HomeGuidesAPI Reference
API Reference
GuidesAPI ReferenceGitHubAirheads Developer Community
  1. Orchestrator REST APIs
  2. flow

Retrieve active, inactive, or all flows from an appliance with optional filtering

get
http://127.0.0.1:8080/flow

Retrieves network flow data from a specified SD-WAN appliance. Flows can be filtered by IP endpoints, ports, protocols, applications, VRFs, zones, and various optimization states. The API proxies requests to the appliance's internal /flows endpoint, passing all query parameters for server-side filtering.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
string
required
^\d+\.NE$

Network Element Primary Key - unique appliance identifier assigned by Orchestrator. Format: '.NE' (e.g., '0.NE', '10.NE').

string

First IP endpoint for filtering flows. Supports IPv4 and IPv6 addresses. Used with mask1 for subnet filtering.

int32
0 to 128

CIDR subnet mask for ip1. Defines the network prefix length for filtering (e.g., 24 for /24 subnet).

int32
0 to 65535

Port number for the first IP endpoint. Used to filter flows by source or destination port depending on portEitherFlag.

string

Second IP endpoint for filtering flows. Supports IPv4 and IPv6 addresses. Used with mask2 for subnet filtering.

int32
0 to 128

CIDR subnet mask for ip2. Defines the network prefix length for filtering (e.g., 24 for /24 subnet).

int32
0 to 65535

Port number for the second IP endpoint. Used to filter flows by source or destination port depending on portEitherFlag.

boolean
Defaults to true

Controls IP directionality matching. When true (default), ip1/ip2 can match either source or destination. When false, ip1 is source and ip2 is destination.

boolean
Defaults to true

Controls port directionality matching. When true (default), port1/port2 can match either source or destination. When false, port1 is source and port2 is destination.

string
Defaults to 0

VRF (Virtual Routing and Forwarding) ID for ip1 endpoint. Use '0' for default VRF or specify a custom VRF ID.

string
Defaults to 0

VRF (Virtual Routing and Forwarding) ID for ip2 endpoint. Use '0' for default VRF or specify a custom VRF ID.

string
Defaults to 0

VRF ID for bidirectional matching. Matches flows with this VRF as either source or destination. Use 'any' for all VRFs, '0' for default.

string
enum

Filter by specific application traffic type. Only shows built-in applications; user-defined applications not listed in dropdown.

string
enum

Filter by application group category. Shows subset of available application groups for classification-based filtering.

string
enum

Filter by network protocol. Supports common transport and tunneling protocols for granular traffic analysis.

int32
0 to 4095

Filter by VLAN ID. Constrains results to flows associated with a specific Virtual LAN.

string
Defaults to any

Filter by DSCP (Differentiated Services Code Point) marking. Use 'any' for all DSCP values or specify a specific DSCP value.

string

Filter by overlay ID(s). Multiple values separated by '|' (e.g., '1|2'). Useful for multi-overlay deployments.

string
enum

Filter by transport type. Values: 'fabric' (SD-WAN), 'underlay', 'breakout'. Multiple values separated by '|' (e.g., 'fabric|underlay').

Allowed:
services
array of strings

Filter by service name(s). Third-party services use '' suffix for prefix matching. Multiple services separated by '|' (e.g., 'Zscaler_|PaloAlto').

services
string
Defaults to 0

Filter flows destined to specified zone. Use 'any' for all zones, '0' for default zone, or specific zone_id.

string
Defaults to 0

Filter flows originating from specified zone. Use 'any' for all zones, '0' for default zone, or specific zone_id.

string
Defaults to 0

Filter flows involving specified zone bidirectionally (either source or destination). Use 'any' for all zones, '0' for default.

string
enum
Defaults to all

Filter by flow category/state. 'all' returns all flows; other values filter specific flow types based on optimization status or drop reason.

boolean
enum

Include or exclude Edge HA (High Availability) flows. Set true to include HA synchronization traffic.

Allowed:
boolean
enum

Include or exclude built-in policy flows (system-generated flows). Set true to include internal management traffic.

Allowed:
string
enum

Filter by flow timing/activity state. Defaults to 'anytime' + 'term' if not specified. 'last' prefix = active within period; 'term' prefix = ended within period.

string
enum
Defaults to total

Byte count reporting mode. 'total' = lifetime bytes; 'last5m' = bytes in last 5 minutes for active flow analysis.

Allowed:
string
Defaults to any

Filter by flow duration in minutes. Use 'any' for all, or '<N' / '>N' format (e.g., '>5000' for flows lasting more than 5000 minutes).

integer
enum
required
Defaults to 10000

Maximum number of flows to return. Hard limit prevents excessive data retrieval from appliances.

Allowed:
string

When present (any value), filters to show only slow TCP flows. Useful for diagnosing performance issues.

Responses

Updated about 13 hours ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated about 13 hours ago

Did this page help you?