Use curl to query the Analytics API

You can submit a query built with the GraphiQL client as the payload in the data field of a POST request to the Analytics API.

The advantage of executing a request with curl Open external link is that you can redirect the response to a file and execute other post processing methods.

The GraphQL endpoint requires valid JSON, so you must pass the query as the value part of a JSON key:value pair with a key named query.

Pass the list of variables in another JSON key:value pair with a key named variables.

The script below returns the firewall events in one zone over the last 24 hours:

Example bash script that uses curl to query Analytics API
#!/bin/bash
#
# This script fetches the last 24 hours of firewall events for the ZoneID passed
# in as the first parameter using the global key passed in as the second parameter.
######################################################################################

ZoneID="$1"
global_key="$2"
Email="user@domain.com"
#
# Calculate 24 hours back and produce the start and end times in the appropriate format.
back_seconds=60*60*24  # 24 hours
end_epoch=$(date +'%s')
let start_epoch=$end_epoch-$back_seconds
start_date=$(date --date="@$start_epoch" +'%Y-%m-%dT%H:%M:%SZ')
end_date=$(date --date="@$end_epoch" +'%Y-%m-%dT%H:%M:%SZ')

PAYLOAD='{ "query":
  "query {
    viewer {
      zones(filter: { zoneTag: $zoneTag }) {
      firewallEventsAdaptive(
        filter: $filter
        limit: 10000
        orderBy: [datetime_DESC, rayName_DESC]
      ) {
          action,
          datetime,
          rayName,
          clientRequestHTTPHost,
          userAgent
        }
      }
    }
  }",'
PAYLOAD="$PAYLOAD

  \"variables\": {
    \"zoneTag\": \"$ZoneID\",
    \"filter\": {
      \"datetime_gt\": \"$start_date\",
      \"datetime_leq\": \"$end_date\"
    }
  }
}"

# Run query to GraphQL API endpoint

curl -s -X POST -H "Content-Type: application/json" -H "X-Auth-Email: $Email" -H  "X-Auth-Key: $global_key" --data "$(echo $PAYLOAD)" https://api.cloudflare.com/client/v4/graphql/