New: Try our AI‑powered Search (Ctrl + K) — Read more

Network Intelligence API

Prev Next

Usage

The network intelligence API provides both detailed and aggregated data that describes network flows and usage.

Base URL and slugs

All endpoints use the prefix [host]/api.

Authentication

All requests must include a m2000_token key pair in the Cookie field:

-b "m2000_token=HereGoesTheValueOfTheToken"

Retrieve the m2000_token from the Management System under Platform>Accounts>Users. Select Generate API Token in the Actions column.

imagesgenerate_token.png

Generate API Token

Errors

  • Client-side errors: Return a 4xx status code with an error field describing the issue.
  • Server-side errors Return a 5xx status code.

Pagination

All API endpoints support bulk fetches. If a response has hasMore as true, the nextPage will contain the value for the page parameter to fetch the next set of objects.

Versioning

This document describes the first version of the EDR API offered with the Platform.

Endpoints

GET /access-endpoint-info

Description

Returns detailed information about access endpoints previously provided in the Management System.

Parameter definitions

  • accessEndpoint: Optional. Hex presentation string with prefix of 0x. For example, 0x1280d05.
  • page: Optional. Cursor for pagination across multiple pages of results. Don’t include this parameter on the first call. Use the nextPage value from the previous response to request subsequent results.

Example request & response

curl --request GET --header "Authorization: BEARER [token]" [host]/api/access-endpoint-info?accessEndpoint=[accessEndpoint]&page=[page]
  • If information is available from the parameters used or no parameters were used, status code 200 with body:
{  "data": [    {      "AZIMUTH": "40",      "OMCH_IP": "192.168.0.14",      "SECTOR_ID": "1",      "SITE_ID": "1",      "FREQ_NUMERIC": "800",      "SITE_NAME": "",      "TRANSMITTER": "0x2345105",      "FREQ_BAND": "",      "ECI_HEX": "0x2345105",      "ENB_ID": "19216801",      "LOGICAL_CP": "192.169.0.13",      "REGION": "",      "COUNTRY": "",      "COVERAGE_LAYER": "true",      "LONGITUDE": "99.04301",      "LOGICAL_UP": "192.168.0.12",      "ECI_ALIAS": "",      "LATITUDE": "-13.4324324",      "BANDWIDTH": "10"    }    ...  ],  "hasMore": false}
  • If access endpoint does not exists, status code 200 with body:
{  "message": "No results found for Access Endpoint [endpoint]"}

GET /edr-access-endpoint

Description

Returns a list of access endpoint performance metrics in reverse chronological order (newest to oldest).

Parameter definitions

  • accessEndpoint: Optional. Hex presentation string with prefix of 0x. For example, 0x1280d05.
  • accessEndpointAlias: Optional. Access endpoint alias. This info is usually uploaded to the Management System during deployment
  • accessAggregationId: Optional. Numeric eNodeB ID. This info is usually uploaded to the Management System during deployment.

Only one of accessEndpoint, accessEndpointAlias, or accessAggregationId should be provided in the request.

  • limit: Optional. Maximum number of records that will be returned. Limit can range from 1 to 1000 and default value is 1000.
  • from: Optional. Start time window with format YYYY-MM-DDTHH:mm:ss.SSSZ. For example, 2023-12-04T16:45:00.000Z. Default value will be the previous n day configured in MerlinRuntimeProperties_DEFAULT_MAX_DAYS. To configure or see this value, log in into the management system and navigate to Platform > Settings > Advanced.
  • to: Optional. End time window with format YYYY-MM-DDTHH:mm:ss.SSSZ. For example, 2023-12-04T16:45:00.000Z. Default value will be the current date.
  • page: Optional. Cursor for pagination across multiple pages of results. Don’t include this parameter on the first call. Use the nextPage value from the previous response to request subsequent results.

Example request & response

curl --request GET --header "Authorization: BEARER [token]" [host]/api/edr-access-endpoint?accessEndpoint=[accessEndpoint]&limit=[limit]&from=[from]&to=[to]&page=[page]
  • If information is available from the parameters used or no parameters were used, status code 200 with body:
{  "data": [    {      "AverageRecoveredCapacity": 0.0,      "MedianSimultaneousActiveSubscriberCount": 0,      "OpangaSpeedTest": 0.0,      "UplinkVolume": 4864,      "BurstRateStdDevSampleCount": 0,      "TcpRtt": 0,      "IsCoverageLayer": true,      "TcpRttStdDev": 0,      "TimeTo500KBytesSampleCount": 13,      "SectorId": "350",      "AccessType": 1800,      "StartMinute": 45,      "SufficientThroughputPercentSampleCount": 0,      "BurstRateStdDev": 0,      "CongestionRatio": 0,      "AverageSimultaneousActiveSubscriberCount": 0.04,      "InterBurstGapStdDevSampleCount": 0,      "TcpRttStdDevSampleCount": 0,      "AccessAggregationId": 39,      "AccessBandwidth": 3,      "SubscriberClassification": null,      "Country": "USA",      "Region": "Seattle",      "CxScore": 8.986,      "CxSampleCount": 25,      "SiteId": "SEA777",      "StartHour": 19,      "TrafficProcessor": "devmetal2-bowser.opanga.com",      "Azimuth": 40,      "TimeTo500KBytes": 355,      "TcpRttSampleCount": 0,      "BurstRateSampleCount": 25,      "BurstRate": 11.595,      "Protocol": "ALL",      "DownlinkVolume": 13923968,      "SufficientThroughputPercent": 0,      "InterBurstGapSampleCount": 0,      "InterBurstGapStdDev": 0,      "SubscriberBecomeActiveCount": 26,      "AverageRecoveredCapacitySampleCount": 0,      "InterBurstGap": 0,      "AccessAggregationAlias": "SEA777-Seattle",      "AccessEndpointAlias": "SEA777-0x2761",      "IntervalDuration": 15,      "OpangaSpeedTestSampleCount": 0,      "@timestamp": 1741032000000,      "BurstWidth": 433,      "BurstWidthSampleCount": 25,      "AccessEndpoint": "0x2761",      "Location": "54.613976,25.706693"    },    ...  ],  "hasMore": true,  "nextPage": "1741037400000;17179879638;spCTBAUpLmRzLWVkci1hY2Nlc3MtZW5kcG9p"}
  • If more than one identifier (accessEndpoint, accessEndpointAlias, or accessAggregationId) is used, status code 400 with body:
{  "error": "Only one of accessEndpoint, accessEndpointAlias, or accessAggregationId may be provided"}
  • If accessEndpoint/ accessEndpointAlias /accessAggregationId does not exists, status code 200 with body:
{  "data": [],  "hasMore": false}

GET /edr-flow-network-intelligence

Description

Returns detailed information per data flow metrics, including the access endpoint data, flow type, Network Optimization operating mode, etc.

Parameter definitions

  • accessEndpoint: Optional. Hex presentation string with prefix of 0x. For example, 0x1280d05.
  • limit: Optional. Maximum number of records that will be returned. Limit can range from 1 to 1000 and default value is 1000.
  • from: Optional. Start time window with format YYYY-MM-DDTHH:mm:ss.SSSZ. For example, 2023-12-04T16:45:00.000Z. Default value will be the previous n day configured in MerlinRuntimeProperties_DEFAULT_MAX_DAYS. To configure or see this value, log in into the management system and navigate to Platform > Settings > Advanced.
  • to: Optional. End time window with format YYYY-MM-DDTHH:mm:ss.SSSZ. For example, 2023-12-04T16:45:00.000Z. Default value will be the current date.
  • page: Optional. Cursor for pagination across multiple pages of results. Don’t include this parameter on the first call. Use the nextPage value from the previous response to request subsequent results.

Example request & response

curl --request GET --header "Authorization: BEARER [token]" [host]/api/edr-flow-network-intelligence?accessEndpoint=[accessEndpoint]&limit=[limit]&from=[from]&to=[to]&page=[page]
{  "data": [    {      "@timestamp": 1726891199000,      "AccessAggregationAlias": "OakVillageBoulevard",      "AccessAggregationId": 61647,      "AccessBandwidth": 15,      "AccessEndpoint": "0xf0cf51",      "AccessEndpointAlias": "OakVillageBoulevard_0xf0cf51",      "AccessEndpointCount": 1,      "AccessEndpoints": [        "0xf0cf51"      ],      "AccessType": 2601,      "Application": "Meta",      "ApplicationType": "Social Networking",      "Azimuth": 348,      "BurstRate": 4.461,      "BurstWidth": 625,      "CongestionRatio": "",      "ConsumptionRate": 4.4623616,      "Country": "United States",      "CxScore": 5.749052631578947,      "DestIp": "172.217.135.202",      "DeviceId": "7856a3de7089fdda8811a06e94a352b9d0727a713426f252f4e72aa19ff7facc",      "Dns": "r5.sn-p5qlsn76.c.2mdn.net",      "DomainName": ".",      "DownlinkPackets": 272,      "DownlinkVolume": 348622,      "Dscp": 14,      "Duration": 625,      "ElephantFlowUniqueId": "",      "FirstPacketTime": 1726891198000,      "FlowType": "standard",      "Hostname": "",      "InterBurstGap": 1,      "InterBurstGapStdDev": 2,      "IpVersion": 4,      "IsCoverageLayer": "true",      "IsVideo": "false",      "LastPacketTime": 1726891199000,      "Location": "POINT (-82.5259630149595 28.713973875785808)",      "OverflowedPackets": "",      "PeakRate": 4.461,      "Ports": [        443      ],      "PortsVolume": [          348622      ],      "PortsCount": 1,      "Protocol": "TCP",      "QoSClassIdentifier": 9,      "RadioAccessTechnologyTypes": 6,      "Region": "Homosassa",      "SectorId": 1,      "SiteId": "OVB1300_1",      "Sni": "",      "SrcIp": "10.112.230.73",      "SufficientThroughputPercent": "",      "Tac": 48,      "TcpDataPackets": 205,      "TcpRetransmissionPackets": 0,      "TcpRetransmissionPercent": 0,      "TcpRtt": 0,      "TcpRttStdDev": 0,      "Teid": [        638093286,        482891021,        1402494897,        1269318089,        1425062515,        704181955,        467189614,        1352164448      ],      "TimeTo500KBytes": 0,      "TrafficProcessor": "n2000-03.opanga.com",      "TransmitTime": 625,      "TunnelDestIp": "10.31.34.98",      "TunnelSrcIp": "10.207.8.30",      "UplinkPackets": 0,      "UplinkVolume": 0    },    ...  ],  "hasMore": false}

GET /edr-flow-network-intelligence-bulk-export

Description

Bulk export compressed edr-flow-network-intelligence data, specifying the date, hour and access endpoint.

Note This information is deleted daily.

Parameter definitions

  • date: Required. Request parameter corresponds to the date. The format is YYYY-MM-DD. For example, 2023-12-04.
  • hour: Required. Numeric value of the desired time to fetch using a 24 hour format and two digits. For example, 1:00AM would be entered as ‘01’.
  • accessEndpoint: Optional. Hex presentation string with prefix of 0x. For example, 0x1280d05.

Example request & response

curl --request GET --header "Authorization: BEARER [token]" [host]/api/edr-flow-network-intelligence-bulk-export?date=[date]&hour=[hour]&accessEndpoint=[accessEndpoint]

Response is a date-hour-accessEndpoint.zip containing multiple JSON files named by their creation timestamps. If data is not found, an empty zip file is returned.

© 2026 Cisco and/or its affiliates. All rights reserved.

For more information about trademarks, please visit:
Cisco trademarks 
For more information about legal terms, please visit:
Cisco legal terms
For legal information about Accedian Skylight products, please visit:  Accedian legal terms and trademarks