Cloudflare GraphQL Analytics API

Query analytics data across all Cloudflare products via a single GraphQL endpoint. Covers HTTP requests, Workers metrics, DNS, Firewall events, Network Analytics, and 70+ other datasets.

Overview

• Single endpoint for all analytics: https://api.cloudflare.com/client/v4/graphql
• 1,400+ schema types spanning every Cloudflare product
• Two scopes: zone-level (per-domain) and account-level (cross-domain)
• Adaptive sampling on high-traffic datasets with confidence intervals
• No mutations - read-only analytics (the Mutation type is a stub)
• Cost-based rate limiting - default 300 queries per 5 minutes per user (max 320, varies by query cost)

Quick Decision Tree

Need analytics data from Cloudflare?
├─ HTTP traffic (requests, bandwidth, cache) → httpRequestsAdaptiveGroups (zone or account)
├─ Workers performance (CPU, wall time, errors) → workersInvocationsAdaptive (account)
├─ Firewall/WAF events → firewallEventsAdaptive / firewallEventsAdaptiveGroups (zone or account)
├─ DNS query analytics → dnsAnalyticsAdaptive / dnsAnalyticsAdaptiveGroups (zone or account)
├─ Network layer (DDoS, Magic Transit) → *NetworkAnalyticsAdaptiveGroups (account)
├─ Storage (R2, KV, D1, DO) → r2OperationsAdaptiveGroups / kvOperationsAdaptiveGroups / etc. (account)
├─ AI (Workers AI, AI Gateway) → aiInferenceAdaptive / aiGatewayRequestsAdaptiveGroups (account)
├─ Load Balancing → loadBalancingRequestsAdaptiveGroups (zone)
├─ Custom high-cardinality metrics → Workers Analytics Engine (see ../analytics-engine/)
└─ Need raw logs, not aggregates → Logpush (see Cloudflare docs)

Core Concepts

Query Structure

Every query follows this pattern:

{
  viewer {
    # Zone-scoped
    zones(filter: { zoneTag: "ZONE_ID" }) {
      datasetName(
        filter: { datetime_gt: "...", datetime_lt: "..." }
        limit: 1000
        orderBy: [datetimeFiveMinutes_DESC]
      ) {
        count
        dimensions { ... }
        sum { ... }
      }
    }
    # Account-scoped
    accounts(filter: { accountTag: "ACCOUNT_ID" }) {
      datasetName(filter: { ... }, limit: 100) {
        count
        dimensions { ... }
        sum { ... }
      }
    }
  }
}

Dataset Naming Convention

Dataset names follow a consistent pattern visible in the schema:

Prefer *AdaptiveGroups nodes for most use cases - they support flexible time grouping via dimension fields (datetimeFiveMinutes, datetimeHour, etc.) and are the most commonly used.

Key Datasets by Product

Zone-Scoped (per-domain)

Account-Scoped (cross-domain)

Reading Order

In This Reference

• api.md - Query structure, aggregation fields (sum/avg/quantiles/count), filtering operators, dimensions, dataset details
• configuration.md - Authentication, API tokens, client setup (curl, JS, Python), introspection
• patterns.md - Common queries: time-series, top-N, Workers metrics, HTTP analytics, firewall events, multi-zone
• gotchas.md - Rate limits, sampling caveats, query cost, common errors, plan-based limits

See Also

• GraphQL Analytics API Docs
• GraphQL API Explorer
• Observability Reference - Workers Logs, Tail Workers, console logging
• Analytics Engine Reference - Custom high-cardinality analytics via Workers
• Web Analytics Reference - Client-side (RUM) analytics
• API Reference - REST API, SDKs, authentication basics