> ## Documentation Index
> Fetch the complete documentation index at: https://developers.everflow.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Traffic Health
> MCP tools for domain health, reputation, remediation tasks, and the hosting/SSL configuration behind your tracking and conversion domains.
Traffic Health surfaces the operational health of the domains and IPs behind your tracking and conversion links — uptime, SSL, DNS and expiry incidents, blocklist reputation, the remediation tasks that need your attention, and the hosting/certificate configuration each domain resolves to.
Two read-only tools cover the whole surface:
| Tool | Use when |
| --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [`list_traffic_health`](#list_traffic_health) | Network-wide rollups — "show me all open tasks", "which domains are flagged", "list my hosting IPs", "what expires this month". Set `type` to choose the resource. |
| [`get_traffic_health_domain`](#get_traffic_health_domain) | A single domain's full picture in one call — its situation plus, on request, its incidents, tasks, reputation, and configuration. |
## Free vs. Traffic Health Premium
Traffic Health has two tiers. Both tools are always available to any network with Traffic Health enabled, but **a subset of resources and includes require Traffic Health Premium.** On a network without Premium, a Premium-only request does **not** error — it returns an empty result with a `note` explaining the capability is unavailable, e.g.:
```json theme={null}
{ "total": 0, "returned": 0, "has_more": false, "items": [],
"note": "domain_reputations is a Traffic Health Premium capability and is not enabled for this network." }
```
If Traffic Health is not enabled for the network at all, both tools return `INVALID_ARGUMENT: Traffic Health is not enabled for this network`.
| Capability | Free (Traffic Health) | Traffic Health Premium |
| --------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| `list_traffic_health` types | `summary`, `domains`, `tasks`, `uptime_incidents`, `hosting`, `ssl_certificates` | + `domain_reputations`, `ip_reputations` |
| `domains` with `kind=third_party` | — | ✓ |
| External-proxy hosting IPs / certificates (`is_external: true`) | — | ✓ |
| `get_traffic_health_domain` includes | `uptime_incidents`, `tasks`, `configuration` | + `domain_reputation`, `ip_reputation`, `assignments`, `mismatches` |
Point-in-time timestamps in Traffic Health responses are formatted strings — `YYYY-MM-DD HH:MM:SS` in **UTC** (e.g. `2026-12-22 14:08:06`). The one exception is the `assignments` → `usage` window (`from`/`to`), which follows the **network timezone** to match `run_performance_report` and the portal; it carries its own `timezone` field. Fields are omitted when unset.
***
## list\_traffic\_health
Lists Traffic Health resources network-wide, or scoped to a single domain. Set `type` to choose the resource; omit `domain` for a network-wide list or pass it to scope to one domain.
**Parameters:**
| Parameter | Type | Required | Description |
| --------------------- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `type` | string | Yes | Resource to list (see table below). |
| `domain` | string | No | Scope to a single tracking/conversion domain URL (e.g. `track.acme.com`). Applies to `uptime_incidents`, `hosting`, `ssl_certificates`, `domain_reputations`, `ip_reputations`. |
| `kind` | string | No | For `type=domains` only: `tracking`, `conversion`, or `third_party`. `third_party` requires Premium. |
| `status` | string | No | For incidents and reputations: `active` or `resolved`. |
| `from` | string | No | Start of window for the time-bounded types (`uptime_incidents`, `domain_reputations`, `ip_reputations`). `YYYY-MM-DD`, interpreted in the network timezone, inclusive. |
| `to` | string | No | End of window for the time-bounded types (`uptime_incidents`, `domain_reputations`, `ip_reputations`). `YYYY-MM-DD`, interpreted in the network timezone, inclusive. |
| `expires_within_days` | number | No | For `type=domains` or `ssl_certificates` only (1–3650): keep only entries expiring within this many days from now — use to surface upcoming domain/certificate expirations. When set, `ssl_certificates` returns the filtered set without the pagination fields. |
**Resource types:**
| `type` | Tier | Returns |
| -------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `summary` | Free | Network-wide health rollup (a single object, not a list) — see fields below |
| `domains` | Free | Your tracking & conversion domains with health and monitoring status. This is the operational-health view; for ID lookup, redirect config, or networks without Traffic Health, use `get_entity`/`list_entities` `type=tracking_domain`. |
| `tasks` | Free | Open customer-actionable remediation tasks (a domain needs action from you); completed tasks are excluded. Returns the full current set — takes no `from`/`to` window |
| `uptime_incidents` | Free | Uptime / SSL / DNS / expiry incidents per domain (active and resolved) |
| `hosting` | Free | The dedicated IP addresses your domains resolve to, each with the domains resolving to it |
| `ssl_certificates` | Free | SSL certificates covering your domains, with issuer and expiry |
| `domain_reputations` | **Premium** | Domains flagged on blocklists (EASYLIST, HetrixTools, Google Threat Intelligence) |
| `ip_reputations` | **Premium** | Hosting IPs flagged on blocklists (HetrixTools, Google Threat Intelligence) — limited to dedicated IPs serving at least one premium-monitored domain, matching the summary's IP blocklist count |
**Response envelope** — every call returns a uniform wrapper:
| Field | Type | Description |
| ---------- | ------- | -------------------------------------------------------------------------------------------------------------------- |
| `returned` | number | Number of items in this response. |
| `items` | array | The resource records (shapes below). |
| `total` | number | *Paginated types only* — total matching records. |
| `has_more` | boolean | *Paginated types only* — `true` when more records exist beyond this page. Narrow with `domain`/`status`/`from`/`to`. |
| `page` | number | *Paginated types only* — the page returned. |
| `note` | string | Present only when a Premium capability is unavailable for the network. |
`uptime_incidents`, `domain_reputations`, `hosting`, and `ssl_certificates` are **paginated** (default page size 100) and include `total`/`has_more`/`page`. `domains`, `tasks`, and `ip_reputations` return the full set and omit those fields (`ip_reputations` is filtered in memory to premium-monitored IPs, so it does not accept `page`/`page_size`). When `has_more` is `true`, narrow the result with the `domain`, `status`, or `from`/`to` filters rather than expecting every record in one call.
**Item fields by type:**
`summary` *(a single object — not wrapped in the list envelope)*
| Field | Type | Description |
| ---------------------------------------- | ------- | ----------------------------------------------------------------------------------- |
| `active_domains` | number | Active monitored domains |
| `active_self_managed_domains` | number | Active self-managed domains |
| `active_domains_without_incident` | number | Active domains with no open incident |
| `active_domains_with_incident` | number | Active domains with an open incident |
| `active_incidents` | number | Total open incidents |
| `active_domains_with_blacklist_incident` | number | Active domains with an open blocklist incident (Premium) |
| `active_domain_blacklist_incidents` | number | Open domain blocklist incidents (Premium) |
| `active_ip_blacklist_incidents` | number | Open hosting-IP blocklist incidents (Premium) |
| `mean_time_to_resolution_seconds` | number | Network-wide mean incident time-to-resolution, in seconds |
| `has_premium` | boolean | Whether Traffic Health Premium is active for the network |
| `premium_monitored_domain_quota` | number | Premium-monitored-domain ceiling for the network (omitted when Premium is inactive) |
`domains`
| Field | Type | Description |
| --------------------------------------- | ------- | ------------------------------------------ |
| `url` | string | Domain URL |
| `domain_type` | string | `tracking`, `conversion`, or `third_party` |
| `tracking_status` / `conversion_status` | string | Health status for the domain's role |
| `monitoring_type` | string | `basic` or `premium` |
| `ownership` | string | Ownership / management model |
| `is_mps` | boolean | Managed proxy service domain |
| `is_shared_ip` | boolean | Resolves to a shared (non-dedicated) IP |
| `time_expires` | string | Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC) |
| `ip_addresses` | array | Hosting IPs (see `hosting`) |
| `certificates` | array | SSL certificates (see `ssl_certificates`) |
`tasks`
| Field | Type | Description |
| ----------------------- | ------ | -------------------------------------------- |
| `url` | string | Affected domain |
| `identifier` | string | Task identifier |
| `type` / `category` | string | Task type and grouping (e.g. `renew_domain`) |
| `status` | string | Task status |
| `assignment` | string | Who the task is assigned to |
| `title` / `description` | string | Human-readable summary |
| `incident_identifier` | string | The incident that generated the task |
| `time_created` | string | `YYYY-MM-DD HH:MM:SS` (UTC) |
`uptime_incidents`
| Field | Type | Description |
| -------------------------------- | ------ | ------------------------------------------------------------------ |
| `url` | string | Affected domain |
| `identifier` | string | Incident identifier |
| `type` | string | Incident type (uptime / SSL / DNS / expiry) |
| `status` | string | `active` or `resolved` |
| `factors` | array | Contributing signals |
| `task_identifiers` | array | Linked remediation tasks |
| `time_created` / `time_resolved` | string | `YYYY-MM-DD HH:MM:SS` (UTC) (`time_resolved` omitted while active) |
`hosting`
| Field | Type | Description |
| ------------- | ------- | ------------------------------------------------------------------------------------------------------------- |
| `ip_address` | string | Dedicated IP |
| `ip_type` | string | e.g. `dedicated` |
| `ip_version` | string | `ipv4` or `ipv6` |
| `is_external` | boolean | External-proxy IP (Premium) |
| `is_mps` | boolean | Managed proxy service IP |
| `domains` | array | The domain URLs that resolve to this IP — use to gauge the blast radius if the IP is blocklisted or goes down |
`ssl_certificates`
| Field | Type | Description |
| ------------------------------ | ------- | ------------------------------------ |
| `common_name` | string | Certificate common name |
| `issuer` | string | Issuing authority |
| `serial_number` | string | Certificate serial |
| `time_issued` / `time_expires` | string | `YYYY-MM-DD HH:MM:SS` (UTC) |
| `is_external` | boolean | External-proxy certificate (Premium) |
`domain_reputations` *(Premium)*
| Field | Type | Description |
| -------------- | ------ | -------------------------------------------------------------------------------- |
| `url` | string | Flagged domain |
| `identifier` | string | Incident identifier |
| `status` | string | `active` or `resolved` |
| `provider` | string | Blocklist source (e.g. `easylist`, `google_threat_intelligence`) |
| `vendor` | string | Reporting vendor |
| `flagged_urls` | array | Specific URLs flagged |
| `delist_url` | string | Delisting request URL where available |
| `remediation` | object | Per-vendor remediation context, when the vendor catalog describes it (see below) |
| `time_created` | string | `YYYY-MM-DD HH:MM:SS` (UTC) |
`ip_reputations` *(Premium)*
| Field | Type | Description |
| --------------------- | ------ | ---------------------------------------------------------- |
| `ip_address` | string | Flagged hosting IP |
| `identifier` | string | Incident identifier |
| `status` | string | `active` or `resolved` |
| `provider` / `vendor` | string | Blocklist source and reporting vendor |
| `delist_url` | string | Delisting request URL where available |
| `remediation` | object | Per-vendor remediation context, when available (see below) |
| `time_created` | string | `YYYY-MM-DD HH:MM:SS` (UTC) |
The `remediation` object (on both `domain_reputations` and `ip_reputations`) turns a flag into an action — it's the vendor-catalog detail behind the listing. The whole object is omitted when the catalog has no entry for the vendor; individual fields are omitted when blank.
| Field | Type | Description |
| ------------------ | ------ | --------------------------------------------------------------------------- |
| `name` | string | Vendor display name |
| `category` | string | Threat category (e.g. phishing, malware, spam) |
| `impact_level` | string | How serious the listing is |
| `impact_details` | string | What the listing affects (deliverability, reachability, …) |
| `listing_criteria` | string | Why the entity was listed / how to avoid it — the core remediation guidance |
| `website_url` | string | The vendor's site, for status checks and delisting |
| `description` | string | What this vendor/blocklist is |
***
## get\_traffic\_health\_domain
Returns the full Traffic Health picture for **one** domain in a single call — its current situation, plus on request its incidents, tasks, reputation, and configuration. Use `list_traffic_health` for network-wide rollups.
**Parameters:**
| Parameter | Type | Required | Description |
| --------- | ------ | -------- | ------------------------------------------------------------------------- |
| `domain` | string | Yes | The tracking or conversion domain URL to inspect (e.g. `track.acme.com`). |
| `include` | string | No | Comma-separated detail to compose (see table). |
**Includes:**
| `include` | Tier | Adds |
| ------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------- |
| `uptime_incidents` | Free | This domain's uptime / SSL / DNS / expiry incidents |
| `tasks` | Free | This domain's open remediation tasks |
| `configuration` | Free | Hosting IP(s) and SSL certificate(s) for this domain (ownership and monitoring type are already in the situation summary) |
| `domain_reputation` | **Premium** | Blocklist flags on the domain |
| `ip_reputation` | **Premium** | Blocklist flags on its hosting IP(s) |
| `assignments` | **Premium** | Offer/affiliate assignment summary for this domain, plus a `usage` block with its trailing-90-day traffic and revenue |
| `mismatches` | **Premium** | Traffic observed on a domain other than the assigned one |
**Response — situation summary** (always returned, with no `include`):
| Field | Type | Description |
| ---------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------ |
| `url` | string | The domain |
| `situation` | string | Overall health |
| `domain_type` | string | `tracking`, `conversion`, or `third_party` |
| `ownership` | string | Ownership / management model |
| `is_mps` | boolean | Managed proxy service domain |
| `is_ip_flagged` | boolean | A hosting IP is currently flagged |
| `time_expires` | string | Domain expiry, `YYYY-MM-DD HH:MM:SS` (UTC) |
| `ongoing_incidents` / `resolved_incidents` | number | Incident counts |
| `action_required_tasks` / `non_urgent_tasks` / `completed_tasks` | number | Task counts by urgency |
| `active_flags` / `removed_flags` | number | Reputation flag counts |
| `mean_time_to_resolution_seconds` | number | This domain's mean incident time-to-resolution, in seconds (omitted when zero) |
| `time_first_uptime_checked` / `time_last_uptime_checked` | string | When uptime monitoring for this domain began / last ran, `YYYY-MM-DD HH:MM:SS` (UTC) |
**Response — composed includes:** Each requested `include` is added to the situation summary under its own key:
| Key | Shape |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `uptime_incidents` | The `uptime_incidents` list envelope, scoped to this domain. |
| `tasks` | A `{ returned, items }` envelope of this domain's tasks (same `tasks` item shape). |
| `configuration` | An object `{ "hosting": …, "ssl_certificates": … }` using the `hosting` and `ssl_certificates` list envelopes for this domain. |
| `domain_reputation` / `ip_reputation` | The matching reputation list envelope; on a non-Premium network the section carries the Premium `note`. |
| `assignments` | An object with `active`, `assignable`, `offers_assigned`, `partners_assigned`, `combinations_assigned`, plus a nested `usage` object (Premium; otherwise a Premium `note`). |
| `mismatches` | A `{ returned, items }` envelope; each item has `assigned_domain`, `offer_id`/`offer_name`, `affiliate_id`/`affiliate_name`, `assignment_type`, `time_detected` (Premium; otherwise a Premium `note`). |
The `assignments` `usage` object reports the domain's traffic and revenue over the trailing 90 days — the practical "blast radius" if the domain goes down. Unlike the point-in-time timestamps elsewhere in Traffic Health (which are UTC), this window follows the **network timezone**, matching `run_performance_report` and the portal:
| Field | Type | Description |
| ----------------------------------------------- | ------ | --------------------------------------------------------------------------- |
| `timezone` | string | The network timezone the window is reported in (e.g. `America/Los_Angeles`) |
| `from` / `to` | string | The usage window, `YYYY-MM-DD HH:MM:SS` in the network timezone |
| `partners_using_domain` | number | Distinct partners that ran traffic on the domain |
| `offers_ran` | number | Distinct offers that ran on the domain |
| `gross_clicks` / `unique_clicks` | number | Click volume |
| `conversions` | number | Conversion count |
| `payout` / `revenue` / `sale_amount` / `profit` | number | Financials over the window |
| `margin` | number | Profit margin |
`get_traffic_health_domain` only resolves domains that are **monitored** (present in the network's monitored-domain list). A domain that appears in `list_traffic_health(type=domains)` but is not monitored returns `INVALID_ARGUMENT: Domain with url … is not present in list of monitored domains`.
***
## Examples
**Overall network health rollup**
```json theme={null}
{ "tool": "list_traffic_health", "arguments": { "type": "summary" } }
```
**All open tasks across the network**
```json theme={null}
{ "tool": "list_traffic_health", "arguments": { "type": "tasks" } }
```
**Active uptime incidents for one domain in the last 30 days**
```json theme={null}
{ "tool": "list_traffic_health",
"arguments": { "type": "uptime_incidents", "domain": "track.acme.com", "status": "active", "from": "2026-05-26" } }
```
**Certificates expiring within the next 30 days**
```json theme={null}
{ "tool": "list_traffic_health",
"arguments": { "type": "ssl_certificates", "expires_within_days": 30 } }
```
**Domains flagged on a blocklist (Premium)**
```json theme={null}
{ "tool": "list_traffic_health", "arguments": { "type": "domain_reputations", "status": "active" } }
```
**One domain's full health picture with detail**
```json theme={null}
{ "tool": "get_traffic_health_domain",
"arguments": { "domain": "track.acme.com", "include": "uptime_incidents,tasks,configuration" } }
```
**A domain's assignments and revenue exposure (Premium)** — `assignments` returns the assignment summary and a nested `usage` block (trailing-90-day traffic and revenue), so you can gauge what's at risk while the domain is impaired:
```json theme={null}
{ "tool": "get_traffic_health_domain",
"arguments": { "domain": "track.acme.com", "include": "assignments" } }
```
See the Everflow Helpdesk for what Traffic Health monitors, when to use it, and how to act on domain incidents and tasks.