Skip to content

On ISP, Datacenter and Gaming, every log record is a connection, not a single request: the record is written when the connection closes. With plain HTTP, a single keep-alive connection can carry several requests; the request field shows only the first one. A connection that is still open does not appear in the list until it closes.

Every record comes back with the same fixed set of keys, whatever the service type; a key without a value is null, never missing. Keys specific to the ISP family are alwaysnull in Mobile/Residential records, and statusCode is always null in the ISP family. The list is sorted newest first.

Three pitfalls

Fields

✓ is filled in on this type, null is always empty on this type. A ✓ field can also be null if no value was recorded for that connection.

FieldISP familyMobile / ResidentialMeaning
id✓✓The record's ID. In the ISP family it is the same as requestId (ULID); for records before September 17, 2026 it is a stable, derived ID.
timestamp✓✓ISO-8601, UTC. In the ISP family, the moment the connection CLOSED, to the second. The list is sorted newest first.
level✓✓connect, disconnect, error, quota or auth. In the ISP family it is derived from result (see the result codes table).
message✓✓A human-readable summary, e.g. HTTP CONNECT → example.com:443. In the ISP family, for failed records with no connection info, it is a readable description plus the result code (e.g. This command/protocol is not supported (#103)). The format can change; don't parse it, read the related fields.
method✓✓Command or HTTP method: CONNECT, GET, POST … In the ISP family it is the same as command (UDP ASSOCIATE included). null if the connection was rejected before it reached that stage.
ip✓✓The target, as host:port (the IP if there is no hostname). null for a connection rejected before the target was known.
sourceIp✓✓Your client's IP; the machine that connects to the proxy.
bytesIn✓✓DOWNLOADED bytes (from the target to you).
bytesOut✓✓UPLOADED bytes (from you to the target).
durationMs✓✓How long the connection stayed open, in ms. It is NOT latency.
statusCodenull✓HTTP status code. Mobile/Residential only.
headersnull✓The request's HTTP headers (as JSON text). Mobile/Residential only.
requestId✓nullThe connection's unique ID (a 26-character ULID). Send this when you contact support. null for records before September 17, 2026.
result✓nullResult code (see the table below). null for records before September 17, 2026.
resultCategory✓nullsuccess, client, policy, upstream or unknown. If result is null, it is derived from ok: success or unknown.
ok✓nullWhether the connection succeeded (true / false).
errorCode✓nullresult as 5-digit text, e.g. 00104 (00000 on success). null if result is null.
service✓nullThe protocol actually used: http or socks (SOCKS5). With the auto protocol the same port accepts both. null if the connection was rejected before it reached that stage.
proxyType✓nullOld name; same value as service.
command✓nullCONNECT, GET, POST … or UDP ASSOCIATE (UDP over SOCKS5; supported with the auto protocol). null if the connection was rejected before it reached that stage.
request✓nullThe FIRST request line on the connection. On a keep-alive connection only the first one is recorded. null if the connection was rejected before the request was read.
targetHost✓nullTarget hostname (the IP if you connected to an IP directly). null if the connection was rejected before the target was known.
targetIp✓nullThe target's resolved IP. null if no connection was made to the target.
targetPort✓nullTarget port. null if the connection was rejected before the target was known.
targetInfo✓nullOld format: targetIp:targetPort.
clientPort✓nullYour client's source port.
gateIp✓nullThe proxy (entry) address you connected to; usually the host in the proxy list. It is NOT your exit IP.
gatePort✓nullThe proxy port you connected to.
egressIp✓nullThe REAL IP your traffic uses to reach the internet; the address the target site sees. It is not recorded for every connection; null when missing (always null for records before September 17, 2026).
extIp✓nullOld name; same value as egressIp.
latencyMs✓nullLatency of connecting to the target, in ms. null if not measured; it is not 0.
totalBytes✓nullbytesIn + bytesOut.
slot✓nullThe order's port slot number. null for records before September 17, 2026.

Result codes

ISP, Datacenter and Gaming only. The descriptions are texts you can show to your customers. New codes can be added; treat an unknown code as an error.

resulterrorCodeHTTPCategorylevelMeaning
000000200successconnectConnection successful
10000100407clientauthWrong username or password
10100101403clientauthYour IP address is not authorized for this order
10200102400clienterrorMalformed request
10300103—clienterrorThis command/protocol is not supported
10400104403policyerrorYou are not allowed to access the target address
10500105403policyquotaQuota reached
10600106429policyquotaConnection limit reached
10700107403policyerrorTarget port blocked
20000200502upstreamerrorTarget server could not be reached
20100201—clientdisconnectConnection closed by the client (not a service error)
———unknownerrorUnrecognized code; treat it as an error

Result categories

resultCategoryMeaning
successThe connection was established.
clientCaused on the client side: credentials or IP authorization, request format, an unsupported command, or the client closing the connection.
policyUsage policy or account limit: a blocked target, quota, concurrent connections, a closed port.
upstreamCould not connect to the target; try again.
unknownUnrecognized code (or a failed record from before September 17, 2026).

Filtering

ok, result, category, request_id, client_ip, egress_ip, target_host, service,udp, slot, port and min_latency_ms apply only to these types. status_group returns 400 here.

status_group (2xx, 4xx, 5xx) applies only to these types. Here, ip is searched for within the target or client address. Sending a parameter specific to the ISP family returns 400 invalid_request; details.field names the parameter.

An unknown parameter, or a date range whose start is after its end, also returns 400. All parameters are on theLogs endpoint.

Incomplete list

meta.partial is returned in every response. If it is true, the list may be incomplete: in the ISP family older records could not be read at that moment; on Mobile/Residential only the most recent records were returned. Try again shortly. If the log store is temporarily unreachable, 503 service_unavailable is returned.

Records before September 17, 2026

How records from the old log system are returned

The ISP, Datacenter and Gaming log system was replaced on September 17, 2026. Older records are also returned in the list (after the new records), but the fields that system did not have are null:requestId, result, errorCode, egressIp, extIp, latencyMs and slot. In these records levelis only connect or error, and resultCategory is only success or unknown; id is a stable, derived ID.

Filters that rely only on fields from the new system (ok, result, category, request_id, egress_ip, target_host,udp, slot, port, min_latency_ms) and partial searches in the ip parameter return only records from September 17, 2026 onward. The log timeline and the usage counters in the service details also cover only the new system.

If the old records cannot be read at that moment, the response still comes back, but meta.partial is true. In the same situation, the usage history returns meta.available false.

Breaking changes
  • extIp is now the real exit IP (the same as egressIp). It used to carry the proxy address you connected to; that address is now in gateIp + gatePort.
  • parentInfo was removed.
  • In ISP records, id is now the requestId (ULID).
  • timestamp is now the moment the connection CLOSED, to the second.
  • level now also takes the values auth, quota and disconnect.
  • Every record comes back with the same fixed set of keys. New keys were added: requestId, result, gateIp, egressIp, latencyMs and others.
  • proxyType is now only http or socks (the same as service); an unrecognized value returns null.
  • In the ISP family, the source value of the usage endpoints is now logs.
  • In Mobile/Residential logs, bytesIn and bytesOut used to come back swapped. Now, on every type, bytesIn is downloaded and bytesOut is uploaded bytes (past records included).

Give the requestId when you contact support

When you ask for help with a connection, send that record's requestId value; the support team uses it to find that exact connection. You can also query the same connection yourself with the request_id parameter. This is not the request_id in error responses: that one identifies your API request, this one a proxy connection.

PreviousUsage dataNextErrors