read questions: - How can I get a direct download link for a Radar dataset? - Is there a way to fetch a signed URL for one dataset instead of streaming it? instructions: - text: Generate a download URL for dataset ID {datasetId}. slots: datasetId: requestBody.datasetId - text: Give me a link to download dataset {datasetId}. slots: datasetId: requestBody.datasetId method: generated generated: '2026-09-26' - target: $.paths['/radar/dns/top/ases'].get update: x-apievangelist-phrasing: intent: Rank networks querying a domain on 1.1.1.1 effect: read questions: - Which networks resolve my domain most through Cloudflare's public DNS resolver? - What ASNs query a given domain the most? instructions: - text: Rank autonomous systems by 1.1.1.1 queries for {domain}. slots: domain: query.domain - text: List the top {limit} networks looking up {domain}. slots: limit: query.limit domain: query.domain method: generated generated: '2026-09-26' - target: $.paths['/radar/dns/top/locations'].get update: x-apievangelist-phrasing: intent: Rank countries querying a domain on 1.1.1.1 effect: read questions: - Which countries look up my domain the most via 1.1.1.1? - Where in the world is a domain being resolved most often? instructions: - text: Rank locations by 1.1.1.1 queries for {domain}. slots: domain: query.domain - text: Show the top {limit} countries resolving {domain} over {dateRange}. slots: limit: query.limit domain: query.domain dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/arc'].get update: x-apievangelist-phrasing: intent: Summarize ARC results for routed email effect: read questions: - What share of emails forwarded by Email Routing pass ARC validation? - Can I see ARC pass/fail rates for routed mail that also failed DMARC? instructions: - text: Summarize ARC outcomes for Email Routing traffic over {dateRange}. slots: dateRange: query.dateRange - text: Show ARC results for routed messages whose DMARC result was {dmarc}. slots: dmarc: query.dmarc method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/dkim'].get update: x-apievangelist-phrasing: intent: Summarize DKIM results for routed email effect: read questions: - How many forwarded emails pass DKIM signature checks? - What is the DKIM failure rate for mail going through Email Routing? instructions: - text: Summarize DKIM outcomes for Email Routing traffic in {dateRange}. slots: dateRange: query.dateRange - text: Give me the DKIM pass rate for routed mail with SPF result {spf}. slots: spf: query.spf method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/dmarc'].get update: x-apievangelist-phrasing: intent: Summarize DMARC results for routed email effect: read questions: - What percentage of routed emails pass DMARC? - Is DMARC failure more common for routed mail sent over IPv6? instructions: - text: Summarize DMARC outcomes for Email Routing messages over {dateRange}. slots: dateRange: query.dateRange - text: Break down DMARC results of routed mail sent over {ipVersion}. slots: ipVersion: query.ipVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/encrypted'].get update: x-apievangelist-phrasing: intent: Summarize encryption of routed email effect: read questions: - How much mail handled by Email Routing arrives encrypted? - What share of forwarded messages are delivered without TLS? instructions: - text: Summarize encrypted vs unencrypted Email Routing traffic for {dateRange}. slots: dateRange: query.dateRange - text: Show the encryption share of routed mail that passed DKIM with result {dkim}. slots: dkim: query.dkim method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/ip_version'].get update: x-apievangelist-phrasing: intent: Summarize routed email by IP version effect: read questions: - What share of routed email is delivered over IPv6? - Do encrypted forwarded messages favor IPv4 or IPv6? instructions: - text: Summarize the IPv4/IPv6 split of Email Routing traffic in {dateRange}. slots: dateRange: query.dateRange - text: Show IP versions used by routed mail with encryption status {encrypted}. slots: encrypted: query.encrypted method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/summary/spf'].get update: x-apievangelist-phrasing: intent: Summarize SPF results for routed email effect: read questions: - What fraction of emails going through Email Routing pass SPF? - Can I check SPF pass rates for forwarded mail that failed ARC? instructions: - text: Summarize SPF outcomes for Email Routing traffic over {dateRange}. slots: dateRange: query.dateRange - text: Break down SPF results for routed mail whose ARC result was {arc}. slots: arc: query.arc method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/arc'].get update: x-apievangelist-phrasing: intent: Track ARC results for routed email over time effect: read questions: - Is ARC validation of forwarded email improving over time? - Can I get a daily time series of ARC outcomes for Email Routing? instructions: - text: Trend ARC results of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail ARC outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/dkim'].get update: x-apievangelist-phrasing: intent: Track DKIM results for routed email over time effect: read questions: - Has the DKIM pass rate for forwarded mail changed over the past months? - Can I trend DKIM failures in Email Routing traffic? instructions: - text: Trend DKIM results of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail DKIM outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/dmarc'].get update: x-apievangelist-phrasing: intent: Track DMARC results for routed email over time effect: read questions: - Is DMARC compliance of routed email rising over time? - Can I see a time series of DMARC failures for Email Routing? instructions: - text: Trend DMARC results of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail DMARC outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/encrypted'].get update: x-apievangelist-phrasing: intent: Track encryption of routed email over time effect: read questions: - Is more forwarded email arriving encrypted over time? - Can I trend unencrypted deliveries through Email Routing? instructions: - text: Trend the encrypted share of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail encryption status per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/ip_version'].get update: x-apievangelist-phrasing: intent: Track routed email by IP version over time effect: read questions: - Is IPv6 delivery of routed email growing over time? - Can I trend the IPv4/IPv6 split of Email Routing traffic? instructions: - text: Trend IP versions of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail IPv4 vs IPv6 share per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/routing/timeseries_groups/spf'].get update: x-apievangelist-phrasing: intent: Track SPF results for routed email over time effect: read questions: - Has SPF validation of forwarded mail changed recently? - Can I get a time series of SPF outcomes for Email Routing? instructions: - text: Trend SPF results of Email Routing traffic across {dateRange}. slots: dateRange: query.dateRange - text: Chart routed-mail SPF outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/arc'].get update: x-apievangelist-phrasing: intent: Summarize ARC results in scanned email effect: read questions: - In email security scanning, what share of messages pass ARC? - Can I see ARC results only for scanned mail sent over TLS 1.3? instructions: - text: Summarize ARC validation across security-scanned email for {dateRange}. slots: dateRange: query.dateRange - text: Break down ARC results of scanned mail delivered with {tlsVersion}. slots: tlsVersion: query.tlsVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/dkim'].get update: x-apievangelist-phrasing: intent: Summarize DKIM results in scanned email effect: read questions: - What percentage of security-scanned emails have valid DKIM signatures? - Is DKIM failure higher for scanned mail that also fails SPF? instructions: - text: Summarize DKIM validation across security-scanned email for {dateRange}. slots: dateRange: query.dateRange - text: Break down DKIM results of scanned mail with SPF result {spf}. slots: spf: query.spf method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/dmarc'].get update: x-apievangelist-phrasing: intent: Summarize DMARC results in scanned email effect: read questions: - How many emails seen by Cloudflare email security fail DMARC? - Does DMARC failure vary by TLS version in scanned email? instructions: - text: Summarize DMARC validation across security-scanned email for {dateRange}. slots: dateRange: query.dateRange - text: Break down DMARC results of scanned mail delivered with {tlsVersion}. slots: tlsVersion: query.tlsVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/malicious'].get update: x-apievangelist-phrasing: intent: Summarize share of malicious email effect: read questions: - What percentage of email is classified as malicious? - Is malicious mail more common among messages that fail DMARC? instructions: - text: Give me the malicious vs clean email share for {dateRange}. slots: dateRange: query.dateRange - text: Show the malicious share of mail whose DMARC result was {dmarc}. slots: dmarc: query.dmarc method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/spam'].get update: x-apievangelist-phrasing: intent: Summarize share of spam email effect: read questions: - What proportion of email traffic is spam? - Is spam more prevalent in mail that fails SPF? instructions: - text: Give me the spam vs legitimate email split over {dateRange}. slots: dateRange: query.dateRange - text: Show the spam share of messages with SPF result {spf}. slots: spf: query.spf method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/spf'].get update: x-apievangelist-phrasing: intent: Summarize SPF results in scanned email effect: read questions: - What share of security-scanned mail passes SPF? - Can I see SPF outcomes of scanned emails that failed DKIM? instructions: - text: Summarize SPF validation across security-scanned email for {dateRange}. slots: dateRange: query.dateRange - text: For scanned messages where DKIM came back {dkim}, show how SPF turned out. slots: dkim: query.dkim method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/spoof'].get update: x-apievangelist-phrasing: intent: Summarize share of spoofed email effect: read questions: - How much email is spoofed rather than legitimate? - Are spoofed messages concentrated among mail that fails ARC? instructions: - text: Give me the spoofed vs genuine email proportion for {dateRange}. slots: dateRange: query.dateRange - text: Show the spoof share of messages whose ARC result was {arc}. slots: arc: query.arc method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/threat_category'].get update: x-apievangelist-phrasing: intent: Summarize email threats by category effect: read questions: - Which threat categories, like phishing or malware links, show up most in email? - What is the breakdown of email threats by type? instructions: - text: Summarize email threat categories over {dateRange}. slots: dateRange: query.dateRange - text: Break down threat types in mail sent with {tlsVersion}. slots: tlsVersion: query.tlsVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/summary/tls_version'].get update: x-apievangelist-phrasing: intent: Summarize email by TLS version effect: read questions: - Which TLS versions are used to deliver email? - How much inbound mail still uses TLS 1.0 or 1.1? instructions: - text: Summarize TLS versions used for email delivery over {dateRange}. slots: dateRange: query.dateRange - text: Break down TLS versions of mail with DMARC result {dmarc}. slots: dmarc: query.dmarc method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/arc'].get update: x-apievangelist-phrasing: intent: Track ARC results in scanned email over time effect: read questions: - How has ARC validation in security-scanned mail changed over time? - Can I trend ARC failures in scanned email by week? instructions: - text: Trend ARC results for security-scanned email across {dateRange}. slots: dateRange: query.dateRange - text: Chart scanned-mail ARC outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/dkim'].get update: x-apievangelist-phrasing: intent: Track DKIM results in scanned email over time effect: read questions: - Is the DKIM pass rate in scanned email trending up? - Can I get a time series of DKIM outcomes from email security data? instructions: - text: Trend DKIM results for security-scanned email across {dateRange}. slots: dateRange: query.dateRange - text: Chart scanned-mail DKIM outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/dmarc'].get update: x-apievangelist-phrasing: intent: Track DMARC results in scanned email over time effect: read questions: - How has DMARC adoption in scanned email evolved over time? - Can I trend DMARC failures in email security data? instructions: - text: Trend DMARC results for security-scanned email across {dateRange}. slots: dateRange: query.dateRange - text: Chart scanned-mail DMARC outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/malicious'].get update: x-apievangelist-phrasing: intent: Track malicious email share over time effect: read questions: - Is the share of malicious email rising over time? - Can I chart malicious email week by week? instructions: - text: Trend the malicious email share across {dateRange}. slots: dateRange: query.dateRange - text: Chart malicious vs clean mail per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/spam'].get update: x-apievangelist-phrasing: intent: Track spam email share over time effect: read questions: - Has the proportion of spam email changed over the past few months? - Can I get a daily spam rate time series? instructions: - text: Trend the spam share of email across {dateRange}. slots: dateRange: query.dateRange - text: Chart spam vs non-spam mail per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/spf'].get update: x-apievangelist-phrasing: intent: Track SPF results in scanned email over time effect: read questions: - How have SPF pass rates in security-scanned mail changed over time? - Can I trend SPF failures from email security data? instructions: - text: Trend SPF results for security-scanned email across {dateRange}. slots: dateRange: query.dateRange - text: Chart scanned-mail SPF outcomes per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/spoof'].get update: x-apievangelist-phrasing: intent: Track spoofed email share over time effect: read questions: - Is email spoofing increasing over time? - Can I chart the spoofed mail rate by day? instructions: - text: Trend the spoofed email share across {dateRange}. slots: dateRange: query.dateRange - text: Chart spoof vs non-spoof mail per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/threat_category'].get update: x-apievangelist-phrasing: intent: Track email threat categories over time effect: read questions: - Which email threat types have been growing over time? - Can I trend phishing versus other email threat categories? instructions: - text: Trend email threat categories across {dateRange}. slots: dateRange: query.dateRange - text: Chart email threat type shares per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/timeseries_groups/tls_version'].get update: x-apievangelist-phrasing: intent: Track email TLS versions over time effect: read questions: - Is TLS 1.3 adoption for email delivery increasing? - Can I trend which TLS versions email servers negotiate? instructions: - text: Trend TLS versions used for email across {dateRange}. slots: dateRange: query.dateRange - text: Chart email TLS version shares per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/top/tlds'].get update: x-apievangelist-phrasing: intent: Rank sender TLDs by email volume effect: read questions: - Which top-level domains send the most email? - Can I rank sending TLDs only within generic or country-code categories? instructions: - text: List the top {limit} TLDs by email messages. slots: limit: query.limit - text: Rank {tldCategory} TLDs by email volume over {dateRange}. slots: tldCategory: query.tldCategory dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/top/tlds/malicious/{malicious}'].get update: x-apievangelist-phrasing: intent: Rank TLDs by malicious email effect: read questions: - Which TLDs are the biggest sources of mail flagged as malicious? - What TLDs are responsible for the most clean, non-malicious mail? instructions: - text: Rank TLDs by email with malicious classification {malicious}. slots: malicious: path.malicious - text: List the top {limit} {tldCategory} TLDs for malicious value {malicious}. slots: limit: query.limit tldCategory: query.tldCategory malicious: path.malicious method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/top/tlds/spam/{spam}'].get update: x-apievangelist-phrasing: intent: Rank TLDs by spam email effect: read questions: - Which top-level domains send the most spam? - What TLDs have the most legitimate, non-spam senders? instructions: - text: Rank TLDs by email with spam classification {spam}. slots: spam: path.spam - text: List the top {limit} sender TLDs where spam is {spam} over {dateRange}. slots: limit: query.limit spam: path.spam dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/email/security/top/tlds/spoof/{spoof}'].get update: x-apievangelist-phrasing: intent: Rank TLDs by spoofed email effect: read questions: - Which top-level domains are most associated with spoofed email? - Can I list TLDs that send the most non-spoofed mail? instructions: - text: Rank TLDs by email with spoof classification {spoof}. slots: spoof: path.spoof - text: Show the top {limit} {tldCategory} TLDs where spoof is {spoof}. slots: limit: query.limit tldCategory: query.tldCategory spoof: path.spoof method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/asns'].get update: x-apievangelist-phrasing: intent: List autonomous systems effect: read questions: - Can I list all autonomous systems registered in a country? - What autonomous systems does Radar know about, sorted by population? instructions: - text: List autonomous systems in {location}. slots: location: query.location - text: List ASes ordered by {orderBy}. slots: orderBy: query.orderBy method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/asns/{asn}'].get update: x-apievangelist-phrasing: intent: Get details for an AS number effect: read questions: - Who operates a given AS number and where is it based? - What does Cloudflare Radar know about a specific autonomous system? instructions: - text: Get details for AS{asn}. slots: asn: path.asn - text: Tell me the name, country and organization behind ASN {asn}. slots: asn: path.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/asns/{asn}/rel'].get update: x-apievangelist-phrasing: intent: Get an AS's peering and transit relationships effect: read questions: - Who are the upstream providers and peers of a given network? - What is the relationship between two specific ASNs? instructions: - text: Show the AS-level relationships of AS{asn}. slots: asn: path.asn - text: Check how AS{asn} is related to AS{asn2}. slots: asn: path.asn asn2: query.asn2 method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/asns/ip'].get update: x-apievangelist-phrasing: intent: Find the autonomous system for an IP address effect: read questions: - Which network (ASN) does an IP address belong to? - Can I get the AS details and user population behind an IP? instructions: - text: Find the autonomous system that owns {ip}. slots: ip: query.ip - text: Look up the ASN details for IP address {ip}. slots: ip: query.ip method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/ip'].get update: x-apievangelist-phrasing: intent: Get information about an IP address effect: read questions: - What information does Radar have about a given IP address? - Where is an IP address located and what network announces it? instructions: - text: Get IP address information for {ip}. slots: ip: query.ip - text: Tell me the location and network of {ip}. slots: ip: query.ip method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/locations'].get update: x-apievangelist-phrasing: intent: List countries and locations effect: read questions: - Which locations and country codes does Radar support? - Can I get the full list of locations with their alpha-2 codes? instructions: - text: List all Radar locations. - text: Page through Radar locations starting at offset {offset}. slots: offset: query.offset method: generated generated: '2026-09-26' - target: $.paths['/radar/entities/locations/{location}'].get update: x-apievangelist-phrasing: intent: Get details for a location effect: read questions: - What region and coordinates does Radar assign to a country code? - What details does Radar hold for one specific country? instructions: - text: Get location details for {location}. slots: location: path.location - text: Look up the country with alpha-2 code {location}. slots: location: path.location method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/bot_class'].get update: x-apievangelist-phrasing: intent: Summarize HTTP traffic from bots vs humans effect: read questions: - What share of web traffic comes from bots rather than humans? - Is bot traffic higher on mobile devices in a given country? instructions: - text: Summarize bot vs human HTTP traffic in {location}. slots: location: query.location - text: Show the bot share of {deviceType} traffic over {dateRange}. slots: deviceType: query.deviceType dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/device_type'].get update: x-apievangelist-phrasing: intent: Summarize HTTP traffic by device type effect: read questions: - What share of web traffic comes from mobile versus desktop? - Which device types generate traffic in one network? instructions: - text: Summarize mobile vs desktop HTTP traffic in {location}. slots: location: query.location - text: Break down device types for traffic from AS{asn}. slots: asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/http_protocol'].get update: x-apievangelist-phrasing: intent: Summarize traffic by HTTP vs HTTPS effect: read questions: - How much web traffic is still plain HTTP instead of HTTPS? - What is the HTTPS share of requests in a country? instructions: - text: Summarize HTTP vs HTTPS traffic in {location}. slots: location: query.location - text: Show the HTTPS share of {botClass} traffic over {dateRange}. slots: botClass: query.botClass dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/http_version'].get update: x-apievangelist-phrasing: intent: Summarize traffic by HTTP version effect: read questions: - What percentage of requests use HTTP/3 versus HTTP/2 or HTTP/1.x? - Is HTTP/3 adoption higher on mobile? instructions: - text: Summarize HTTP/1.x, HTTP/2 and HTTP/3 shares in {location}. slots: location: query.location - text: Show HTTP version adoption for {deviceType} traffic. slots: deviceType: query.deviceType method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/ip_version'].get update: x-apievangelist-phrasing: intent: Summarize web traffic by IPv4 vs IPv6 effect: read questions: - How much web traffic in a country is over IPv6? - What is the IPv6 adoption rate for a given network? instructions: - text: Summarize IPv6 adoption of HTTP traffic in {location}. slots: location: query.location - text: Give me the IPv4/IPv6 split of web requests from AS{asn}. slots: asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/os'].get update: x-apievangelist-phrasing: intent: Summarize web traffic by operating system effect: read questions: - What share of web traffic comes from Android versus iOS or Windows? - Which operating systems dominate traffic in a country? instructions: - text: Summarize HTTP traffic by operating system in {location}. slots: location: query.location - text: Break down operating systems of {deviceType} requests over {dateRange}. slots: deviceType: query.deviceType dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/summary/tls_version'].get update: x-apievangelist-phrasing: intent: Summarize web traffic by TLS version effect: read questions: - How much HTTPS traffic uses TLS 1.3? - Is anyone still connecting with TLS 1.0 in a given country? instructions: - text: Summarize TLS versions of web traffic in {location}. slots: location: query.location - text: Show TLS version adoption for {httpVersion} requests. slots: httpVersion: query.httpVersion method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/bot_class'].get update: x-apievangelist-phrasing: intent: Track bot vs human web traffic over time effect: read questions: - Is the share of bot traffic growing over time? - Can I chart automated versus human requests daily for a country? instructions: - text: Trend bot vs human HTTP traffic in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the automated traffic share per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/browser'].get update: x-apievangelist-phrasing: intent: Track top user agents over time effect: read questions: - How have the most popular browsers' shares of traffic changed over time? - Can I trend the top user agents in a specific country? instructions: - text: Trend the top {limitPerGroup} user agents in {location}. slots: limitPerGroup: query.limitPerGroup location: query.location - text: Chart individual browser versions' traffic share over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/browser_family'].get update: x-apievangelist-phrasing: intent: Track browser families over time effect: read questions: - How are browser families like Chrome, Safari and Firefox trending in traffic share? - Can I see browser family share over time on mobile? instructions: - text: Trend browser family share in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart browser families for {deviceType} traffic over time. slots: deviceType: query.deviceType method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/device_type'].get update: x-apievangelist-phrasing: intent: Track web traffic by device type over time effect: read questions: - Is mobile traffic overtaking desktop over time? - Can I trend device type mix of web requests weekly? instructions: - text: Trend mobile vs desktop traffic in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart device type share per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/http_protocol'].get update: x-apievangelist-phrasing: intent: Track HTTP vs HTTPS traffic over time effect: read questions: - Is the share of unencrypted HTTP traffic shrinking over time? - Can I chart HTTPS adoption for a country month by month? instructions: - text: Trend HTTP vs HTTPS traffic in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the HTTPS share per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/http_version'].get update: x-apievangelist-phrasing: intent: Track HTTP version adoption over time effect: read questions: - How fast is HTTP/3 adoption growing? - Can I trend HTTP/2 versus HTTP/3 usage for one network? instructions: - text: Trend HTTP version adoption in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart HTTP/3 usage for AS{asn} over time. slots: asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/ip_version'].get update: x-apievangelist-phrasing: intent: Track IPv6 adoption in web traffic over time effect: read questions: - How has IPv6 adoption for web traffic grown over time? - Can I chart the IPv6 share of requests for a mobile carrier's ASN? instructions: - text: Trend IPv6 adoption of HTTP traffic in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart the IPv4/IPv6 mix for AS{asn} per {aggInterval}. slots: asn: query.asn aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/os'].get update: x-apievangelist-phrasing: intent: Track operating system share over time effect: read questions: - How has the share of Android versus iOS traffic changed over time? - Can I trend top operating systems for mobile traffic? instructions: - text: Trend operating system share in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart top operating systems for {deviceType} devices over time. slots: deviceType: query.deviceType method: generated generated: '2026-09-26' - target: $.paths['/radar/http/timeseries_groups/tls_version'].get update: x-apievangelist-phrasing: intent: Track TLS version adoption over time effect: read questions: - How quickly is TLS 1.3 adoption growing for web traffic? - Can I see a time series of TLS versions used in one country? instructions: - text: Trend TLS version adoption in {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Chart TLS 1.3 vs older versions per {aggInterval}. slots: aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases'].get update: x-apievangelist-phrasing: intent: Rank networks by HTTP traffic effect: read questions: - Which networks generate the most web traffic in a country? - What are the top autonomous systems by HTTP requests? instructions: - text: List the top {limit} ASes by HTTP traffic in {location}. slots: limit: query.limit location: query.location - text: Rank networks by web requests over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/bot_class/{bot_class}'].get update: x-apievangelist-phrasing: intent: Rank networks by bot or human traffic effect: read questions: - Which networks send the most bot traffic? - What ASNs generate the most likely-human web traffic? instructions: - text: Rank ASes by HTTP traffic of bot class {bot_class}. slots: bot_class: path.bot_class - text: Show the {limit} ASNs in {location} sending the most {bot_class}-classified requests. slots: limit: query.limit location: query.location bot_class: path.bot_class method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/device_type/{device_type}'].get update: x-apievangelist-phrasing: intent: Rank networks by traffic from a device type effect: read questions: - Which networks send the most mobile web traffic? - What ASNs carry the most desktop requests in a country? instructions: - text: Rank ASes by HTTP traffic from {device_type} devices. slots: device_type: path.device_type - text: List the {limit} ISPs in {location} carrying the most {device_type} browsing. slots: limit: query.limit location: query.location device_type: path.device_type method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/http_protocol/{http_protocol}'].get update: x-apievangelist-phrasing: intent: Rank networks by HTTP or HTTPS traffic effect: read questions: - Which networks still send the most plain HTTP traffic? - What ASNs lead in HTTPS requests? instructions: - text: Rank ASes by web traffic over {http_protocol}. slots: http_protocol: path.http_protocol - text: Name the {limit} {location} providers with the most {http_protocol} scheme requests. slots: limit: query.limit location: query.location http_protocol: path.http_protocol method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/http_version/{http_version}'].get update: x-apievangelist-phrasing: intent: Rank networks by HTTP version used effect: read questions: - Which networks send the most HTTP/3 traffic? - What ASNs still rely most on HTTP/1.x? instructions: - text: Rank ASes by traffic using {http_version}. slots: http_version: path.http_version - text: Give me {limit} {location} networks leading on protocol version {http_version}. slots: limit: query.limit location: query.location http_version: path.http_version method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/ip_version/{ip_version}'].get update: x-apievangelist-phrasing: intent: Rank networks by IPv4 or IPv6 web traffic effect: read questions: - Which networks send the most IPv6 web traffic? - What ASNs have the most IPv4-only requests? instructions: - text: Rank autonomous systems by share of requests arriving via {ip_version} addressing. slots: ip_version: path.ip_version - text: Find the {limit} carriers in {location} with most {ip_version} addressed clients. slots: limit: query.limit location: query.location ip_version: path.ip_version method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/os/{os}'].get update: x-apievangelist-phrasing: intent: Rank networks by traffic from an operating system effect: read questions: - Which networks send the most traffic from iOS devices? - What ASNs lead in Android web requests? instructions: - text: Rank ASes by web traffic from {os}. slots: os: path.os - text: List the top {limit} networks in {location} for {os} users. slots: limit: query.limit location: query.location os: path.os method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/ases/tls_version/{tls_version}'].get update: x-apievangelist-phrasing: intent: Rank networks by TLS version used effect: read questions: - Which networks send the most TLS 1.3 traffic? - What ASNs still use old TLS versions most? instructions: - text: Rank ASes by web traffic using {tls_version}. slots: tls_version: path.tls_version - text: List the top {limit} networks in {location} for {tls_version} connections. slots: limit: query.limit location: query.location tls_version: path.tls_version method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/browser_families'].get update: x-apievangelist-phrasing: intent: Rank browser families by traffic effect: read questions: - Which browser families have the biggest share of web traffic? - What is the most used browser family in a country? instructions: - text: Rank browser families by HTTP traffic in {location}. slots: location: query.location - text: List the top {limit} browser families on {os}. slots: limit: query.limit os: query.os method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/browsers'].get update: x-apievangelist-phrasing: intent: Rank user agents by traffic effect: read questions: - Which specific browser versions send the most traffic? - What are the top user agents in a given country? instructions: - text: Rank user agents by HTTP traffic in {location}. slots: location: query.location - text: List the top {limit} browsers for {deviceType} traffic. slots: limit: query.limit deviceType: query.deviceType method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations'].get update: x-apievangelist-phrasing: intent: Rank countries by HTTP traffic effect: read questions: - Which countries generate the most web traffic? - What are the top locations by HTTP requests this month? instructions: - text: List the top {limit} countries by HTTP traffic. slots: limit: query.limit - text: Rank locations by web requests over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/bot_class/{bot_class}'].get update: x-apievangelist-phrasing: intent: Rank countries by bot or human traffic effect: read questions: - Which countries generate the most bot traffic? - Where does the most likely-human web traffic come from? instructions: - text: Rank countries by HTTP traffic of bot class {bot_class}. slots: bot_class: path.bot_class - text: List the top {limit} locations for {bot_class} traffic over {dateRange}. slots: limit: query.limit bot_class: path.bot_class dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/device_type/{device_type}'].get update: x-apievangelist-phrasing: intent: Rank countries by traffic from a device type effect: read questions: - Which countries have the most mobile web traffic? - Where does desktop traffic mostly come from? instructions: - text: Rank countries by HTTP traffic from {device_type} devices. slots: device_type: path.device_type - text: List the top {limit} locations for {device_type} requests over {dateRange}. slots: limit: query.limit device_type: path.device_type dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/http_protocol/{http_protocol}'].get update: x-apievangelist-phrasing: intent: Rank countries by HTTP or HTTPS traffic effect: read questions: - Which countries still send the most unencrypted HTTP traffic? - Where is HTTPS traffic highest? instructions: - text: Rank countries by web traffic over {http_protocol}. slots: http_protocol: path.http_protocol - text: Rank {limit} nations by {http_protocol} scheme usage during {dateRange}. slots: limit: query.limit http_protocol: path.http_protocol dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/http_version/{http_version}'].get update: x-apievangelist-phrasing: intent: Rank countries by HTTP version used effect: read questions: - Which countries use HTTP/3 the most? - Where is HTTP/1.x still most common? instructions: - text: Rank countries by traffic using {http_version}. slots: http_version: path.http_version - text: Top {limit} countries adopting {http_version} during {dateRange}, please. slots: limit: query.limit http_version: path.http_version dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/ip_version/{ip_version}'].get update: x-apievangelist-phrasing: intent: Rank countries by IPv4 or IPv6 web traffic effect: read questions: - Which countries lead in IPv6 web traffic? - Where is IPv4-only web traffic still most common? instructions: - text: Rank countries by share of clients connecting via {ip_version} addressing. slots: ip_version: path.ip_version - text: Show which {limit} places lead {ip_version} connectivity during {dateRange}. slots: limit: query.limit ip_version: path.ip_version dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/os/{os}'].get update: x-apievangelist-phrasing: intent: Rank countries by traffic from an operating system effect: read questions: - Which countries have the most iOS web traffic? - Where is Android traffic share highest? instructions: - text: Rank countries by web traffic from {os}. slots: os: path.os - text: List the top {limit} locations for {os} users over {dateRange}. slots: limit: query.limit os: path.os dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/http/top/locations/tls_version/{tls_version}'].get update: x-apievangelist-phrasing: intent: Rank countries by TLS version used effect: read questions: - Which countries use TLS 1.3 the most? - Where are old TLS versions still in heavy use? instructions: - text: Rank countries by web traffic using {tls_version}. slots: tls_version: path.tls_version - text: List the top {limit} locations for {tls_version} connections over {dateRange}. slots: limit: query.limit tls_version: path.tls_version dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/netflows/timeseries'].get update: x-apievangelist-phrasing: intent: Chart network traffic (NetFlows) over time effect: read questions: - Did overall network traffic drop in a country during an outage? - Can I chart NetFlows traffic for one ASN over time? instructions: - text: Chart NetFlows traffic for {location} over {dateRange}. slots: location: query.location dateRange: query.dateRange - text: Plot network traffic for AS{asn} using {normalization} normalization. slots: asn: query.asn normalization: query.normalization method: generated generated: '2026-09-26' - target: $.paths['/radar/netflows/top/ases'].get update: x-apievangelist-phrasing: intent: Rank networks by NetFlows traffic effect: read questions: - Which networks carry the most traffic by NetFlows volume? - What ASNs in a country move the most network traffic? instructions: - text: List the top {limit} ASes by network traffic in {location}. slots: limit: query.limit location: query.location - text: Rank networks by NetFlows volume over {dateRange}. slots: dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/netflows/top/locations'].get update: x-apievangelist-phrasing: intent: Rank countries by NetFlows traffic effect: read questions: - Which countries generate the most network traffic by NetFlows? - What locations on a continent move the most traffic? instructions: - text: List the top {limit} countries by NetFlows traffic. slots: limit: query.limit - text: Rank locations in {continent} by network traffic over {dateRange}. slots: continent: query.continent dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/iqi/summary'].get update: x-apievangelist-phrasing: intent: Summarize Internet quality (IQI) percentiles effect: read questions: - What are typical bandwidth and latency percentiles for a country? - Can I get the Internet Quality Index DNS response time summary for a network? instructions: - text: Summarize IQI {metric} percentiles for {location}. slots: metric: query.metric location: query.location - text: Get the {metric} quality summary for AS{asn}. slots: metric: query.metric asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/iqi/timeseries_groups'].get update: x-apievangelist-phrasing: intent: Track Internet quality (IQI) over time effect: read questions: - Has latency in a country gotten better or worse over time? - Can I trend bandwidth percentiles for a network with interpolation? instructions: - text: Trend IQI {metric} for {location} over {dateRange}. slots: metric: query.metric location: query.location dateRange: query.dateRange - text: Chart {metric} percentiles for AS{asn} per {aggInterval}. slots: metric: query.metric asn: query.asn aggInterval: query.aggInterval method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/speed/histogram'].get update: x-apievangelist-phrasing: intent: Get a speed test histogram effect: read questions: - What does the distribution of speed test results look like in a country? - Can I get a bandwidth histogram with a custom bucket size? instructions: - text: Build a speed test histogram for {location}. slots: location: query.location - text: Get the {metricGroup} histogram with {bucketSize} buckets. slots: metricGroup: query.metricGroup bucketSize: query.bucketSize method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/speed/summary'].get update: x-apievangelist-phrasing: intent: Summarize speed test results effect: read questions: - What are average bandwidth, latency, jitter and packet loss for a country? - What do the last 90 days of speed tests say about a given ISP? instructions: - text: Summarize speed test results for {location}. slots: location: query.location - text: Get speed test bandwidth, latency and jitter for AS{asn}. slots: asn: query.asn method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/speed/top/ases'].get update: x-apievangelist-phrasing: intent: Rank networks by speed test results effect: read questions: - Which ISPs have the fastest download speeds in a country? - What networks have the worst latency or packet loss? instructions: - text: Rank ISPs in {location} by {orderBy}. slots: location: query.location orderBy: query.orderBy - text: List the top {limit} networks by speed test bandwidth. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/quality/speed/top/locations'].get update: x-apievangelist-phrasing: intent: Rank countries by speed test results effect: read questions: - Which countries have the fastest Internet speeds? - Where is latency the worst based on speed tests? instructions: - text: Rank countries in {continent} by {orderBy}. slots: continent: query.continent orderBy: query.orderBy - text: List the top {limit} locations by speed test bandwidth. slots: limit: query.limit method: generated generated: '2026-09-26' - target: $.paths['/radar/ranking/domain/{domain}'].get update: x-apievangelist-phrasing: intent: Get a domain's popularity rank effect: read questions: - What is my domain's popularity rank on Cloudflare Radar? - Which rank bucket does a domain fall into on a particular date? instructions: - text: Get rank details for {domain}. slots: domain: path.domain - text: Show the {rankingType} rank of {domain} on {date}. slots: rankingType: query.rankingType domain: path.domain date: query.date method: generated generated: '2026-09-26' - target: $.paths['/radar/ranking/timeseries_groups'].get update: x-apievangelist-phrasing: intent: Track domain ranks over time effect: read questions: - How has a domain's popularity rank changed over time? - Can I compare the rank history of several domains? instructions: - text: Chart the rank history of {domains} over {dateRange}. slots: domains: query.domains dateRange: query.dateRange - text: Trend {rankingType} rankings over time. slots: rankingType: query.rankingType method: generated generated: '2026-09-26' - target: $.paths['/radar/ranking/top'].get update: x-apievangelist-phrasing: intent: List top or trending domains effect: read questions: - What are the most popular domains on the Internet right now? - Which domains are trending in a given country? instructions: - text: List the top {limit} domains in {location}. slots: limit: query.limit location: query.location - text: Show {rankingType} domains for {date}. slots: rankingType: query.rankingType date: query.date method: generated generated: '2026-09-26' - target: $.paths['/radar/search/global'].get update: x-apievangelist-phrasing: intent: Search locations, networks and reports effect: read questions: - Can I search Radar for a country, network or report by name? - Is there one search that finds autonomous systems and locations together? instructions: - text: Search Radar for {query}. slots: query: query.query - text: Search for {query} but only include {include} results. slots: query: query.query include: query.include method: generated generated: '2026-09-26' - target: $.paths['/radar/traffic_anomalies'].get update: x-apievangelist-phrasing: intent: List detected traffic anomalies effect: read questions: - Has Radar detected any traffic anomalies that might signal an outage in my country? - Can I list only verified traffic anomalies? instructions: - text: List traffic anomalies detected in {location}. slots: location: query.location - text: Show traffic anomalies with status {status} over {dateRange}. slots: status: query.status dateRange: query.dateRange method: generated generated: '2026-09-26' - target: $.paths['/radar/traffic_anomalies/locations'].get update: x-apievangelist-phrasing: intent: Rank locations by traffic anomalies effect: read questions: - Which countries have had the most traffic anomalies? - What locations rank highest by verified anomaly count? instructions: - text: Rank locations by traffic anomalies over {dateRange}. slots: dateRange: query.dateRange - text: List the top {limit} locations by anomalies with status {status}. slots: limit: query.limit status: query.status method: generated generated: '2026-09-26' - target: $.paths['/radar/verified_bots/top/bots'].get update: x-apievangelist-phrasing: intent: Rank verified bots by traffic effect: read questions: - Which verified bots, like search crawlers, send the most requests? - Who owns the busiest verified bots? instructions: - text: List the top {limit} verified bots with their owners. slots: limit: query.limit - text: Rank verified bots by HTTP requests in {location}. slots: location: query.location method: generated generated: '2026-09-26' - target: $.paths['/radar/verified_bots/top/categories'].get update: x-apievangelist-phrasing: intent: Rank verified bot categories by traffic effect: read questions: - Which categories of verified bots generate the most traffic? - What share of verified bot requests come from search engine crawlers versus monitoring? instructions: - text: Rank verified bot categories by HTTP requests over {dateRange}. slots: dateRange: query.dateRange - text: Show verified bot category shares in {location}. slots: location: query.location method: generated generated: '2026-09-26'