Query CDN access logs for a pull zone.
Authenticate with either an Authorization bearer JWT or an AccessKey header.
Filter pushdown happens in ClickHouse where possible; country and free-text
search are applied in-process after fetch.
Documentation Index
Fetch the complete documentation index at: https://docs.bunny.net/llms.txt
Use this file to discover all available pages before exploring further.
Path Parameters
Query Parameters
Inclusive start of the time range (UTC). Defaults to To - 24h.
Must fall within the 3-day log retention window. The total range
(To - From) cannot exceed 3 days.
Exclusive end of the time range (UTC). Defaults to now.
Comma-separated list of HTTP status filters. Each entry can be an exact
code (e.g. 200, 404) or a status class (e.g. 2xx, 5xx).
Multiple entries are combined with OR.
Comma-separated list of cache statuses to match exactly (e.g. HIT,MISS,EXPIRED).
ISO 3166 alpha-2 country code (e.g. EE). Multiple values can be comma-separated.
Edge location / server zone (exact match).
Client IP address filter (IPv4 or IPv6). The match width adapts to the zone's IP anonymization setting so the filter can never reveal information beyond what the API returns: exact match when anonymization is disabled, /24 (IPv4) or /64 (IPv6) when last-octet anonymization is enabled, and ignored when full anonymization is enabled.
Case-insensitive substring match against the request URL (host + path).
Case-insensitive substring match against the User-Agent header.
Case-insensitive substring match against the Referer header.
Free-text, case-insensitive token search. Tokens are space-separated; a row matches if ANY token appears in ANY of the searched columns: cache status, request ID, edge location, host, path, user agent, referer, and (for zones with extended logging) content range. Remote IP, country code, and the authorization header are not searched. use the dedicated filters for those, or note that the authorization header is encrypted at rest. Limited to 16 tokens of at most 128 characters each.
Exact request ID (UUID) to look up a single log entry.
Include origin-shield (edge → shield) requests. Defaults to false to match v1.
Maximum entries to return. Defaults to 100. Capped at 10000.
Number of entries to skip. Defaults to 0.
Sort order by timestamp: asc or desc (default).