Traffic Health - Everflow API

Traffic Health surfaces the operational health of the domains and IPs behind your tracking and conversion links — uptime, SSL, DNS and expiry incidents, blocklist reputation, the remediation tasks that need your attention, and the hosting/certificate configuration each domain resolves to. Two read-only tools cover the whole surface:

Tool	Use when
`list_traffic_health`	Network-wide rollups — “show me all open tasks”, “which domains are flagged”, “list my hosting IPs”, “what expires this month”. Set `type` to choose the resource.
`get_traffic_health_domain`	A single domain’s full picture in one call — its situation plus, on request, its incidents, tasks, reputation, and configuration.

Free vs. Traffic Health Premium

Traffic Health has two tiers. Both tools are always available to any network with Traffic Health enabled, but a subset of resources and includes require Traffic Health Premium. On a network without Premium, a Premium-only request does not error — it returns an empty result with a note explaining the capability is unavailable, e.g.:

{ "total": 0, "returned": 0, "has_more": false, "items": [],
  "note": "domain_reputations is a Traffic Health Premium capability and is not enabled for this network." }

If Traffic Health is not enabled for the network at all, both tools return INVALID_ARGUMENT: Traffic Health is not enabled for this network.

Capability	Free (Traffic Health)	Traffic Health Premium
`list_traffic_health` types	`summary`, `domains`, `tasks`, `uptime_incidents`, `hosting`, `ssl_certificates`	+ `domain_reputations`, `ip_reputations`
`domains` with `kind=third_party`	—	✓
External-proxy hosting IPs / certificates (`is_external: true`)	—	✓
`get_traffic_health_domain` includes	`uptime_incidents`, `tasks`, `configuration`	+ `domain_reputation`, `ip_reputation`, `assignments`, `mismatches`

Point-in-time timestamps in Traffic Health responses are formatted strings — YYYY-MM-DD HH:MM:SS in UTC (e.g. 2026-12-22 14:08:06). The one exception is the assignments → usage window (from/to), which follows the network timezone to match run_performance_report and the portal; it carries its own timezone field. Fields are omitted when unset.

list_traffic_health

Lists Traffic Health resources network-wide, or scoped to a single domain. Set type to choose the resource; omit domain for a network-wide list or pass it to scope to one domain. Parameters:

Parameter	Type	Required	Description
`type`	string	Yes	Resource to list (see table below).
`domain`	string	No	Scope to a single tracking/conversion domain URL (e.g. `track.acme.com`). Applies to `uptime_incidents`, `hosting`, `ssl_certificates`, `domain_reputations`, `ip_reputations`.
`kind`	string	No	For `type=domains` only: `tracking`, `conversion`, or `third_party`. `third_party` requires Premium.
`status`	string	No	For incidents and reputations: `active` or `resolved`.
`from`	string	No	Start of window for the time-bounded types (`uptime_incidents`, `domain_reputations`, `ip_reputations`). `YYYY-MM-DD`, interpreted in the network timezone, inclusive.
`to`	string	No	End of window for the time-bounded types (`uptime_incidents`, `domain_reputations`, `ip_reputations`). `YYYY-MM-DD`, interpreted in the network timezone, inclusive.
`expires_within_days`	number	No	For `type=domains` or `ssl_certificates` only (1–3650): keep only entries expiring within this many days from now — use to surface upcoming domain/certificate expirations. When set, `ssl_certificates` returns the filtered set without the pagination fields.
`page`	number	No	Page number (default 1). Honored only by `uptime_incidents` and `domain_reputations`.
`page_size`	number	No	Rows per page (1–200, default 100). Honored only by `uptime_incidents` and `domain_reputations`.

Resource types:

`type`	Tier	Returns
`summary`	Free	Network-wide health rollup (a single object, not a list) — see fields below
`domains`	Free	Your tracking & conversion domains with health and monitoring status. This is the operational-health view; for ID lookup, redirect config, or networks without Traffic Health, use `get_entity`/`list_entities` `type=tracking_domain`.
`tasks`	Free	Open customer-actionable remediation tasks (a domain needs action from you); completed tasks are excluded. Returns the full current set — takes no `from`/`to` window
`uptime_incidents`	Free	Uptime / SSL / DNS / expiry incidents per domain (active and resolved)
`hosting`	Free	The dedicated IP addresses your domains resolve to, each with the domains resolving to it
`ssl_certificates`	Free	SSL certificates covering your domains, with issuer and expiry
`domain_reputations`	Premium	Domains flagged on blocklists (EASYLIST, HetrixTools, Google Threat Intelligence)
`ip_reputations`	Premium	Hosting IPs flagged on blocklists (HetrixTools, Google Threat Intelligence) — limited to dedicated IPs serving at least one premium-monitored domain, matching the summary’s IP blocklist count

Response envelope — every call returns a uniform wrapper:

Field	Type	Description
`returned`	number	Number of items in this response.
`items`	array	The resource records (shapes below).
`total`	number	Paginated types only — total matching records.
`has_more`	boolean	Paginated types only — `true` when more records exist beyond this page. Narrow with `domain`/`status`/`from`/`to`.
`page`	number	Paginated types only — the page returned.
`note`	string	Present only when a Premium capability is unavailable for the network.

Only uptime_incidents and domain_reputations honor page/page_size (default page size 100) for true pagination. hosting and ssl_certificates include the total/has_more/page envelope but return a single bounded page — they do not accept page/page_size. domains, tasks, and ip_reputations return the full set and omit those fields (ip_reputations is filtered in memory to premium-monitored IPs). When has_more is true on a paginated type, page with page, or narrow the result with the domain, status, or from/to filters.

Item fields by type: summary (a single object — not wrapped in the list envelope)

Field	Type	Description
`active_domains`	number	Active monitored domains
`active_self_managed_domains`	number	Active self-managed domains
`active_domains_without_incident`	number	Active domains with no open incident
`active_domains_with_incident`	number	Active domains with an open incident
`active_incidents`	number	Total open incidents
`active_domains_with_blacklist_incident`	number	Active domains with an open blocklist incident (Premium)
`active_domain_blacklist_incidents`	number	Open domain blocklist incidents (Premium)
`active_ip_blacklist_incidents`	number	Open hosting-IP blocklist incidents (Premium)
`mean_time_to_resolution_seconds`	number	Network-wide mean incident time-to-resolution, in seconds
`has_premium`	boolean	Whether Traffic Health Premium is active for the network
`premium_monitored_domain_quota`	number	Premium-monitored-domain ceiling for the network (omitted when Premium is inactive)

domains

Field	Type	Description
`url`	string	Domain URL
`domain_type`	string	`tracking`, `conversion`, or `third_party`
`tracking_status` / `conversion_status`	string	Health status for the domain’s role
`monitoring_type`	string	`basic` or `premium`
`ownership`	string	Ownership / management model
`is_mps`	boolean	Managed proxy service domain
`is_shared_ip`	boolean	Resolves to a shared (non-dedicated) IP
`time_expires`	string	Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC)
`ip_addresses`	array	Hosting IPs (see `hosting`)
`certificates`	array	SSL certificates (see `ssl_certificates`)

tasks

Field	Type	Description
`url`	string	Affected domain
`identifier`	string	Task identifier
`type` / `category`	string	Task type and grouping (e.g. `renew_domain`)
`status`	string	Task status
`assignment`	string	Who the task is assigned to
`title` / `description`	string	Human-readable summary
`incident_identifier`	string	The incident that generated the task
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

uptime_incidents

Field	Type	Description
`url`	string	Affected domain
`identifier`	string	Incident identifier
`type`	string	Incident type (uptime / SSL / DNS / expiry)
`status`	string	`active` or `resolved`
`factors`	array	Contributing signals
`task_identifiers`	array	Linked remediation tasks
`time_created` / `time_resolved`	string	`YYYY-MM-DD HH:MM:SS` (UTC) (`time_resolved` omitted while active)

hosting

Field	Type	Description
`ip_address`	string	Dedicated IP
`ip_type`	string	e.g. `dedicated`
`ip_version`	string	`ipv4` or `ipv6`
`is_external`	boolean	External-proxy IP (Premium)
`is_mps`	boolean	Managed proxy service IP
`domains`	array	The domain URLs that resolve to this IP — use to gauge the blast radius if the IP is blocklisted or goes down

ssl_certificates

Field	Type	Description
`common_name`	string	Certificate common name
`issuer`	string	Issuing authority
`serial_number`	string	Certificate serial
`time_issued` / `time_expires`	string	`YYYY-MM-DD HH:MM:SS` (UTC)
`is_external`	boolean	External-proxy certificate (Premium)

domain_reputations (Premium)

Field	Type	Description
`url`	string	Flagged domain
`identifier`	string	Incident identifier
`status`	string	`active` or `resolved`
`provider`	string	Blocklist source (e.g. `easylist`, `google_threat_intelligence`)
`vendor`	string	Reporting vendor
`flagged_urls`	array	Specific URLs flagged
`delist_url`	string	Delisting request URL where available
`remediation`	object	Per-vendor remediation context, when the vendor catalog describes it (see below)
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

ip_reputations (Premium)

Field	Type	Description
`ip_address`	string	Flagged hosting IP
`identifier`	string	Incident identifier
`status`	string	`active` or `resolved`
`provider` / `vendor`	string	Blocklist source and reporting vendor
`delist_url`	string	Delisting request URL where available
`remediation`	object	Per-vendor remediation context, when available (see below)
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

The remediation object (on both domain_reputations and ip_reputations) turns a flag into an action — it’s the vendor-catalog detail behind the listing. The whole object is omitted when the catalog has no entry for the vendor; individual fields are omitted when blank.

Field	Type	Description
`name`	string	Vendor display name
`category`	string	Threat category (e.g. phishing, malware, spam)
`impact_level`	string	How serious the listing is
`impact_details`	string	What the listing affects (deliverability, reachability, …)
`listing_criteria`	string	Why the entity was listed / how to avoid it — the core remediation guidance
`website_url`	string	The vendor’s site, for status checks and delisting
`description`	string	What this vendor/blocklist is

get_traffic_health_domain

Returns the full Traffic Health picture for one domain in a single call — its current situation, plus on request its incidents, tasks, reputation, and configuration. Use list_traffic_health for network-wide rollups. Parameters:

Parameter	Type	Required	Description
`domain`	string	Yes	The tracking or conversion domain URL to inspect (e.g. `track.acme.com`).
`include`	string	No	Comma-separated detail to compose (see table).

Includes:

`include`	Tier	Adds
`uptime_incidents`	Free	This domain’s uptime / SSL / DNS / expiry incidents
`tasks`	Free	This domain’s open remediation tasks
`configuration`	Free	Hosting IP(s) and SSL certificate(s) for this domain (ownership and monitoring type are already in the situation summary)
`domain_reputation`	Premium	Blocklist flags on the domain
`ip_reputation`	Premium	Blocklist flags on its hosting IP(s)
`assignments`	Premium	Offer/affiliate assignment summary for this domain, plus a `usage` block with its trailing-90-day traffic and revenue
`mismatches`	Premium	Traffic observed on a domain other than the assigned one

Response — situation summary (always returned, with no include):

Field	Type	Description
`url`	string	The domain
`situation`	string	Overall health
`domain_type`	string	`tracking`, `conversion`, or `third_party`
`ownership`	string	Ownership / management model
`is_mps`	boolean	Managed proxy service domain
`is_ip_flagged`	boolean	A hosting IP is currently flagged
`time_expires`	string	Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC)
`ongoing_incidents` / `resolved_incidents`	number	Incident counts
`action_required_tasks` / `non_urgent_tasks` / `completed_tasks`	number	Task counts by urgency
`active_flags` / `removed_flags`	number	Reputation flag counts
`mean_time_to_resolution_seconds`	number	This domain’s mean incident time-to-resolution, in seconds (omitted when zero)
`time_first_uptime_checked` / `time_last_uptime_checked`	string	When uptime monitoring for this domain began / last ran, `YYYY-MM-DD HH:MM:SS` (UTC)

Response — composed includes: Each requested include is added to the situation summary under its own key:

Key	Shape
`uptime_incidents`	The `uptime_incidents` list envelope, scoped to this domain.
`tasks`	A `{ returned, items }` envelope of this domain’s tasks (same `tasks` item shape).
`configuration`	An object `{ "hosting": …, "ssl_certificates": … }` using the `hosting` and `ssl_certificates` list envelopes for this domain.
`domain_reputation` / `ip_reputation`	The matching reputation list envelope; on a non-Premium network the section carries the Premium `note`.
`assignments`	An object with `active`, `assignable`, `offers_assigned`, `partners_assigned`, `combinations_assigned`, plus a nested `usage` object (Premium; otherwise a Premium `note`).
`mismatches`	A `{ returned, items }` envelope; each item has `assigned_domain`, `offer_id`/`offer_name`, `affiliate_id`/`affiliate_name`, `assignment_type`, `time_detected` (Premium; otherwise a Premium `note`).

The assignments usage object reports the domain’s traffic and revenue over the trailing 90 days — the practical “blast radius” if the domain goes down. Unlike the point-in-time timestamps elsewhere in Traffic Health (which are UTC), this window follows the network timezone, matching run_performance_report and the portal:

Field	Type	Description
`timezone`	string	The network timezone the window is reported in (e.g. `America/Los_Angeles`)
`from` / `to`	string	The usage window, `YYYY-MM-DD HH:MM:SS` in the network timezone
`partners_using_domain`	number	Distinct partners that ran traffic on the domain
`offers_ran`	number	Distinct offers that ran on the domain
`gross_clicks` / `unique_clicks`	number	Click volume
`conversions`	number	Conversion count
`payout` / `revenue` / `sale_amount` / `profit`	number	Financials over the window
`margin`	number	Profit margin

get_traffic_health_domain only resolves domains that are monitored (present in the network’s monitored-domain list). A domain that appears in list_traffic_health(type=domains) but is not monitored returns INVALID_ARGUMENT: Domain with url … is not present in list of monitored domains.

Examples

Overall network health rollup

{ "tool": "list_traffic_health", "arguments": { "type": "summary" } }

All open tasks across the network

{ "tool": "list_traffic_health", "arguments": { "type": "tasks" } }

Active uptime incidents for one domain in the last 30 days

{ "tool": "list_traffic_health",
  "arguments": { "type": "uptime_incidents", "domain": "track.acme.com", "status": "active", "from": "2026-05-26" } }

Certificates expiring within the next 30 days

{ "tool": "list_traffic_health",
  "arguments": { "type": "ssl_certificates", "expires_within_days": 30 } }

Domains flagged on a blocklist (Premium)

{ "tool": "list_traffic_health", "arguments": { "type": "domain_reputations", "status": "active" } }

One domain’s full health picture with detail

{ "tool": "get_traffic_health_domain",
  "arguments": { "domain": "track.acme.com", "include": "uptime_incidents,tasks,configuration" } }

A domain’s assignments and revenue exposure (Premium) — assignments returns the assignment summary and a nested usage block (trailing-90-day traffic and revenue), so you can gauge what’s at risk while the domain is impaired:

{ "tool": "get_traffic_health_domain",
  "arguments": { "domain": "track.acme.com", "include": "assignments" } }

Learn more about Traffic Health

See the Everflow Helpdesk for what Traffic Health monitors, when to use it, and how to act on domain incidents and tasks.

​Free vs. Traffic Health Premium

​list_traffic_health

​get_traffic_health_domain

​Examples

Learn more about Traffic Health

Free vs. Traffic Health Premium

list_traffic_health

get_traffic_health_domain

Examples