# Types

The fields of every response and event type, and the enumerations they use.

## Lookup types

Response models are sealed classes with `init` properties.

- **Nullability:** A property whose type does not end in `?` is always set: a response that omits it or sends `null` for it, or a `null` element in a list or dictionary, throws a `SynthientException` rather than producing a partial object.
- **Unknown fields:** Fields the SDK does not know are ignored.
- **Units:** Timestamps are `DateTimeOffset` values. The API sends most as Unix seconds and some as Unix milliseconds, and the SDK reads numbers of `1e12` or more as milliseconds and returns both in UTC. The exception is `AccountApiKey.CreatedAt`, which the API sends as an RFC 3339 string.

### IPInfo

The intelligence Synthient holds for an IP address. See the [IP API](https://docs.synthient.com/ipapi) for how each field is derived.

- `IP` `IPAddress` — The address that was looked up, as the API canonicalized it.
- `Network` `Network?` — The network that announces the address, or `null` if the API has no network data.
- `Location` `Location?` — The geolocation of the address, or `null` if the API has no location data.
- `Intelligence` `Intelligence?` — The risk score and the proxy, VPN, and device observations for the address, or `null` if the API has no intelligence data.

### Network

- `Asn` `long` — The autonomous system number, or `0` if the address is not routed.
- `Isp` `string` — The name of the internet service provider.
- `Type` `string` — The kind of network, such as `NetworkType.Residential`. See [Enumerations](#enumerations).
- `Org` `string?` — The organization the address is registered to, or `null` if unknown.
- `Domain` `string?` — The network operator's domain, or `null` if unknown.
- `AbuseEmail` `string?` — The operator's abuse contact email, or `null` if unknown.
- `AbusePhone` `string?` — The operator's abuse contact phone number, or `null` if unknown.

### Location

- `Country` `string` — The ISO 3166-1 alpha-2 country code.
- `State` `string` — The state or region.
- `City` `string` — The city.
- `Timezone` `string` — The IANA time zone name.
- `Latitude` `double` — The latitude in degrees.
- `Longitude` `double` — The longitude in degrees.
- `GeoHash` `string` — The geohash of the coordinates.

### Intelligence

Synthient's assessment of an address. See [Methodology](https://docs.synthient.com/methodology) for how it is built.

- `RiskScore` `int` — The risk of the address, from 0 to 100.
- `Categories` `IReadOnlyList<string>` — The kinds of services seen on the address, such as `"RESIDENTIAL_PROXY"`. New values may be added.
- `Behavior` `IReadOnlyList<string>` — Behaviors observed from the address. New values may be added.
- `Providers` `IReadOnlyList<Provider>` — The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.
- `Devices` `IReadOnlyList<Device>` — The device types seen behind the address.

### Provider

A proxy, VPN, or anonymizer service seen using an address.

- `Name` `string` — The service tag, such as `"BRIGHTDATA"`. The API names this field `provider`. See [Service Tags](https://docs.synthient.com/service-tags).
- `Type` `string` — The service category.
- `LastSeen` `DateTimeOffset` — When the service was last seen using the address.

### Device

A device type seen behind an address.

- `OS` `string` — The operating system, such as `DeviceOS.Android`. See [Enumerations](#enumerations).
- `Version` `string` — The operating system version.
- `LastSeen` `DateTimeOffset` — When the device was last seen.

## Domain types

### DomainInfo

The honeypot traffic Synthient has observed for a domain.

- `Domain` `string` — The domain that was looked up.
- `Status` `string` — Whether the domain had events in the last 24 hours, `DomainStatus.Active` or `DomainStatus.Inactive`.
- `Stats` `DomainStats` — Aggregate event counts.
- `TimeSeries` `IReadOnlyList<TimeSeriesPoint>` — Daily event counts.
- `UniqueIPs` `UniqueIPCounts` — The number of distinct source addresses.
- `TopAsn` `AsnCount?` — The network that sent the most events, or `null` if there were none.
- `TopSubdomains` `IReadOnlyList<SubdomainCount>` — The most targeted subdomains.
- `TopPorts` `IReadOnlyList<PortCount>` — The most targeted ports.
- `GeoDistribution` `IReadOnlyList<CountryCount>` — Event counts by source country.
- `HourDowHeatmap` `IReadOnlyList<IReadOnlyList<long>>` — The last 30 days of events by UTC day of week and hour, indexed as `HourDowHeatmap[day][hour]`. Day 0 is Monday, unlike `DayOfWeek`, where 0 is Sunday.
- `ActivityStats` `ActivityStats` — The hourly activity pattern.
- `RecentEvents` `IReadOnlyList<DomainEvent>` — The most recent events, capped by the lookup's `limit`.

### DomainStats

- `Events24h` `long` — The number of events in the last 24 hours.
- `TotalEvents30d` `long` — The number of events in the last 30 days.

### UniqueIPCounts

The number of distinct source addresses seen for a domain.

- `Value24h` `long` — The count for the last 24 hours.
- `Value30d` `long` — The count for the last 30 days.
- `Sparkline24h` `IReadOnlyList<long>` — Hourly counts for the last 24 hours.

### TimeSeriesPoint

The event counts for one day.

- `Date` `DateTimeOffset` — The start of the UTC day.
- `Events` `long` — The number of events that day.
- `UniqueIPs` `long` — The number of distinct source addresses that day.

### AsnCount

- `Asn` `long` — The autonomous system number.
- `Events` `long` — The number of events from the network.

### SubdomainCount

- `Subdomain` `string` — The targeted subdomain.
- `Count` `long` — The number of events that targeted it.

### PortCount

- `Port` `int` — The targeted port.
- `Count` `long` — The number of events that targeted it.

### CountryCount

- `CountryCode` `string` — The ISO 3166-1 alpha-2 country code.
- `Events` `long` — The number of events from the country.
- `UniqueIPs` `long` — The number of distinct addresses from the country.

### ActivityStats

The hourly activity pattern of a domain.

- `Cadence` `string` — A sentence describing how events are spread over the last 30 days. See [Enumerations](#enumerations).
- `MedianPerHour` `long` — The median number of events per hour.
- `P95PerHour` `long` — The 95th percentile of events per hour.
- `PeakHour` `int` — The busiest UTC hour of the day.
- `QuietHour` `int` — The quietest UTC hour of the day.

### DomainEvent

A single honeypot event for a domain.

- `Timestamp` `DateTimeOffset` — When the event happened.
- `SourceIP` `string` — The full proxy exit address that carried the event. The API names the field `source_ip_masked`, but the address is not masked.
- `TargetSubdomain` `string` — The subdomain that was targeted.
- `CountryCode` `string` — The source country.
- `Port` `int` — The targeted port.

## Account types

### Account

The account that owns the API key.

- `Email` `string` — The account holder's email address.
- `FirstName` `string` — The account holder's first name.
- `LastName` `string` — The account holder's last name.
- `Organization` `Organization` — The organization the account belongs to.
- `Scopes` `IReadOnlyList<string>` — The permissions granted to the API key. See [Enumerations](#enumerations).
- `LookupQuota` `LookupQuota` — The remaining lookup credit balance.
- `ApiKey` `AccountApiKey?` — The API key used for the request, or `null` if the response omits it.

### Organization

- `Id` `string` — The organization's ID, a UUID.
- `Name` `string` — The organization's name.
- `Relation` `string` — The account's role in the organization. See [Enumerations](#enumerations).

### LookupQuota

An account's lookup credit balance.

- `Credits` `long` — The number of lookup credits remaining.
- `ResetsIn` `TimeSpan` — How long until the credits reset.

### AccountApiKey

An API key. It never contains the secret key itself.

- `Id` `string` — The key's ID, a UUID.
- `Name` `string` — The key's display name.
- `CreatedAt` `DateTimeOffset` — When the key was created, parsed from the RFC 3339 string the API sends.

## Export types

### ExportPage

One page of a feed's exports, newest first.

- `Stream` `string` — The feed's stream identifier, such as `"proxies"`.
- `Exports` `IReadOnlyList<Export>` — The exports on this page. The API names this field `feeds`.
- `NextCursor` `string?` — Fetches the next page through the `cursor` parameter. It is `null` or empty on the last page.

### Export

A Parquet export of a feed.

- `Id` `string` — Identifies the export for `GetExportMetaAsync`, `GetDownloadUrlAsync`, and `DownloadAsync`. On the first page, the newest hourly export may have the ID `ExportId.Latest`.
- `Kind` `string` — Whether the export covers an hour or a day, `ExportKind.Hourly` or `ExportKind.Daily`.
- `Date` `DateOnly` — The UTC day of the export.
- `Hour` `int?` — The UTC hour of an hourly export, or `null` for a daily export.
- `SizeBytes` `long` — The size of the Parquet file in bytes.
- `RowCount` `long` — The number of rows in the file.
- `Checksum` `string` — The hex-encoded SHA-256 of the Parquet file.
- `CreatedAt` `DateTimeOffset` — When the export was produced.
- `DownloadPath` `string` — The API path of the export's download, including the version prefix.

### ExportMeta

A Parquet export's checksum, size, and schema, without its contents. Unlike `Export.Date`, its `Date` is a `DateTimeOffset`.

- `Id` `string` — The export ID.
- `Stream` `string` — The feed's stream identifier.
- `Kind` `string` — Whether the export covers an hour or a day, `ExportKind.Hourly` or `ExportKind.Daily`.
- `Format` `string` — The file format, `"parquet"`.
- `Date` `DateTimeOffset` — The start of the export's UTC day or hour.
- `Hour` `int?` — The UTC hour of an hourly export, or `null` for a daily export.
- `Rows` `long` — The number of rows in the file.
- `Size` `long` — The size of the Parquet file in bytes.
- `Checksum` `string` — The hex-encoded SHA-256 of the Parquet file.
- `CreatedAt` `DateTimeOffset` — When the export was produced.
- `Schema` `ParquetSchema` — The Parquet columns.

### ParquetSchema

- `Fields` `IReadOnlyList<ParquetColumn>` — The columns in file order.

### ParquetColumn

- `Name` `string` — The column name.
- `Type` `string` — The column type. See [Enumerations](#enumerations).

## Event types

Stream payloads match the [Firehose](https://docs.synthient.com/enterprise/firehose) and [Helios](https://docs.synthient.com/enterprise/helios) documentation field for field. The API may omit any field of `ProxyEvent`, `AnonymizerEvent`, `TorrentEvent`, and `Ja4tEvent`, so all of their properties are nullable, as are those of `TorrentFile` and `TorrentPeer`. Timestamps are decoded as described under [Lookup types](#lookup-types).

### ProxyEvent

A proxy sighting from the `Proxies` feed.

- `IP` `string?` — The proxy exit address.
- `Provider` `string?` — The proxy service tag.
- `Type` `string?` — The service category. See [Enumerations](#enumerations).
- `CountryCode` `string?` — The ISO 3166-1 alpha-2 country of the address.
- `Asn` `long?` — The autonomous system number of the address.
- `Timestamp` `DateTimeOffset?` — When the proxy was seen.

### AnonymizerEvent

A VPN or anonymizer IP range from the `Anonymizers` feed.

- `RangeStart` `string?` — The first address of the range.
- `RangeEnd` `string?` — The last address of the range.
- `Provider` `string?` — The service tag.
- `Type` `string?` — The service category, such as `ProxyType.CommercialVpn`.
- `CountryCode` `string?` — The ISO 3166-1 alpha-2 country of `RangeStart`.
- `Asn` `long?` — The autonomous system number of `RangeStart`.
- `Timestamp` `DateTimeOffset?` — When the range was seen.

### TorrentEvent

A torrent observed on the BitTorrent DHT or a tracker.

- `InfoHash` `string?` — The hex-encoded SHA-1 info hash.
- `Name` `string?` — The torrent's name.
- `MagnetUri` `string?` — The torrent's magnet link.
- `TotalSize` `long?` — The total size of the torrent's files in bytes.
- `PieceLength` `long?` — The piece size in bytes.
- `FileCount` `int?` — The number of files in the torrent.
- `Files` `IReadOnlyList<TorrentFile>?` — The files in the torrent.
- `Peers` `IReadOnlyList<TorrentPeer>?` — The peers seen sharing the torrent.
- `Timestamp` `DateTimeOffset?` — When the torrent was seen.

### TorrentFile

- `Path` `string?` — The file path within the torrent.
- `Length` `long?` — The file size in bytes.

### TorrentPeer

- `IP` `string?` — The peer's address.
- `Port` `int?` — The peer's port.
- `Source` `string?` — Where the peer was found, such as `"DHT"`, `"PEX"`, or `"tracker"`.
- `Encrypted` `bool?` — Whether the peer supports encrypted connections.

### Ja4tEvent

A JA4T TCP fingerprint sighting.

- `IP` `string?` — The address the fingerprint was seen from.
- `Ja4t` `string?` — The JA4T fingerprint.
- `Provider` `string?` — The service tag of the address.
- `Type` `string?` — The service category, such as `ProxyType.DatacenterProxy`.
- `CountryCode` `string?` — The ISO 3166-1 alpha-2 country of the address.
- `Asn` `long?` — The autonomous system number of the address.
- `Timestamp` `DateTimeOffset?` — When the fingerprint was seen.

### HeliosMeta

The Helios honeypot sensor that captured an event. The API may omit any of its fields.

- `ProxyIP` `string?` — The proxy exit address the traffic arrived through.
- `Server` `string?` — The sensor that captured the traffic.
- `PoolId` `string?` — The sensor pool.
- `Provider` `string?` — The proxy service the traffic arrived through.

### HeliosHttpEvent

An HTTP request captured by a Helios honeypot.

- `Timestamp` `DateTimeOffset` — When the request was captured.
- `TunnelId` `ulong` — Identifies the proxy tunnel the request arrived through. Live values use the full `ulong` range.
- `Domain` `string` — The host the tunnel was opened to.
- `Port` `int` — The destination port.
- `Protocol` `string` — The protocol, `"http"`.
- `Meta` `HeliosMeta` — The capturing sensor.
- `Details` `HttpRequestDetails?` — The parsed request, or `null` if the API omits it.
- `Raw` `byte[]?` — The raw request bytes, decoded from the API's base64, or `null` if the API omits them.

### HttpRequestDetails

A parsed HTTP request. The API may omit any of its fields.

- `Method` `string?` — The request method.
- `Uri` `string?` — The request target.
- `Version` `string?` — The HTTP version, such as `"HTTP/1.1"`.
- `Headers` `IReadOnlyDictionary<string, string>?` — The request headers.

### HeliosHttpsEvent

A TLS ClientHello captured by a Helios honeypot.

- `Timestamp` `DateTimeOffset` — When the handshake was captured.
- `TunnelId` `ulong` — Identifies the proxy tunnel the handshake arrived through. Live values use the full `ulong` range.
- `Domain` `string` — The host the tunnel was opened to.
- `Port` `int` — The destination port.
- `Protocol` `string` — The protocol, `"https"`.
- `Meta` `HeliosMeta` — The capturing sensor.
- `Details` `TlsClientHello?` — The parsed ClientHello, or `null` if the sensor could not parse the handshake.
- `Raw` `string?` — Always `null`, because the sensors do not capture handshake bytes.

### TlsClientHello

A TLS ClientHello parsed by a Helios sensor. Fields the sensor could not parse are `null`, and new fields may be added.

- `RecordVersion` `string?` — The record layer version, such as `"TLS 1.0"`.
- `HandshakeVersion` `string?` — The ClientHello version, such as `"TLS 1.2"`.
- `ClientRandom` `string?` — The hex-encoded 32-byte client random.
- `SessionId` `string?` — The hex-encoded session ID.
- `SessionIdLength` `int?` — The length of the session ID in bytes.
- `CipherSuites` `IReadOnlyList<TlsCodeName>?` — The offered cipher suites.
- `CompressionMethods` `IReadOnlyList<int>?` — The offered compression methods.
- `Extensions` `IReadOnlyList<TlsExtension>?` — The extensions in wire order.
- `Sni` `string?` — The `server_name` extension value.
- `Alpn` `IReadOnlyList<string>?` — The offered application protocols.
- `SupportedVersions` `IReadOnlyList<string>?` — The offered TLS versions.
- `SupportedGroups` `IReadOnlyList<TlsCodeName>?` — The offered key exchange groups.
- `SignatureAlgorithms` `IReadOnlyList<TlsCodeName>?` — The offered signature algorithms.
- `EcPointFormats` `IReadOnlyList<string>?` — The offered elliptic curve point formats.
- `KeyShareGroups` `IReadOnlyList<string>?` — The groups the client sent key shares for.
- `PskKeyExchangeModes` `IReadOnlyList<string>?` — The offered pre-shared key exchange modes.
- `CompressCertificate` `IReadOnlyList<string>?` — The offered certificate compression algorithms.
- `HasGrease` `bool?` — Whether the ClientHello contains GREASE values.
- `ApplicationSettings` `bool?` — Whether the client offered application settings (ALPS).
- `DelegatedCredentials` `bool?` — Whether the client offered the `delegated_credentials` extension.
- `EncryptThenMac` `bool?` — Whether the client offered the `encrypt_then_mac` extension.
- `ExtendedMasterSecret` `bool?` — Whether the client offered the `extended_master_secret` extension.
- `PostHandshakeAuth` `bool?` — Whether the client offered the `post_handshake_auth` extension.
- `RenegotiationInfo` `bool?` — Whether the client offered the `renegotiation_info` extension.
- `SignedCertificateTimestamps` `bool?` — Whether the client offered the `signed_certificate_timestamp` extension.
- `StatusRequest` `bool?` — Whether the client requested OCSP stapling.

### TlsCodeName

A TLS registry code point and its name. GREASE values are named `"GREASE(0x....)"`.

- `Code` `int?` — The code point.
- `Name` `string?` — The code point's registered name.

### TlsExtension

An extension in a TLS ClientHello.

- `Code` `int?` — The extension type.
- `Name` `string?` — The extension's registered name.
- `Length` `int?` — The extension body length in bytes.

### HeliosDnsEvent

A destination that a Helios honeypot tunnel was asked to reach. Despite the feed's name, it is not a DNS query: names resolved inside a tunneled DNS session are not visible.

- `Timestamp` `DateTimeOffset` — When the event was captured.
- `TunnelId` `ulong` — Identifies the proxy tunnel. Live values use the full `ulong` range.
- `Domain` `string` — The host name or address literal the tunnel was opened to.
- `Port` `int` — The destination port.
- `Protocol` `string` — The protocol, `"dns"`.
- `Meta` `HeliosMeta` — The capturing sensor.

### HeliosAdbEvent

An Android Debug Bridge shell command captured by a Helios honeypot. It has no timestamp because the sensor sends none.

- `Session` `string` — Identifies the ADB session as 32 hex characters.
- `SequentialId` `long` — The 1-based position of the command within its session.
- `Command` `string` — The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.
- `Hash` `string` — The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of `Command`: every command in a session shares it, and sessions that replay the same script share it too.

## Enumerations

Each value set is a static class of `string` constants, and the properties that hold these values are typed `string`. Compare them with the constants, and handle values that have no constant: the API may add values to the sets marked open.

### NetworkType

The kind of network that announces an address, used by `Network.Type`. Open.

| Constant                   | Value            |
| -------------------------- | ---------------- |
| `NetworkType.Mobile`       | `MOBILE`         |
| `NetworkType.Satellite`    | `SATELLITE`      |
| `NetworkType.InFlightWifi` | `IN_FLIGHT_WIFI` |
| `NetworkType.Residential`  | `RESIDENTIAL`    |
| `NetworkType.Corporate`    | `CORPORATE`      |
| `NetworkType.Academic`     | `ACADEMIC`       |
| `NetworkType.Datacenter`   | `DATACENTER`     |
| `NetworkType.Government`   | `GOVERNMENT`     |

### ProxyType

The kind of service seen on an address, used by `ProxyEvent.Type`, `AnonymizerEvent.Type`, and `Ja4tEvent.Type`. Open.

| Constant                     | Value               |
| ---------------------------- | ------------------- |
| `ProxyType.FreeVpn`          | `FREE_VPN`          |
| `ProxyType.CommercialVpn`    | `COMMERCIAL_VPN`    |
| `ProxyType.EnterpriseVpn`    | `ENTERPRISE_VPN`    |
| `ProxyType.MobileProxy`      | `MOBILE_PROXY`      |
| `ProxyType.BlockchainProxy`  | `BLOCKCHAIN_PROXY`  |
| `ProxyType.ResidentialProxy` | `RESIDENTIAL_PROXY` |
| `ProxyType.PublicProxy`      | `PUBLIC_PROXY`      |
| `ProxyType.DatacenterProxy`  | `DATACENTER_PROXY`  |
| `ProxyType.TorNode`          | `TOR_NODE`          |
| `ProxyType.PrivateRelay`     | `PRIVATE_RELAY`     |
| `ProxyType.Botnet`           | `BOTNET`            |
| `ProxyType.SearchEngine`     | `SEARCH_ENGINE`     |
| `ProxyType.AICrawler`        | `AI_CRAWLER`        |
| `ProxyType.SocialMedia`      | `SOCIAL_MEDIA`      |
| `ProxyType.UptimeMonitor`    | `UPTIME_MONITOR`    |
| `ProxyType.LinkPreview`      | `LINK_PREVIEW`      |
| `ProxyType.SeoCrawler`       | `SEO_CRAWLER`       |
| `ProxyType.WebArchiver`      | `WEB_ARCHIVER`      |
| `ProxyType.WebhookProvider`  | `WEBHOOK_PROVIDER`  |
| `ProxyType.PaymentProcessor` | `PAYMENT_PROCESSOR` |
| `ProxyType.InternetScanner`  | `INTERNET_SCANNER`  |

### DeviceOS

A device operating system, used by `Device.OS`. Open.

| Constant            | Value       |
| ------------------- | ----------- |
| `DeviceOS.Android`  | `Android`   |
| `DeviceOS.ChromeOS` | `Chrome OS` |
| `DeviceOS.FreeBsd`  | `FreeBSD`   |
| `DeviceOS.IOS`      | `iOS`       |
| `DeviceOS.Linux`    | `Linux`     |
| `DeviceOS.MacOSX`   | `Mac OS X`  |
| `DeviceOS.Windows`  | `Windows`   |

### Scope

A permission granted to an API key, used by `Account.Scopes`. Open. `Scope.Basic` authorizes lookups and `GetAccountAsync`. Each feed has one scope for its exports and one for its stream, as listed under [Feeds](https://docs.synthient.com/sdks/csharp/feeds). See [Authentication](https://docs.synthient.com/authentication) for how scopes are granted.

| Constant                    | Value                   |
| --------------------------- | ----------------------- |
| `Scope.Basic`               | `BASIC`                 |
| `Scope.ProxyFeeds`          | `PROXY_FEEDS`           |
| `Scope.ProxyFirehose`       | `PROXY_FIREHOSE`        |
| `Scope.AnonymizersFeed`     | `ANONYMIZERS_FEED`      |
| `Scope.AnonymizersStream`   | `ANONYMIZERS_STREAM`    |
| `Scope.Ja3Feed`             | `JA3_FEED`              |
| `Scope.Ja3Stream`           | `JA3_STREAM`            |
| `Scope.TorrentsFeed`        | `TORRENTS_FEED`         |
| `Scope.TorrentsStream`      | `TORRENTS_STREAM`       |
| `Scope.HoneypotHttpFeed`    | `HONEYPOT_HTTP_FEED`    |
| `Scope.HoneypotHttpStream`  | `HONEYPOT_HTTP_STREAM`  |
| `Scope.HoneypotHttpsFeed`   | `HONEYPOT_HTTPS_FEED`   |
| `Scope.HoneypotHttpsStream` | `HONEYPOT_HTTPS_STREAM` |
| `Scope.HoneypotAdbFeed`     | `HONEYPOT_ADB_FEED`     |
| `Scope.HoneypotAdbStream`   | `HONEYPOT_ADB_STREAM`   |
| `Scope.HoneypotDnsFeed`     | `HONEYPOT_DNS_FEED`     |
| `Scope.HoneypotDnsStream`   | `HONEYPOT_DNS_STREAM`   |
| `Scope.Ja4Feed`             | `JA4_FEED`              |
| `Scope.Ja4Stream`           | `JA4_STREAM`            |
| `Scope.Ja4tFeed`            | `JA4T_FEED`             |
| `Scope.Ja4tStream`          | `JA4T_STREAM`           |
| `Scope.AdminProxies`        | `ADMIN_PROXIES`         |

### Relation

An account's role in its organization, used by `Organization.Relation`.

| Constant          | Value    |
| ----------------- | -------- |
| `Relation.Owner`  | `OWNER`  |
| `Relation.Admin`  | `ADMIN`  |
| `Relation.Member` | `MEMBER` |

### DomainStatus

Whether a domain has recent activity, used by `DomainInfo.Status`.

| Constant                | Value      | Meaning                                                                    |
| ----------------------- | ---------- | -------------------------------------------------------------------------- |
| `DomainStatus.Active`   | `active`   | The domain had events in the last 24 hours.                                |
| `DomainStatus.Inactive` | `inactive` | The domain had no events in the last 24 hours, or has never been observed. |

### Cadence

A sentence describing a domain's activity pattern, used by `ActivityStats.Cadence`.

| Constant                    | Value                                                |
| --------------------------- | ---------------------------------------------------- |
| `Cadence.NoActivity`        | `No activity in the last 30 days.`                   |
| `Cadence.EvenlyDistributed` | `Activity is evenly distributed across the day.`     |
| `Cadence.BusinessHours`     | `Activity follows a weekday business-hours pattern.` |
| `Cadence.Weekend`           | `Activity follows a weekend pattern.`                |
| `Cadence.BurstDriven`       | `Activity is burst-driven with significant peaks.`   |

### ExportKind

Whether an export covers an hour or a day, used by `Export.Kind` and `ExportMeta.Kind`.

| Constant            | Value    |
| ------------------- | -------- |
| `ExportKind.Hourly` | `hourly` |
| `ExportKind.Daily`  | `daily`  |

### ParquetType

The type of a Parquet column, used by `ParquetColumn.Type`. Open.

| Constant             | Value    |
| -------------------- | -------- |
| `ParquetType.String` | `string` |
| `ParquetType.Int64`  | `int64`  |
| `ParquetType.UInt32` | `uint32` |
| `ParquetType.UInt64` | `uint64` |
| `ParquetType.Bool`   | `bool`   |
| `ParquetType.Bytes`  | `bytes`  |