Traffic Health - Everflow API

Traffic Health surfaces the operational health of the domains and IPs behind your tracking and conversion links — uptime, SSL, DNS and expiry incidents, blocklist reputation, the remediation tasks that need your attention, the hosting and certificate configuration each domain resolves to, and the ISPs whose traffic to a domain is declining.

Tool	What it does	Requires
list_traffic_health	Network-wide rollups — flagged domains, open tasks, incidents, hosting IPs, certificates, declining ISPs	Traffic Health
get_traffic_health_domain	One domain’s full picture in a single call	Traffic Health

Traffic Health has two tiers. Both tools work on any network with Traffic Health enabled, but some resources and includes need Traffic Health Premium — marked below, and listed in full under Free vs. Premium. A Premium request on a non-Premium network does not error: it returns an empty result with an explanatory note. If Traffic Health is not enabled at all, both tools return INVALID_ARGUMENT: Traffic Health is not enabled for this network.

list_traffic_health

Lists Traffic Health resources network-wide, or scoped to a single domain. Set type to choose the resource; omit domain for a network-wide list, or pass it to scope to one domain. Requires: Traffic Health (Read Only) Ask for it: “Which of my tracking domains have open remediation tasks?” · “Is any ISP’s traffic to my domains dropping?” Parameters

Parameter	Type	Required	Default	Description
`type`	string	Yes	—	Resource to list (see the table below)
`domain`	string	No	—	Scope to one tracking/conversion domain URL (e.g. `track.acme.com`). Applies to `uptime_incidents`, `hosting`, `ssl_certificates`, `domain_reputations`, `ip_reputations`, `isp_trends`
`kind`	string	No	—	For `type=domains` only: `tracking`, `conversion`, or `third_party`. `third_party` requires Premium
`status`	string	No	—	For incidents and reputations: `active` or `resolved`
`from`	string	No	—	Start of window for the time-bounded types (`uptime_incidents`, `domain_reputations`, `ip_reputations`). `YYYY-MM-DD`, network timezone, inclusive
`to`	string	No	—	End of window for the same types. `YYYY-MM-DD`, network timezone, inclusive
`expires_within_days`	number	No	—	For `type=domains` or `ssl_certificates` only (1–3650): keep only entries expiring within this many days. When set, `ssl_certificates` returns the filtered set without the pagination fields
`page`	number	No	1	Page number. Honored only by `uptime_incidents` and `domain_reputations`
`page_size`	number	No	100	Rows per page (1–100). Honored only by `uptime_incidents` and `domain_reputations`

Example

list_traffic_health(type="ssl_certificates", expires_within_days=30)
→ every certificate covering your domains that expires in the next 30 days

Resource types

`type`	Tier	Returns
`summary`	Free	Network-wide health rollup (a single object, not a list)
`domains`	Free	Your tracking & conversion domains with health and monitoring status
`tasks`	Free	Open customer-actionable remediation tasks; completed tasks excluded. Returns the full current set — takes no `from`/`to` window
`uptime_incidents`	Free	Uptime / SSL / DNS / expiry incidents per domain (active and resolved)
`hosting`	Free	The dedicated IP addresses your domains resolve to, each with the domains resolving to it
`ssl_certificates`	Free	SSL certificates covering your domains, with issuer and expiry
`domain_reputations`	Premium	Domains flagged on blocklists (EASYLIST, HetrixTools, Google Threat Intelligence)
`ip_reputations`	Premium	Hosting IPs flagged on blocklists (HetrixTools, Google Threat Intelligence) — limited to dedicated IPs serving at least one premium-monitored domain, matching the summary’s IP blocklist count
`isp_trends`	Premium	Tracking domain × ISP pairs whose click volume is declining against every comparison day — yesterday measured against the single days 7, 14 and 30 days back. Use it to spot an ISP degrading or blocking a tracking domain

Returns Every call returns a uniform wrapper:

Field	Type	Description
`returned`	number	Number of items in this response
`items`	array	The resource records — shapes in the accordions below
`total`	number	Paginated types only — total matching records
`has_more`	boolean	Paginated types only — more records exist beyond this page
`page`	number	Paginated types only — the page returned
`note`	string	Present only when a Premium capability is unavailable for the network

Gotchas

Only uptime_incidents and domain_reputations truly paginate. hosting and ssl_certificates carry the total/has_more/page envelope but return a single bounded page. domains, tasks, ip_reputations and isp_trends return the full set and omit those fields. When has_more is true on a paginated type, page with page or narrow with domain, status, or from/to.
Parameters that don’t apply to the chosen type return an error, not silence. Passing page/page_size to a non-paginated type, domain to a type that isn’t domain-scoped, or expires_within_days to anything but domains/ssl_certificates returns INVALID_ARGUMENT naming the types that do accept it.
An empty isp_trends result means nothing is declining — not that there is no traffic. Only declining pairs are returned, and only when yesterday is down against all three comparison days.
Timestamps are UTC — formatted strings, YYYY-MM-DD HH:MM:SS (e.g. 2026-12-22 14:08:06). The one exception is the assignments → usage window on the other tool, which follows the network timezone. Fields are omitted when unset.
For a domain’s identity and config (ID lookup, primary/assignable flags, redirect settings) rather than its health, use get_entity/list_entities with type=tracking_domain — that works on networks without Traffic Health too.

Item fields by type

summary

A single object — not wrapped in the list envelope.

Field	Type	Description
`active_domains`	number	Active monitored domains
`active_self_managed_domains`	number	Active self-managed domains
`active_domains_without_incident`	number	Active domains with no open incident
`active_domains_with_incident`	number	Active domains with an open incident
`active_incidents`	number	Total open incidents
`active_domains_with_blacklist_incident`	number	Active domains with an open blocklist incident (Premium)
`active_domain_blacklist_incidents`	number	Open domain blocklist incidents (Premium)
`active_ip_blacklist_incidents`	number	Open hosting-IP blocklist incidents (Premium)
`mean_time_to_resolution_seconds`	number	Network-wide mean incident time-to-resolution, in seconds
`has_premium`	boolean	Whether Traffic Health Premium is active for the network
`premium_monitored_domain_quota`	number	Premium-monitored-domain ceiling (omitted when Premium is inactive)

domains

Field	Type	Description
`url`	string	Domain URL
`domain_type`	string	`tracking`, `conversion`, or `third_party`
`tracking_status` / `conversion_status`	string	Health status for the domain’s role
`monitoring_type`	string	`basic` or `premium`
`ownership`	string	Ownership / management model
`is_mps`	boolean	Managed proxy service domain
`is_shared_ip`	boolean	Resolves to a shared (non-dedicated) IP
`time_expires`	string	Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC)
`ip_addresses`	array	Hosting IPs (see `hosting`)
`certificates`	array	SSL certificates (see `ssl_certificates`)

tasks

Field	Type	Description
`url`	string	Affected domain
`identifier`	string	Task identifier
`type` / `category`	string	Task type and grouping (e.g. `renew_domain`)
`status`	string	Task status
`assignment`	string	Who the task is assigned to
`title` / `description`	string	Human-readable summary
`incident_identifier`	string	The incident that generated the task
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

uptime_incidents

Field	Type	Description
`url`	string	Affected domain
`identifier`	string	Incident identifier
`type`	string	Incident type (uptime / SSL / DNS / expiry)
`status`	string	`active` or `resolved`
`factors`	array	Contributing signals
`task_identifiers`	array	Linked remediation tasks
`time_created` / `time_resolved`	string	`YYYY-MM-DD HH:MM:SS` (UTC); `time_resolved` omitted while active

hosting and ssl_certificates

hosting

Field	Type	Description
`ip_address`	string	Dedicated IP
`ip_type`	string	e.g. `dedicated`
`ip_version`	string	`ipv4` or `ipv6`
`is_external`	boolean	External-proxy IP (Premium)
`is_mps`	boolean	Managed proxy service IP
`domains`	array	The domain URLs that resolve to this IP — use it to gauge the blast radius if the IP is blocklisted or goes down

ssl_certificates

Field	Type	Description
`common_name`	string	Certificate common name
`issuer`	string	Issuing authority
`serial_number`	string	Certificate serial
`time_issued` / `time_expires`	string	`YYYY-MM-DD HH:MM:SS` (UTC)
`is_external`	boolean	External-proxy certificate (Premium)

domain_reputations and ip_reputations (Premium)

domain_reputations

Field	Type	Description
`url`	string	Flagged domain
`identifier`	string	Incident identifier
`status`	string	`active` or `resolved`
`provider`	string	Blocklist source (e.g. `easylist`, `google_threat_intelligence`)
`vendor`	string	Reporting vendor
`flagged_urls`	array	Specific URLs flagged
`delist_url`	string	Delisting request URL where available
`remediation`	object	Per-vendor remediation context, when the vendor catalog describes it
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

ip_reputations

Field	Type	Description
`ip_address`	string	Flagged hosting IP
`identifier`	string	Incident identifier
`status`	string	`active` or `resolved`
`provider` / `vendor`	string	Blocklist source and reporting vendor
`delist_url`	string	Delisting request URL where available
`remediation`	object	Per-vendor remediation context, when available
`time_created`	string	`YYYY-MM-DD HH:MM:SS` (UTC)

The remediation object turns a flag into an action — it’s the vendor-catalog detail behind the listing. The whole object is omitted when the catalog has no entry for the vendor; individual fields are omitted when blank.

Field	Type	Description
`name`	string	Vendor display name
`category`	string	Threat category (e.g. phishing, malware, spam)
`impact_level`	string	How serious the listing is
`impact_details`	string	What the listing affects (deliverability, reachability, …)
`listing_criteria`	string	Why the entity was listed and how to avoid it — the core remediation guidance
`website_url`	string	The vendor’s site, for status checks and delisting
`description`	string	What this vendor/blocklist is

isp_trends (Premium)

Only declining pairs are returned — a pair appears when yesterday is down against all three comparison days.

Field	Type	Description
`domain`	string	Tracking domain URL. Omitted if the domain has been deleted since the report ran
`isp`	string	ISP name
`clicks`	object	Click volume — snapshot object, see below
`conversions`	object	Conversion count — same shape
`revenue`	object	Revenue — same shape, rounded to 2 decimal places

Each metric object holds the four day snapshots plus the change from each comparison day:

Field	Type	Description
`yesterday`	number	The most recent full day
`seven_days_ago` / `fourteen_days_ago` / `thirty_days_ago`	number	The single day that many days back — not a rolling average
`delta_vs_seven_days_ago` / `delta_vs_fourteen_days_ago` / `delta_vs_thirty_days_ago`	number	Absolute change from that day (negative = down)
`trend_vs_seven_days_ago_pct` / `trend_vs_fourteen_days_ago_pct` / `trend_vs_thirty_days_ago_pct`	number	Percentage movement, where `-75.0` means down 75%. A comparison day with no traffic yields `0` rather than an infinite trend

get_traffic_health_domain

Returns the full Traffic Health picture for one domain in a single call — its current situation, plus on request its incidents, tasks, reputation, and configuration. Requires: Traffic Health (Read Only) Ask for it: “What’s going on with track.acme.com, and what’s at risk if it goes down?” Parameters

Parameter	Type	Required	Default	Description
`domain`	string	Yes	—	The tracking or conversion domain URL to inspect (e.g. `track.acme.com`)
`include`	string	No	—	Comma-separated detail to compose (see the table below)

Example

get_traffic_health_domain(domain="track.acme.com",
                          include="uptime_incidents,tasks,configuration")
→ the domain's situation summary plus its incidents, open tasks, hosting IPs and certificates

Includes

`include`	Tier	Adds
`uptime_incidents`	Free	This domain’s uptime / SSL / DNS / expiry incidents
`tasks`	Free	This domain’s open remediation tasks
`configuration`	Free	Hosting IP(s) and SSL certificate(s) — ownership and monitoring type are already in the situation summary
`domain_reputation`	Premium	Blocklist flags on the domain
`ip_reputation`	Premium	Blocklist flags on its hosting IP(s)
`assignments`	Premium	Offer/affiliate assignment summary, plus a `usage` block with trailing-90-day traffic and revenue
`mismatches`	Premium	Traffic observed on a domain other than the assigned one

Returns The situation summary is always returned, with or without include:

Field	Type	Description
`url`	string	The domain
`situation`	string	Overall health
`domain_type`	string	`tracking`, `conversion`, or `third_party`
`ownership`	string	Ownership / management model
`is_mps`	boolean	Managed proxy service domain
`is_ip_flagged`	boolean	A hosting IP is currently flagged
`time_expires`	string	Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC)
`ongoing_incidents` / `resolved_incidents`	number	Incident counts
`action_required_tasks` / `non_urgent_tasks` / `completed_tasks`	number	Task counts by urgency
`active_flags` / `removed_flags`	number	Reputation flag counts
`mean_time_to_resolution_seconds`	number	This domain’s mean incident time-to-resolution (omitted when zero)
`time_first_uptime_checked` / `time_last_uptime_checked`	string	When uptime monitoring began / last ran, `YYYY-MM-DD HH:MM:SS` (UTC)

Each requested include is added under its own key:

Key	Shape
`uptime_incidents`	The `uptime_incidents` list envelope, scoped to this domain
`tasks`	A `{ returned, items }` envelope of this domain’s tasks
`configuration`	`{ "hosting": …, "ssl_certificates": … }`, using those list envelopes for this domain
`domain_reputation` / `ip_reputation`	The matching reputation list envelope; on a non-Premium network the section carries the Premium `note`
`assignments`	`active`, `assignable`, `offers_assigned`, `partners_assigned`, `combinations_assigned`, plus a nested `usage` object (Premium)
`mismatches`	A `{ returned, items }` envelope; each item has `assigned_domain`, `offer_id`/`offer_name`, `affiliate_id`/`affiliate_name`, `assignment_type`, `time_detected` (Premium)

The assignments → usage object reports the domain’s traffic and revenue over the trailing 90 days — the practical blast radius if the domain goes down:

Field	Type	Description
`timezone`	string	The network timezone the window is reported in (e.g. `America/Los_Angeles`)
`from` / `to`	string	The usage window, `YYYY-MM-DD HH:MM:SS` in the network timezone
`partners_using_domain`	number	Distinct partners that ran traffic on the domain
`offers_ran`	number	Distinct offers that ran on the domain
`gross_clicks` / `unique_clicks`	number	Click volume
`conversions`	number	Conversion count
`payout` / `revenue` / `sale_amount` / `profit`	number	Financials over the window
`margin`	number	Profit margin

Gotchas

Only monitored domains resolve here. A domain that appears in list_traffic_health(type=domains) but isn’t monitored returns INVALID_ARGUMENT: Domain with url … is not present in list of monitored domains.
The usage window follows the network timezone, unlike the UTC timestamps everywhere else in Traffic Health. It carries its own timezone field so the two can’t be confused.

Free vs. Premium

Capability	Free (Traffic Health)	Traffic Health Premium
`list_traffic_health` types	`summary`, `domains`, `tasks`, `uptime_incidents`, `hosting`, `ssl_certificates`	+ `domain_reputations`, `ip_reputations`, `isp_trends`
`domains` with `kind=third_party`	—	✓
External-proxy hosting IPs / certificates (`is_external: true`)	—	✓
`get_traffic_health_domain` includes	`uptime_incidents`, `tasks`, `configuration`	+ `domain_reputation`, `ip_reputation`, `assignments`, `mismatches`

A Premium-only request on a network without Premium returns an empty result and a note, rather than an error:

{ "total": 0, "returned": 0, "has_more": false, "items": [],
  "note": "domain_reputations is a Traffic Health Premium capability and is not enabled for this network." }

Learn more about Traffic Health

See the Everflow Helpdesk for what Traffic Health monitors, when to use it, and how to act on domain incidents and tasks.

​list_traffic_health

​get_traffic_health_domain

​Free vs. Premium

Learn more about Traffic Health

list_traffic_health

get_traffic_health_domain

Free vs. Premium