Returns the traffic metrics of your account over a time window: requests by DataDome status, by origin and by threat, the responses DataDome returned, slider and device check outcomes, and contact form submissions. Metrics can be bucketed by time and split by root domain, domain, endpoint or AI agent. Access. The endpoint is available to accounts on an Enterprise Bot Protect plan that have the Trend Reports feature. Any other account gets 403 with the error TREND_REPORTS_NOT_ENABLED, whatever the API key. The API key identifies one account, and every metric returned belongs to that account.Authentication. Send the API key in the x-api-key header. Rate limit. 5 requests per minute per API key. Above it the endpoint returns 429 with a Retry-After header. A request spends the budget once access is granted and before its parameters are checked: a 400 uses one request of the budget, a 403 does not. Time window. from is included and to is excluded. Both are optional: without to the window ends now, and without from it starts 24 hours before to. from must be within the last 24 months and not in the future. A to in the future is treated as now. Send dates as ISO 8601 with seconds and an offset or Z, for example 2026-09-08T15:00:00Z. Fractional seconds are rejected. Every timestamp in the response has the same format, rendered in the requested timezone. Realtime horizon. meta.realtimeHorizon marks where the data source changes. Before the horizon, metrics come from aggregated trend report data, in hourly steps. They are final. From the horizon onward, metrics are computed from real-time logs, to the second. They are provisional: slider and device check outcomes are recorded after the request, so the same query run later can return higher counts. Request boundaries that fall before the horizon are rounded out to the full hour. Always read the horizon from meta.realtimeHorizon, and label your reports with meta.from and meta.to. DDoS traffic. Requests stopped by DDoS Protect during an attack are included in requestsCount and requestsByThreat.ddos. They are not tied to a domain, endpoint or AI agent, so they don't appear in queries that filter or split by those dimensions, or in agentic scope. In that case, the sum of the split buckets can be lower than the unfiltered total. Buckets and pagination. interval sets the time bucket (hour, day or month). Without it, the whole window is one bucket. splitBy adds one dimension per value, and each dimension multiplies the number of buckets. Day and month buckets follow the calendar of timezone. The first and last bucket are clamped to the window, so they can be shorter than interval. Buckets with no traffic are left out, so a window without traffic returns data: []. Buckets are ordered by time, then by the dimensions in the order given in splitBy. Pagination applies only with interval or splitBy. Otherwise the response holds at most one bucket and meta.hasMore is false. When meta.hasMore is true, send meta.nextCursor back as cursor with every other parameter unchanged (limit may change). A cursor expires after 1 hour. An expired cursor, or one sent with other parameters, is rejected with 400 INVALID_CURSOR. The last page has hasMore: false and no nextCursor. Agentic traffic. Agentic scope is on when agenticOnly=true, when aiAgents is set, or when splitBy contains aiAgent. In agentic scope every metric counts AI agent traffic only, meta.query.agenticScope is true, and every bucket carries requestsByIntent. Its values never exceed requestsCount and can sum to less when a request's detected intent is not one of its keys. With splitBy=aiAgent, each bucket carries aiAgentUuid. A null value groups the traffic of agents that are not AI agents of your account. Warnings. An endpoints or aiAgents value that is a valid UUID but matches nothing on your account does not fail the request. It is listed in meta.warnings, with the code UNKNOWN_ENDPOINT_UUID or UNKNOWN_AI_AGENT_UUID, and it matches no traffic. meta.warnings is absent when there is nothing to report. rootDomains and domains are not checked: a value that matches nothing returns no traffic and no warning.