Common Monitoring Use Cases

This page brings the monitoring API categories together through common operational and reporting use cases.

Choose Stored Statistics for Continuous Monitoring

A common design mistake is to poll device real-time endpoints continuously to build a monitoring history. Each request must be processed by the selected device, so this approach consumes device and SD-WAN Manager resources and does not scale across a large fabric.

Use real-time endpoints for an immediate troubleshooting snapshot. For continuous collection, dashboards, reporting, and trend analysis, query the SD-WAN Manager statistics database instead.

Use case	Immediate troubleshooting or current-state endpoint	Recommended scalable endpoint
CPU utilization, uptime, and system status	GET /device/system/status?deviceId={system-ip} Useful response fields: cpu_user, cpu_system, cpu_idle, uptime, uptime-date, lastupdated	POST /statistics/system for stored system measurements over a time range
Interface speed, state, utilization, traffic, drops, and errors	GET /device/interface?deviceId={system-ip} Useful response fields: vdevice-dataKey, if-admin-status, if-oper-status, speed-mbps, uptime-date, lastupdated, rx-octets, tx-octets, rx-packets, tx-packets, rx-drops, tx-drops, rx-errors, tx-errors	POST /statistics/interface for historical records, or POST /statistics/interface/aggregation for grouped and bucketized utilization
Tunnel up/down state across devices	GET /data/device/state/BFDSessions This is a bulk state call, not a device real-time call. Useful response fields: vdevice-host-name, system-ip, state	POST /statistics/approute when historical tunnel state and application-route measurements are required
Tunnel traffic for one device	GET /device/tunnel/statistics?deviceId={system-ip} Useful response fields: vdevice-host-name, system-ip, rx_octets, tx_octets	POST /statistics/approute for historical tunnel traffic, filtering, and trend analysis

Do not turn troubleshooting calls into a polling system

Even when a /device endpoint returns counters, repeatedly polling it to create a time series is not recommended. Use Statistics APIs for stored history or Bulk APIs for batched collection across devices. Review the rate limits and load-management guidance before setting a collection interval.

Use Cases Covered in This Guide

Use case	Recommended API	Result
Device and site mapping	GET /device or GET /device?site-id={site-id}	Maps sites to WAN Edge system IPs and reports device reachability
Calculated device health	GET /statistics/devicehealth/overview/cpu	Manager-calculated good, fair, and poor classifications with supporting device metrics
Historical device measurements	POST /statistics/system	Stored CPU, memory, disk, and load measurements over time
Tunnel path quality	POST /statistics/approute/aggregation, grouped by tunnel name or the full local/remote tuple	Historical latency, jitter, and loss for each overlay path
Current circuit availability	GET /device/bfd/sessions?deviceId={system-ip}	Current BFD session state, grouped client-side by device and local color
Historical circuit quality	POST /statistics/approute/aggregation, grouped by vdevice_name and local_color	Historical quality across paths using each local transport
Site availability	POST /statistics/nwa/details with type=site	Measured downtime and availability over a selected period
Composite site health	GET /statistics/sitehealth/common	Ready-made overall, device, tunnel, and application health with scores
Applications observed at a site	GET /statistics/dpi/applications with all site device system IPs in the vdevice_name rule	Application flow and usage data for the selected site devices
Application health across sites	GET /statistics/perfmon/applications/sites/health	Manager-calculated application health, optionally including usage

Replace Analytics Aggregation Calls

Some SD-WAN Manager interfaces use unpublished paths under /analytics/api/v4/dataservice/aggregate/. These paths are not part of the 26.1 OpenAPI specification and should not be treated as stable public APIs. Use the documented monitoring operations below instead.

Analytics use case	Documented monitoring API	Detailed example
Applications by traffic utilization	POST /statistics/dpi/aggregation	Applications by Traffic Utilization
Sites by availability	POST /statistics/nwa/details with type=site	Aggregate Sites by Availability
Circuits by availability	POST /statistics/nwa/aggregation with type=link	Circuits by Availability

There is no first-class circuit object in these APIs. Model a circuit as a link or TLOC identified by device system IP and transport color. For path quality rather than availability, see Tunnel Path Quality, which uses POST /statistics/approute/aggregation grouped by the local and remote system IPs and colors.

---

Discover Devices and Map Them to Sites

Most device, tunnel, circuit, and application workflows need a WAN Edge system IP. Use the device inventory as the common starting point:

GET /dataservice/device

This unfiltered request returns the device inventory for the entire fabric. Use it to discover all devices and their site, system IP, personality, and reachability before narrowing the inventory to one site.

Add the site-id query parameter when the workflow is scoped to one site:

GET/device?site-id=90List devices at one site

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

Empty. Supply the site ID in the site-id query parameter.

Response - 200 OK

{
  "data": [
    {
      "host-name": "branch-90-edge-1",
      "site-id": "90",
      "system-ip": "10.0.90.2",
      "deviceId": "10.0.90.2",
      "personality": "vedge",
      "reachability": "reachable"
    }
  ]
}

Select WAN Edge records, normally identified by personality: "vedge". For real-time device calls, preferably select only devices whose reachability is reachable.

The API families use different names for the same identifiers. Apply these mappings throughout the guide:

Device inventory field	Used as	Where it is used
site-id	Site identifier	/device?site-id={site-id} inventory filter
system-ip	deviceId query value	Real-time calls such as /device/bfd/sessions?deviceId={system-ip}
system-ip	vdevice_name rule value	Stored statistics queries such as AppRoute and DPI
reachability	Device-selection condition	Avoid device-scoped real-time calls to unreachable devices
personality	Device-type condition	Select WAN Edges and exclude controllers when appropriate

site-id -> devices -> system-ip
                         ├─> real-time deviceId
                         └─> statistics vdevice_name

Field naming differs by API family

Device inventory responses use hyphenated fields such as site-id and system-ip. Statistics responses and query rules commonly use underscore names such as site_id and vdevice_name. Do not substitute a hostname, management IP, or chassis UUID when an operation requires the SD-WAN system IP.

---

Device Health

Use the device-health overview to retrieve the SD-WAN Manager health classification for WAN Edges. The response organizes devices into good, fair, and poor categories and includes the number of devices in each category.

GET/statistics/devicehealth/overview/cpu?last_n_hours=1&limit=100Get the WAN Edge health overview

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

Empty. The time window and result limit are query parameters.

Response - 200 OK

{
  "total": {
    "good": 22,
    "fair": 7,
    "poor": 10
  },
  "detail": {
    "good": [
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 4.529,
        "memory_utilization": 41.0,
        "reachability": "reachable",
        "system_ip": "10.0.90.2",
        "health": "good",
        "host_name": "BR9-DRE-ExtNode",
        "tenant": [],
        "site_id": "90",
        "site-name": "BOS90",
        "prev_cpu_load": 4.505166666666666,
        "prev_memory_utilization": 41.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 7.316,
        "memory_utilization": 34.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.83",
        "health": "good",
        "host_name": "BR83-C8375-E-G2",
        "tenant": [],
        "site_id": "10083",
        "site-name": "SITE_10083",
        "prev_cpu_load": 7.478750000000001,
        "prev_memory_utilization": 34.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 7.508,
        "memory_utilization": 11.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.49",
        "health": "good",
        "host_name": "c8kv-STACKIT",
        "tenant": [],
        "site_id": "7132",
        "site-name": "SITE_7132",
        "prev_cpu_load": 7.438833333333334,
        "prev_memory_utilization": 11.000000000000002
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 7.707,
        "memory_utilization": 27.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.95",
        "health": "good",
        "host_name": "CAMPUS1-MILPITAS-C8355-G2",
        "tenant": [],
        "site_id": "95035",
        "site-name": "CAMPUS1SJC95035",
        "prev_cpu_load": 7.746444444444445,
        "prev_memory_utilization": 27.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 8.968,
        "memory_utilization": 30.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.22",
        "health": "good",
        "host_name": "SJ22-166A-R30RU45-GW_LRT0009726",
        "tenant": [],
        "site_id": "2295035",
        "site-name": "SJC22-DMZ-Lab",
        "prev_cpu_load": 9.798222222222224,
        "prev_memory_utilization": 30.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 9.814,
        "memory_utilization": 33.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.24",
        "health": "good",
        "host_name": "SJ24-276-B06-WAN_LRT0048008",
        "tenant": [],
        "site_id": "24",
        "site-name": "SJC24",
        "prev_cpu_load": 9.457583333333334,
        "prev_memory_utilization": 33.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 10.982,
        "memory_utilization": 26.0,
        "reachability": "reachable",
        "system_ip": "10.0.90.1",
        "health": "good",
        "host_name": "BR9-DRE-ServContr",
        "tenant": [],
        "site_id": "90",
        "site-name": "BOS90",
        "prev_cpu_load": 14.074472222222225,
        "prev_memory_utilization": 26.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 12.272,
        "memory_utilization": 40.05,
        "reachability": "reachable",
        "system_ip": "10.2.3.1",
        "health": "good",
        "host_name": "BR3-C1111X-8P",
        "tenant": [],
        "site_id": "10103",
        "site-name": "NYC10103",
        "prev_cpu_load": 11.036666666666667,
        "prev_memory_utilization": 41.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 12.529,
        "memory_utilization": 25.222,
        "reachability": "reachable",
        "system_ip": "10.110.10.1",
        "health": "good",
        "host_name": "BR10-c8kv",
        "tenant": [],
        "site_id": "10010",
        "site-name": "SLC10010",
        "prev_cpu_load": 12.957500000000001,
        "prev_memory_utilization": 25.45
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 13.63,
        "memory_utilization": 66.759,
        "reachability": "reachable",
        "system_ip": "10.101.1.102",
        "health": "good",
        "host_name": "BR6-SDR-ISR4k",
        "tenant": [],
        "site_id": "101106",
        "site-name": "CPH101106",
        "prev_cpu_load": 13.144833333333333,
        "prev_memory_utilization": 66.40416666666667
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 14.348,
        "memory_utilization": 41.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.70",
        "health": "good",
        "host_name": "BR7-DRE-IntNode",
        "tenant": [],
        "site_id": "70",
        "site-name": "PHL70",
        "prev_cpu_load": 14.321833333333336,
        "prev_memory_utilization": 41.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 17.57,
        "memory_utilization": 49.0,
        "reachability": "reachable",
        "system_ip": "10.10.58.2",
        "health": "good",
        "host_name": "c8kv-azure-sdr",
        "tenant": [],
        "site_id": "582",
        "site-name": "Azure-Europe-SDR",
        "prev_cpu_load": 16.906333333333333,
        "prev_memory_utilization": 49.01666666666667
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 17.747,
        "memory_utilization": 44.844,
        "reachability": "reachable",
        "system_ip": "10.3.1.40",
        "health": "good",
        "host_name": "EXEC_SOHO2-C1161X",
        "tenant": [],
        "site_id": "13140",
        "site-name": "LOSGATOS40",
        "prev_cpu_load": 16.29816666666667,
        "prev_memory_utilization": 44.75
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 19.558,
        "memory_utilization": 47.0,
        "reachability": "reachable",
        "system_ip": "10.200.0.6",
        "health": "good",
        "host_name": "BR101-HNL-C8KV",
        "tenant": [],
        "site_id": "13120",
        "site-name": "HNL13120",
        "prev_cpu_load": 19.602333333333334,
        "prev_memory_utilization": 46.03333333333334
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 19.636,
        "memory_utilization": 19.0,
        "reachability": "reachable",
        "system_ip": "10.1.2.3",
        "health": "good",
        "host_name": "RemoteSite3-SanJose",
        "tenant": [],
        "site_id": "3",
        "site-name": "SJC00003",
        "prev_cpu_load": 19.267875,
        "prev_memory_utilization": 19.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 19.943,
        "memory_utilization": 47.0,
        "reachability": "reachable",
        "system_ip": "10.2.3.210",
        "health": "good",
        "host_name": "COLO1A-DEN-C8KV",
        "tenant": [],
        "site_id": "10023",
        "site-name": "COLO1DEN10023",
        "prev_cpu_load": 19.973958333333336,
        "prev_memory_utilization": 47.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 20.106,
        "memory_utilization": 47.0,
        "reachability": "reachable",
        "system_ip": "10.2.3.211",
        "health": "good",
        "host_name": "COLO1B-DEN-C8KV",
        "tenant": [],
        "site_id": "10023",
        "site-name": "COLO1DEN10023",
        "prev_cpu_load": 19.904750000000003,
        "prev_memory_utilization": 47.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 28.163,
        "memory_utilization": 42.0,
        "reachability": "reachable",
        "system_ip": "10.2.2.211",
        "health": "good",
        "host_name": "DC2b",
        "tenant": [],
        "site_id": "10021",
        "site-name": "DC2SJC10021",
        "prev_cpu_load": 28.054263888888894,
        "prev_memory_utilization": 42.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 29.368,
        "memory_utilization": 45.475,
        "reachability": "reachable",
        "system_ip": "10.2.4.1",
        "health": "good",
        "host_name": "BR4-C8200",
        "tenant": [],
        "site_id": "10104",
        "site-name": "LA10104",
        "prev_cpu_load": 31.168333333333333,
        "prev_memory_utilization": 45.68333333333334
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 31.729,
        "memory_utilization": 51.0,
        "reachability": "reachable",
        "system_ip": "10.2.2.210",
        "health": "good",
        "host_name": "DC2a",
        "tenant": [],
        "site_id": "10021",
        "site-name": "DC2SJC10021",
        "prev_cpu_load": 31.87988888888889,
        "prev_memory_utilization": 51.0
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 52.216,
        "memory_utilization": 38.964,
        "reachability": "reachable",
        "system_ip": "10.10.10.17",
        "health": "good",
        "host_name": "SJC-Edge2",
        "tenant": [],
        "site_id": "23",
        "site-name": "SJC23",
        "prev_cpu_load": 52.423791666666666,
        "prev_memory_utilization": 38.80416666666667
      },
      {
        "health_score": 10.0,
        "qoe": 10.0,
        "cpu_load": 59.848,
        "memory_utilization": 39.45,
        "reachability": "reachable",
        "system_ip": "10.10.10.13",
        "health": "good",
        "host_name": "SJC-Edge1",
        "tenant": [],
        "site_id": "23",
        "site-name": "SJC23",
        "prev_cpu_load": 61.917833333333334,
        "prev_memory_utilization": 39.49166666666667
      }
    ],
    "fair": [
      {
        "health_score": 5.0,
        "qoe": 9.0,
        "cpu_load": 33.648,
        "memory_utilization": 58.022,
        "reachability": "reachable",
        "system_ip": "10.3.1.30",
        "health": "fair",
        "host_name": "EXEC_SOHO1_C8231-G2",
        "tenant": [],
        "site_id": "13130",
        "site-name": "NAPA30",
        "prev_cpu_load": 20.099500000000003,
        "prev_memory_utilization": 58.01666666666666
      },
      {
        "health_score": 5.0,
        "qoe": 9.0,
        "cpu_load": 21.212,
        "memory_utilization": 31.0,
        "reachability": "reachable",
        "system_ip": "10.2.2.3",
        "health": "fair",
        "host_name": "BR5",
        "tenant": [],
        "site_id": "10105",
        "site-name": "CHI10105",
        "prev_cpu_load": 21.14666666666666,
        "prev_memory_utilization": 31.0
      },
      {
        "health_score": 5.0,
        "qoe": 10.0,
        "cpu_load": 14.761,
        "memory_utilization": 51.644,
        "reachability": "reachable",
        "system_ip": "10.10.10.20",
        "health": "fair",
        "host_name": "BOS_Edge1",
        "tenant": [],
        "site_id": "90",
        "site-name": "BOS90",
        "prev_cpu_load": 12.49522222222222,
        "prev_memory_utilization": 51.56111111111111
      },
      {
        "health_score": 5.0,
        "qoe": 10.0,
        "cpu_load": 12.995,
        "memory_utilization": 65.706,
        "reachability": "reachable",
        "system_ip": "10.2.1.211",
        "health": "fair",
        "host_name": "DC1B-SFO-C8300",
        "tenant": [],
        "site_id": "10020",
        "site-name": "DC1SFO10020",
        "prev_cpu_load": 7.878500000000002,
        "prev_memory_utilization": 65.64999999999999
      },
      {
        "health_score": 5.0,
        "qoe": 9.0,
        "cpu_load": 12.413,
        "memory_utilization": 69.0,
        "reachability": "reachable",
        "system_ip": "10.2.1.210",
        "health": "fair",
        "host_name": "DC1A-SFO-C8300",
        "tenant": [],
        "site_id": "10020",
        "site-name": "DC1SFO10020",
        "prev_cpu_load": 11.755666666666665,
        "prev_memory_utilization": 68.84583333333333
      },
      {
        "health_score": 5.0,
        "qoe": 9.0,
        "cpu_load": 11.865,
        "memory_utilization": 24.0,
        "reachability": "reachable",
        "system_ip": "10.47.1.1",
        "health": "fair",
        "host_name": "azure-cgw-east-us-1",
        "tenant": [],
        "site_id": "81",
        "site-name": "AZURE-EAST-US",
        "prev_cpu_load": 11.460333333333333,
        "prev_memory_utilization": 24.683333333333337
      },
      {
        "health_score": 5.0,
        "qoe": 9.0,
        "cpu_load": 11.703,
        "memory_utilization": 25.0,
        "reachability": "reachable",
        "system_ip": "10.47.1.2",
        "health": "fair",
        "host_name": "azure-cgw-east-us-2",
        "tenant": [],
        "site_id": "81",
        "site-name": "AZURE-EAST-US",
        "prev_cpu_load": 11.874833333333335,
        "prev_memory_utilization": 25.0
      }
    ],
    "poor": [
      {
        "health_score": 0.0,
        "qoe": 6.0,
        "cpu_load": 10.901,
        "memory_utilization": 96.0,
        "reachability": "reachable",
        "system_ip": "10.10.10.57",
        "health": "poor",
        "host_name": "aws-cgw-eu-cent-1",
        "tenant": [],
        "site_id": "8",
        "site-name": "AWS-EU-ENT",
        "prev_cpu_load": 11.048499999999999,
        "prev_memory_utilization": 96.0
      },
      {
        "health_score": 0.0,
        "qoe": 6.0,
        "cpu_load": 10.499,
        "memory_utilization": 96.0,
        "reachability": "reachable",
        "system_ip": "10.10.10.30",
        "health": "poor",
        "host_name": "aws-cgw-eu-cent-2",
        "tenant": [],
        "site_id": "8",
        "site-name": "AWS-EU-ENT",
        "prev_cpu_load": 10.392916666666666,
        "prev_memory_utilization": 96.11944444444445
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "10.10.10.65",
        "health": "poor",
        "host_name": "IOT1-IR1101",
        "tenant": [],
        "site_id": "65",
        "site-name": "SITE_65",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "192.168.26.42",
        "health": "poor",
        "host_name": "RTP6-8300-SL-2",
        "tenant": [],
        "site_id": "506250",
        "site-name": "SITE_506250",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "10.19.52.1",
        "health": "poor",
        "host_name": "SDCI-SJ",
        "tenant": [],
        "site_id": "103",
        "site-name": "EQUINIX-SJC",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "10.10.10.12",
        "health": "poor",
        "host_name": "IIOT-IR1101-K9",
        "tenant": [],
        "site_id": "1",
        "site-name": "IoT_Site",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "10.10.10.6",
        "health": "poor",
        "host_name": "host_1010106",
        "tenant": [],
        "site_id": "7",
        "site-name": "SITE_7",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "10.10.10.24",
        "health": "poor",
        "host_name": "SJC24-A06-TSG",
        "tenant": [],
        "site_id": "11",
        "site-name": "SJC24-A06",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "192.168.201.150",
        "health": "poor",
        "host_name": "rsaville_home",
        "tenant": [],
        "site_id": "5150",
        "site-name": "SITE_5150",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      },
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "192.168.26.45",
        "health": "poor",
        "host_name": "C8300-RTP6-Hub",
        "tenant": [],
        "site_id": "1000",
        "site-name": "RTP1000",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      }
    ]
  }
}

Important response fields include:

Field	Meaning
health_score	Overall device-health score calculated by SD-WAN Manager
health	Calculated category: good, fair, or poor
cpu_load	CPU utilization used in the current health calculation
memory_utilization	Memory utilization used in the current health calculation
prev_cpu_load	CPU utilization from the comparison period
prev_memory_utilization	Memory utilization from the comparison period
qoe	Quality-of-experience value associated with the device
reachability	Current device reachability reported by SD-WAN Manager
system_ip	SD-WAN system IP identifying the device
site_id	Site to which the device belongs

Filter Device Health by Site

The endpoint supports a site query parameter. Prefer server-side filtering when only one site is required:

GET/statistics/devicehealth/overview/cpu?last_n_hours=1&limit=100&site=5150Get health for one site

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

Empty. Note that the request parameter is site, while the returned device field is site_id.

Response - 200 OK

{
  "total": {
    "good": 0,
    "fair": 0,
    "poor": 1
  },
  "detail": {
    "good": [],
    "fair": [],
    "poor": [
      {
        "health_score": 0.0,
        "qoe": 3.0,
        "cpu_load": 0.0,
        "memory_utilization": 0.0,
        "reachability": "unreachable",
        "system_ip": "192.168.201.150",
        "health": "poor",
        "host_name": "rsaville_home",
        "tenant": [],
        "site_id": "5150",
        "site-name": "SITE_5150",
        "prev_cpu_load": 0.0,
        "prev_memory_utilization": 0.0
      }
    ]
  }
}

Query Historical System Measurements

The health-overview endpoint returns SD-WAN Manager’s calculated classification. Use POST /statistics/system when the consumer needs the underlying stored measurements over a time range for charting, trending, or independent analysis.

POST/statistics/system?pageSize=100Query stored system measurements

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["172.16.255.201"],
        "field": "vdevice_name",
        "type": "string",
        "operator": "in"
      }
    ]
  },
  "fields": [
    "entry_time",
    "vdevice_name",
    "host_name",
    "cpu_user",
    "cpu_system",
    "cpu_idle",
    "mem_util",
    "disk_used",
    "disk_avail"
  ],
  "sort": [
    {
      "field": "entry_time",
      "type": "date",
      "order": "desc"
    }
  ]
}

Response - 200 OK

{
  "data": [
    {
      "entry_time": 1647393870251,
      "vdevice_name": "172.16.255.201",
      "host_name": "vm201",
      "cpu_user": 8.63,
      "cpu_system": 3.23,
      "cpu_idle": 88.14,
      "mem_util": 0.59,
      "disk_used": 5789007872,
      "disk_avail": 9305948160
    }
  ]
}

Discover the fields available on the target release with GET /statistics/system/fields and the supported filter fields with GET /statistics/system/query/fields.

Requirement	Recommended endpoint
Ready-made good, fair, or poor device classification	GET /statistics/devicehealth/overview/cpu
Stored CPU, memory, disk, and load measurements over time	POST /statistics/system
Immediate device system status during troubleshooting	GET /device/system/status?deviceId={system-ip}

Interpret the classification as a whole

Although cpu appears in the path, detail records can include CPU, memory, QoE, reachability, and other health context. Use the classification calculated by SD-WAN Manager rather than deriving another health category from CPU alone. The one-hour window is a recent health interval, not an instantaneous CPU measurement.

Use system_ip to correlate a health record with statistics data. The device inventory API represents the same value as system-ip. Treat reachability separately from the health category when the consuming application needs explicit unreachable-device handling.

---

Tunnel Health

Customers sometimes use tunnel and circuit interchangeably, but the APIs expose different scopes:

Concept	Practical identity
Tunnel or path	Local device + local color + remote device + remote color
Circuit or transport	Local device + local color

One local circuit can carry multiple BFD tunnels to different remote peers. Choose the API and grouping based on whether the consumer needs an individual overlay path or the underlying local transport.

Customer use case	Endpoint and grouping	Meaning
Tunnel Health	POST /statistics/approute/aggregation, grouped by name or the full local/remote tuple	Historical quality of each overlay path
Circuit Availability	GET /device/bfd/sessions?deviceId={system-ip}, grouped client-side by device and local color	Current reachability through each local transport
Circuit Quality	POST /statistics/approute/aggregation, grouped by device and local color	Historical quality across the paths using each local transport

one circuit / local color -> multiple tunnels to remote peers

Tunnel Path Quality

Use AppRoute aggregation for historical latency, jitter, and loss derived from AppRoute/BFD probe telemetry. Group by the local and remote system IP and color tuple to produce one result per local-to-remote tunnel path. Include a time rule and scope the query to the required WAN Edge system IPs.

POST/statistics/approute/aggregationAggregate health measurements per tunnel

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["10.0.90.1", "10.0.90.2"],
        "field": "vdevice_name",
        "type": "string",
        "operator": "in"
      },
      {
        "value": ["100"],
        "field": "loss_percentage",
        "type": "number",
        "operator": "less"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "local_system_ip",
        "sequence": 1,
        "order": "asc"
      },
      {
        "property": "local_color",
        "sequence": 2,
        "order": "asc"
      },
      {
        "property": "remote_system_ip",
        "sequence": 3,
        "order": "asc"
      },
      {
        "property": "remote_color",
        "sequence": 4,
        "order": "asc"
      }
    ],
    "metrics": [
      {
        "property": "latency",
        "type": "avg"
      },
      {
        "property": "jitter",
        "type": "avg"
      },
      {
        "property": "loss_percentage",
        "type": "avg"
      }
    ]
  }
}

Response - 200 OK

The response contains one aggregated record per local-to-remote tunnel tuple, with the requested average quality measurements.

The complete path tuple is used because some Manager releases expose name in /statistics/approute/fields but still fail when it is used as an aggregation field. It also keeps paths to different remote peers separate.

Current Circuit Availability

The real-time BFD session endpoint returns the current operational state of the tunnels on one reachable WAN Edge.

GET/device/bfd/sessions?deviceId=10.0.90.2Get current BFD sessions for one device

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

Empty. The required deviceId query parameter is the device’s SD-WAN system IP.

Response - 200 OK

The response contains one record per BFD session, including its state and local and remote transport information.

Derive the current circuit state by grouping the returned sessions by local device and local color:

circuit = deviceId + local-color

1. Retrieve the BFD sessions for the device.
2. Group the sessions by local color.
3. Count the sessions in up and down states.
4. Treat the circuit as degraded when only some sessions are up, and unavailable when no sessions on that local color are up.

Current state is not historical availability

This endpoint reports current BFD session state. It does not calculate uptime or an availability percentage over a period. A down session can also indicate a remote-path problem rather than failure of the entire local circuit.

Historical Circuit Quality

Use AppRoute aggregation again for historical circuit latency, jitter, and loss. Group by both vdevice_name and local_color so transports belonging to different WAN Edges remain separate.

POST/statistics/approute/aggregationAggregate quality measurements per circuit

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["10.0.90.1", "10.0.90.2"],
        "field": "vdevice_name",
        "type": "string",
        "operator": "in"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "vdevice_name",
        "sequence": 1,
        "size": 200
      },
      {
        "property": "local_color",
        "sequence": 2,
        "size": 100
      }
    ],
    "metrics": [
      {
        "property": "latency",
        "type": "avg"
      },
      {
        "property": "jitter",
        "type": "avg"
      },
      {
        "property": "loss_percentage",
        "type": "avg"
      }
    ]
  }
}

Response - 200 OK

The response contains one aggregated quality record per device and local-color combination.

Do not group only by local_color when querying multiple devices. Doing so can combine similarly named transports, such as mpls or biz-internet, from several WAN Edges into one result.

Scope the Queries

Follow Discover Devices and Map Them to Sites, then place the returned WAN Edge system IPs in an AppRoute vdevice_name rule:

{
  "value": ["10.0.90.1", "10.0.90.2"],
  "field": "vdevice_name",
  "type": "string",
  "operator": "in"
}

The AppRoute OpenAPI request body is generic and does not formally guarantee a siteid or site_id query field. Resolving the devices with /device?site-id={site-id} and filtering AppRoute records by explicit vdevice_name values is the more defensible implementation.

---

Site Health

Two APIs provide site-level information, but they answer different operational questions and are not interchangeable:

Endpoint	Primary question	Result
POST /statistics/nwa/details	How available was the site during the selected period?	A customizable Network Availability query returning measurements such as down_time, availability, availability_status, and record count
GET /statistics/sitehealth/common	What health state has SD-WAN Manager calculated for the site?	A predefined composite summary containing overall, device, tunnel, and application health and their corresponding scores

Use /statistics/nwa/details for availability reporting, downtime calculations, custom filters, and custom aggregation. Use /statistics/sitehealth/common when a dashboard needs Manager’s ready-made health classification across devices, tunnels, and applications.

/statistics/nwa/details       = measured availability and downtime
/statistics/sitehealth/common = calculated composite health

Details do not change the calculation model

Setting includeDetails=true on /statistics/sitehealth/common asks the predefined Site Health API for additional detail. It does not turn the request into a Network Availability query and does not provide the custom grouping or downtime metrics available from /statistics/nwa/details.

Aggregate Sites by Availability

Network Availability statistics provide a site-level availability calculation. Filter records to type=site, group by site_id, and sum downtime over the selected period.

POST/statistics/nwa/detailsAggregate sites by availability

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["site"],
        "field": "type",
        "type": "string",
        "operator": "in"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "site_id",
        "sequence": 1,
        "size": 200
      }
    ],
    "metrics": [
      {
        "property": "down_time",
        "type": "sum",
        "order": "desc"
      }
    ]
  }
}

Response - 200 OK

{
  "data": [
    {
      "down_time": 720000000,
      "site_id": "1000",
      "count": 200,
      "availability": 0.0,
      "availability_status": "poor",
      "usage": 0.0,
      "latitude": "34.0",
      "longitude": "-78.0",
      "site_name": "RTP1000"
    },
    {
      "down_time": 720000000,
      "site_id": "1445",
      "count": 200,
      "availability": 0.0,
      "availability_status": "poor",
      "usage": 0.0,
      "site_name": "GCP-CGW-US-CENTRAL"
    }
  ]
}

This is a site-level result, not an individual-tunnel result. Use AppRoute aggregation when the consumer needs path latency, jitter, or loss.

Retrieve the Site Health Summary

GET /statistics/sitehealth/common returns one calculated health record per site. It combines overall site health with device, tunnel, and application health.

GET/statistics/sitehealth/common?last_n_hours=24&includeDetails=trueGet health for all sites

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

Empty. Use query parameters to select the time window and optional details.

Response - 200 OK

{
  "data": [
    {
      "site_id": "10105",
      "site_name": "CHI10105",
      "latitude": "41.880818",
      "longitude": "-87.673875",
      "fromGps": "false",
      "site_health": "poor",
      "devices_health": "fair",
      "tunnels_health": "poor",
      "apps_health": "no_data",
      "devices_health_score": 5.0,
      "tunnels_health_score": 2.5,
      "apps_health_score": -1.0,
      "apps_usage": 128601.0,
      "prev_apps_usage": 2850167.0,
      "region_list": [],
      "role": [],
      "device_type": []
    }
  ]
}

The endpoint has no documented site-ID query parameter. Filter the returned records by site_id when only selected sites are required. A value such as apps_health: "no_data" means that application health could not be calculated; it should not be interpreted as good application health.

---

Applications

The DPI statistics APIs cover several related application-monitoring workflows. They return applications observed in traffic during a selected period; they are not a static catalog of every application signature supported by SD-WAN Manager.

Requirement	API	Scope
List applications observed in the fabric	GET /statistics/dpi/applications	Time-window query without a device rule
List applications observed at one site	GET /statistics/dpi/applications	Filter vdevice_name by every WAN Edge system IP at the site
Rank application families by traffic	POST /statistics/dpi/aggregation	Group by family and sum octets; see Applications by Traffic Utilization
Inspect individual DPI records	POST /statistics/dpi	Raw records for validation and troubleshooting
Discover supported DPI fields	GET /statistics/dpi/fields and GET /statistics/dpi/query/fields	Validate fields before building filters or aggregations
Retrieve application health across sites	GET /statistics/perfmon/applications/sites/health	Manager-calculated application health; this is distinct from the DPI application list

Raw DPI Records vs. the Observed Application List

POST /statistics/dpi and GET /statistics/dpi/applications read the same DPI statistics at different levels of processing:

Endpoint	Result	Use it when
POST /statistics/dpi	Raw stored DPI observations, potentially with repeated records for the same application across devices, flows, VPNs, and collection intervals	You need exact stored fields, custom processing, or to troubleshoot an empty higher-level result
GET /statistics/dpi/applications	A processed application-flow list built from the matching DPI observations	You need the applications observed during a period without processing raw records yourself
POST /statistics/dpi/aggregation	Explicitly grouped DPI measurements with calculated metrics	You need results such as total octets grouped by application family

The raw operation is a POST, not a GET, because its time filter, selected fields, and sort order are supplied in a JSON request body. In Bruno, use Applications / 01 - Raw DPI Statistics for raw records, Applications / 02 - Applications for the fabric-wide processed list, and Applications / 03 - Applications by Site for the list scoped to a site’s WAN Edges.

Neither endpoint returns an application-experience or QoE score. For Manager-calculated application health across sites, use GET /statistics/perfmon/applications/sites/health.

List Observed Applications

Use a time-only query to list applications observed across the fabric. The required query parameter contains URL-encoded JSON; it is not a request body.

GET/statistics/dpi/applications?query={url-encoded JSON}&limit=100List applications observed in the fabric

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

None. This GET operation does not send a JSON request body.

Required query URL parameter

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      }
    ]
  }
}

Response - 200 OK

The response lists applications with matching DPI observations during the selected period. Increase the window only when the environment has sparse DPI traffic.

List Applications Observed at a Site

The DPI applications endpoint returns application flow and usage records, not an application-experience or QoE score. Follow Discover Devices and Map Them to Sites to resolve the WAN Edge system-ip values at the target site, then use those values as vdevice_name filters in the application query.

The applications endpoint is a GET operation. Add every WAN Edge system IP at the site to one vdevice_name rule, then pass the JSON query object as the URL-encoded value of the required query parameter. Do not send it in a request body.

In this example, the device inventory returns two WAN Edges for the same site:

GET /dataservice/device?site-id=90

site-id	system-ip	Device
90	10.0.90.1	branch-90-edge-1
90	10.0.90.2	branch-90-edge-2

Both system IPs therefore belong in the same vdevice_name rule. The rule does not mean “two unrelated devices”; it represents all WAN Edges contributing application data for site 90.

GET/statistics/dpi/applications?query={url-encoded JSON}&limit=100Get applications for one site

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

None. This GET operation does not send a JSON request body.

Required query URL parameter

The query parameter contains the filter JSON. The following is its value before Bruno or the HTTP client URL-encodes it:

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["10.0.90.1", "10.0.90.2"],
        "field": "vdevice_name",
        "type": "string",
        "operator": "in"
      }
    ]
  }
}

Response - 200 OK

{
  "data": [
    {
      "application": "office365",
      "octets": 72535008
    },
    {
      "application": "web",
      "octets": 28410320
    }
  ]
}

The response aggregates matching DPI observations for the supplied devices by application. This provides a site-scoped application list without making one request per device. Consider whether observing traffic at both ends of a flow could cause duplicate accounting within the intended scope.

Retrieve Application Health Across Sites

Use the Performance Monitor health endpoint when the requirement is Manager-calculated application health rather than a list of observed applications. The request below retrieves a 24-hour view for all sites, includes usage, and allows Manager to use cached health data.

GET/statistics/perfmon/applications/sites/health?last_n_hours=24&includeUsage=true&useCache=trueGet application health across sites

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

None. Use query parameters to select the time window, include usage, and control cached data.

Response - 200 OK

The response returns Manager-calculated application health records across sites. The supported time windows are 1, 3, 6, 12, and 24 hours. Optionally add health=GOOD, health=FAIR, or health=POOR to return only one health category.

Use Applications / 05 - Application Health Across Sites in Bruno for this operation. It is independent of the two editable system IPs used by the site-scoped DPI application-list request.

Configure the Request in Bruno

Open Applications / 03 - Applications by Site and replace the two example system IPs directly in the vdevice_name value:

"value": ["10.0.90.1", "10.0.90.2"]

Both IPs must belong to the same site. Use Devices / 02 - List Devices by Site to find them, then copy the returned system-ip values into the request URL. The request contains the complete JSON query inline:

get {
  url: https://{{vmanage}}:{{port}}/dataservice/statistics/dpi/applications?query={"query":{..."value":["10.0.90.1","10.0.90.2"]...}}&limit=100
  body: none
  auth: none
}

No additional Bruno variable or pre-request script is required. Keep encodeUrl: true enabled so Bruno URL-encodes the inline JSON query before sending it. For a site with one WAN Edge, leave only one IP in the array; for a site with more than two, add the remaining system IPs.

Troubleshoot an Empty Application Response

First remove the vdevice_name rule and widen the time window. This separates a device-value mismatch from a general absence of DPI data:

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["168"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      }
    ]
  }
}

If the broad applications query is empty, inspect the underlying DPI records:

POST/statistics/dpi?pageSize=100Inspect raw DPI records

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["168"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      }
    ]
  },
  "fields": [
    "entry_time",
    "vdevice_name",
    "host_name",
    "application",
    "family",
    "octets"
  ]
}

Response - 200 OK

An array of matching raw DPI records. Use the exact returned vdevice_name in the applications filter.

• If raw DPI records exist, copy the exact returned vdevice_name into the applications filter.
• If the broad applications query works but the site-specific query is empty, none of the supplied system IPs matches a stored vdevice_name with DPI data in the selected period.
• If both broad and raw queries return HTTP 200 with empty data, Manager has no matching DPI statistics. Check Application Visibility/DPI configuration, deployment state, recent traffic, device support, statistics collection, time synchronization, and retention.
• If the response is HTTP 403, verify that the account has Device Monitoring-read and RBAC VPN-read permissions.
• Compare the API result with the Application Visibility monitoring page for the same device and period. If the UI is also empty, the issue is data availability or configuration rather than the query.

If the UI contains data but the API does not, capture the Manager release, device model, HTTP status, response body, and transmitted URL from the Bruno Timeline.

---

Aggregation Examples

The following examples provide the complete documented requests referenced in Replace Analytics Aggregation Calls.

Applications by Traffic Utilization

Aggregate DPI records by application family and sum the observed octets over the last 24 hours. This is the documented alternative to /analytics/api/v4/dataservice/aggregate/applications for a utilization view.

Because the query below contains only an entry_time rule, it aggregates matching DPI data across the entire fabric. To scope the result to one site, add a vdevice_name rule containing every WAN Edge system IP at that site, as shown in List Applications Observed at a Site.

POST/statistics/dpi/aggregationAggregate applications by utilization

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "family",
        "size": 200,
        "sequence": 1
      }
    ],
    "metrics": [
      {
        "property": "octets",
        "type": "sum",
        "order": "desc"
      }
    ]
  }
}

Response - 200 OK

The response groups DPI observations by family and returns the summed octets, with the highest-utilization groups first.

In Bruno, Applications / 04 - Aggregate Applications by Utilization uses a 1,000-hour fabric-wide window because the demo environment has sparse DPI history. Change 1000 to a shorter period such as 24 for an active production fabric.

Application names and health

Use /statistics/dpi/fields and /statistics/dpi/query/fields to check whether the target release exposes a more specific application grouping. For application health or QoE across sites, use GET /statistics/perfmon/applications/sites/health instead.

Sites by Availability

Filter Network Availability records to site, group them by site ID, and sum downtime over the last 24 hours. This replaces /analytics/api/v4/dataservice/aggregate/sites when the required result is site availability.

POST/statistics/nwa/detailsAggregate sites by availability

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["site"],
        "field": "type",
        "type": "string",
        "operator": "in"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "site_id",
        "sequence": 1,
        "size": 100
      }
    ],
    "metrics": [
      {
        "property": "down_time",
        "type": "sum",
        "order": "desc"
      }
    ]
  }
}

Response - 200 OK

The response returns site-level Network Availability records, including availability and health information. For a ready-made health summary, use GET /statistics/sitehealth/common?last_n_hours=24&includeDetails=true.

Circuits by Availability

Filter Network Availability records to link, then group them by device system IP and transport color. This is the closest documented availability replacement for /analytics/api/v4/dataservice/aggregate/circuits.

POST/statistics/nwa/aggregationAggregate circuits by availability

Headers

X-XSRF-TOKEN: <X-XSRF-TOKEN>
Authorization: Bearer {{apikey}}
Content-Type: application/json

Request body

{
  "query": {
    "condition": "AND",
    "rules": [
      {
        "value": ["24"],
        "field": "entry_time",
        "type": "date",
        "operator": "last_n_hours"
      },
      {
        "value": ["link"],
        "field": "type",
        "type": "string",
        "operator": "in"
      }
    ]
  },
  "aggregation": {
    "field": [
      {
        "property": "system_ip",
        "sequence": 1,
        "size": 100
      },
      {
        "property": "color",
        "sequence": 2,
        "size": 100
      }
    ],
    "metrics": [
      {
        "property": "down_time",
        "type": "sum",
        "order": "desc"
      }
    ]
  }
}

Response - 200 OK

The response returns link-level Network Availability records for each system-IP and color combination.

Circuit quality uses AppRoute statistics

For latency, jitter, and loss, use POST /statistics/approute/aggregation. Group by the relevant combination of local_system_ip, local_color, remote_system_ip, and remote_color, then average latency, jitter, and loss_percentage.

---

Practice with Bruno

After completing authentication, use the grouped requests under Monitoring APIs:

Devices

1. 01 - List All Devices returns the complete device inventory across the fabric without a site filter.
2. 02 - List Devices by Site maps site_id to WAN Edge system IPs and reachability, then saves site_system_ips and the first system_ip automatically.
3. 03 - Device Health Overview returns the global calculated device-health classification.
4. 04 - Device Health by Site applies the site query parameter to the device-health overview.
5. 05 - Historical System Measurements queries stored CPU, memory, and disk measurements for system_ip.

Interfaces

1. 01 - Simple Interface Statistics Query returns stored interface records.
2. 02 - Aggregate Interface Statistics Query averages interface throughput in time buckets.
3. 03 - Bulk Interface State retrieves current interface state across devices.
4. 04 - Bulk Interface Statistics retrieves interface statistics for a generated one-hour interval.

Applications

1. 01 - Raw DPI Statistics retrieves the underlying stored DPI records for inspection and troubleshooting.
2. 02 - Applications lists applications observed across the fabric using a time-only query.
3. 03 - Applications by Site contains two editable WAN Edge system IPs and returns applications observed for those site devices.
4. 04 - Aggregate Applications by Utilization groups DPI traffic by application family and sums observed octets.
5. 05 - Application Health Across Sites retrieves Manager-calculated application health for all sites over the last 24 hours and includes usage.

Sites

1. 01 - Aggregate Sites by Availability summarizes downtime by site.
2. 02 - Site Health Summary gets the predefined 24-hour composite health summary with details.

Tunnels and Circuits

1. 01 - Real-Time BFD Sessions gets the current BFD sessions for system_ip.
2. 02 - Real-Time Application-Route Statistics gets the current AppRoute state for system_ip.
3. 03 - Aggregate Circuits by Availability summarizes downtime by device and transport color.
4. 04 - Tunnel Path Quality aggregates AppRoute quality metrics by the full local/remote system-IP and color tuple.
5. 05 - Historical Circuit Quality aggregates AppRoute quality by device and local color.
6. 06 - Get Application-Route Fields lists the AppRoute fields supported by the target Manager before you build filters or aggregations.

The site, tunnel, circuit-quality, system, and site-health examples use a 24-hour window. The application-utilization example uses 1,000 hours because the demo environment has sparse DPI history; reduce that window for an active production network. Discover supported fields on the target release and review Monitoring API Best Practices before increasing the window or request frequency.

Automate with Python

The standalone Python examples implement all seven operational and aggregation cases discussed in this guide. See Python Monitoring Examples for commands, output options, and the process for registering another use case.