Types

The fields of every response and event type, and the enumerations they use.

Lookup types

Model and event classes are final readonly classes with public promoted properties, built only by the SDK in normal use. Property names are the camelCase form of the API's field names except where noted. Every timestamp is a DateTimeImmutable in UTC.

IpInfo

The result of an IP lookup. See the IP API for how each field is derived.

Name
ip
Type
string
Description
The address that was looked up, in canonical form.
Name
network
Type
?Network
Description
The network the address belongs to, or null if the API has no network data.
Name
location
Type
?Location
Description
Where the address is located, or null if the API has no location data.
Name
intelligence
Type
?Intelligence
Description
What Synthient has observed about the address, or null if the API has no intelligence data.

Network

The network an address belongs to.

Name
asn
Type
int
Description
The autonomous system number, or 0 if the address is not routed.
Name
isp
Type
string
Description
The internet service provider that operates the network.
Name
type
Type
string
Description
The kind of network, such as NetworkType::RESIDENTIAL. See Enumerations.
Name
org
Type
?string
Description
The organization the address is registered to, or null if unknown.
Name
domain
Type
?string
Description
The network operator's domain, or null if unknown.
Name
abuseEmail
Type
?string
Description
The operator's abuse contact email, or null if unknown.
Name
abusePhone
Type
?string
Description
The operator's abuse contact phone number, or null if unknown.

Location

Where an address is located.

Name
country
Type
string
Description
The ISO 3166-1 alpha-2 country code.
Name
state
Type
string
Description
The state or region.
Name
city
Type
string
Description
The city.
Name
timezone
Type
string
Description
The IANA time zone name.
Name
latitude
Type
float
Description
The latitude in degrees.
Name
longitude
Type
float
Description
The longitude in degrees.
Name
geoHash
Type
string
Description
The geohash of the coordinates.

Intelligence

What Synthient has observed about an address. See Methodology for how it is built.

Name
riskScore
Type
int
Description
The risk of the address, from 0 (no risk) to 100.
Name
categories
Type
list<string>
Description
The kinds of services seen on the address, such as "RESIDENTIAL_PROXY". The API may add values.
Name
behavior
Type
list<string>
Description
Behaviors observed from the address.
Name
providers
Type
list<Provider>
Description
The proxy and VPN providers seen using the address.
Name
devices
Type
list<Device>
Description
The devices seen behind the address.

Provider

A proxy or VPN provider seen using an address.

Name
name
Type
string
Description
The provider's service tag. The API names this field provider. See Service Tags.
Name
type
Type
string
Description
The service category.
Name
lastSeen
Type
DateTimeImmutable
Description
When the provider was last seen on the address.

Device

A device seen behind an address.

Name
os
Type
string
Description
The operating system, such as OperatingSystem::ANDROID. See Enumerations.
Name
version
Type
string
Description
The operating system version.
Name
lastSeen
Type
DateTimeImmutable
Description
When the device was last seen.

Domain types

DomainInfo

The result of a domain lookup, covering the last 30 days. A domain that was never observed is inactive with zeroed stats.

Name
domain
Type
string
Description
The domain that was looked up.
Name
status
Type
string
Description
DomainStatus::ACTIVE when the domain had events in the last 24 hours, otherwise DomainStatus::INACTIVE.
Name
stats
Type
DomainStats
Description
Aggregate event counts.
Name
uniqueIps
Type
UniqueIps
Description
Counts of the distinct source addresses.
Name
timeSeries
Type
list<TimeSeriesPoint>
Description
Daily event counts.
Name
topSubdomains
Type
list<SubdomainCount>
Description
The most targeted subdomains.
Name
topPorts
Type
list<PortCount>
Description
The most targeted ports.
Name
geoDistribution
Type
list<CountryCount>
Description
Event counts by source country.
Name
hourDowHeatmap
Type
list<list<int>>
Description
Event counts as 7 rows of 24 hours, Monday first, in UTC, indexed as $hourDowHeatmap[$day][$hour].
Name
activityStats
Type
ActivityStats
Description
The hourly activity pattern.
Name
recentEvents
Type
list<DomainEvent>
Description
The most recent events, capped by the limit argument of lookupDomain().
Name
topAsn
Type
?AsnCount
Description
The network that sent the most events, or null when the domain has no events.

DomainStats

Event counts for a domain.

Name
events24h
Type
int
Description
Events in the last 24 hours.
Name
totalEvents30d
Type
int
Description
Events in the last 30 days.

UniqueIps

Distinct source addresses seen for a domain.

Name
value24h
Type
int
Description
Distinct source addresses in the last 24 hours.
Name
value30d
Type
int
Description
Distinct source addresses in the last 30 days.
Name
sparkline24h
Type
list<int>
Description
Hourly counts over the last 24 hours.

TimeSeriesPoint

One day of a domain's activity.

Name
date
Type
DateTimeImmutable
Description
The start of the day, in UTC.
Name
events
Type
int
Description
Events that day.
Name
uniqueIps
Type
int
Description
The number of distinct source addresses that day.

AsnCount

Events from one autonomous system.

Name
asn
Type
int
Description
The autonomous system number.
Name
events
Type
int
Description
Events from that network.

SubdomainCount

Events for one subdomain.

Name
subdomain
Type
string
Description
The subdomain.
Name
count
Type
int
Description
The number of events that targeted it.

PortCount

Events on one port.

Name
port
Type
int
Description
The port.
Name
count
Type
int
Description
The number of events that targeted it.

CountryCount

Activity from one country.

Name
countryCode
Type
string
Description
The source country code.
Name
events
Type
int
Description
Events from that country.
Name
uniqueIps
Type
int
Description
Distinct source addresses from that country.

ActivityStats

Patterns in a domain's hourly activity, in UTC.

Name
cadence
Type
string
Description
A sentence describing the pattern over the last 30 days. See Enumerations.
Name
medianPerHour
Type
int
Description
The median number of events per hour.
Name
p95PerHour
Type
int
Description
The 95th percentile of events per hour.
Name
peakHour
Type
int
Description
The busiest hour, 0 to 23.
Name
quietHour
Type
int
Description
The quietest hour, 0 to 23.

DomainEvent

A recent event for a domain.

Name
timestamp
Type
DateTimeImmutable
Description
When the event happened.
Name
sourceIp
Type
string
Description
The proxy exit address that carried the event. The API names the field source_ip_masked, but the address is not masked.
Name
targetSubdomain
Type
string
Description
The subdomain that was targeted.
Name
port
Type
int
Description
The destination port.
Name
countryCode
Type
string
Description
The source country.

Account types

Account

The account that owns the API key, from Client::account().

Name
email
Type
string
Description
The account's email address.
Name
firstName
Type
string
Description
The account holder's first name.
Name
lastName
Type
string
Description
The account holder's last name.
Name
organization
Type
Organization
Description
The organization the account belongs to.
Name
scopes
Type
list<string>
Description
The permissions granted to the key. See Scope under Enumerations.
Name
lookupQuota
Type
LookupQuota
Description
The team's remaining lookup credits.
Name
apiKey
Type
?AccountApiKey
Description
The key that made the request, or null if the API omits it.

Organization

The organization an account belongs to.

Name
id
Type
string
Description
The organization's ID.
Name
name
Type
string
Description
The organization's name.
Name
relation
Type
string
Description
The account's role in the organization. See Enumerations.

LookupQuota

The team's remaining lookup credits.

Name
credits
Type
int
Description
The number of lookup credits remaining.
Name
resetsIn
Type
int
Description
Seconds until the credits reset.

AccountApiKey

The API key that made a request. It never includes the secret.

Name
id
Type
string
Description
Identifies the key.
Name
name
Type
string
Description
The key's display name.
Name
createdAt
Type
DateTimeImmutable
Description
When the key was created.

Export types

ExportPage

One page of a feed's exports, newest first.

Name
stream
Type
string
Description
The feed's stream identifier.
Name
exports
Type
list<Export>
Description
The exports on this page. The API names this field feeds.
Name
nextCursor
Type
?string
Description
The cursor for the next page, passed as the cursor argument of listExports(). It is null or empty on the last page.

Export

A Parquet snapshot of a feed.

Name
id
Type
string
Description
Identifies the export for exportMeta(), downloadUrl(), and download(). On the first page, latest means the newest hourly export.
Name
kind
Type
string
Description
ExportKind::HOURLY or ExportKind::DAILY.
Name
date
Type
string
Description
The snapshot date as YYYY-MM-DD, in UTC.
Name
sizeBytes
Type
int
Description
The size of the Parquet file in bytes.
Name
rowCount
Type
int
Description
The number of rows in the file.
Name
checksum
Type
string
Description
The hex-encoded SHA-256 of the file.
Name
createdAt
Type
DateTimeImmutable
Description
When the export was created.
Name
downloadPath
Type
string
Description
The API path of the export's download.
Name
hour
Type
?int
Description
The hour of an hourly export, or null for a daily export.

ExportMeta

Details of one export, including its Parquet schema.

Name
id
Type
string
Description
The export ID.
Name
stream
Type
string
Description
The feed's stream identifier.
Name
kind
Type
string
Description
ExportKind::HOURLY or ExportKind::DAILY.
Name
format
Type
string
Description
Always "parquet".
Name
date
Type
DateTimeImmutable
Description
The start of the day or hour the export covers.
Name
rows
Type
int
Description
The number of rows in the file.
Name
size
Type
int
Description
The size of the Parquet file in bytes.
Name
checksum
Type
string
Description
The hex-encoded SHA-256 of the file.
Name
createdAt
Type
DateTimeImmutable
Description
When the export was created.
Name
schema
Type
ParquetSchema
Description
The Parquet columns.
Name
hour
Type
?int
Description
The hour of an hourly export, or null for a daily export.

ParquetSchema

The columns of a Parquet export.

Name
fields
Type
list<ParquetColumn>
Description
The columns.

ParquetColumn

A column of a Parquet export.

Name
name
Type
string
Description
The column name.
Name
type
Type
string
Description
The column type. See Enumerations.

Event types

Stream events are decoded into the classes below.

Units: Timestamps are DateTimeImmutable in UTC whatever unit the feed sends: integers of 1e12 or more are read as milliseconds, and smaller ones as seconds.
Missing fields: On the proxies, anonymizers, torrents, and JA4T feeds every property is nullable and is null when the API omits it. Helios events require their core properties, so an event missing one throws SynthientException and ends the stream.

ProxyEvent

A proxy sighting from the proxies feed.

Name
ip
Type
?string
Description
The proxy exit address.
Name
provider
Type
?string
Description
The proxy service tag.
Name
type
Type
?string
Description
The service category. See Enumerations.
Name
countryCode
Type
?string
Description
The ISO 3166-1 alpha-2 country of the address.
Name
asn
Type
?int
Description
The autonomous system number of the address.
Name
timestamp
Type
?DateTimeImmutable
Description
When the proxy was seen.

AnonymizerEvent

A VPN or anonymizer IP range from the anonymizers feed.

Name
rangeStart
Type
?string
Description
The first address of the range.
Name
rangeEnd
Type
?string
Description
The last address of the range.
Name
provider
Type
?string
Description
The service tag.
Name
type
Type
?string
Description
The service category, such as ProxyType::COMMERCIAL_VPN.
Name
countryCode
Type
?string
Description
The ISO 3166-1 alpha-2 country of rangeStart.
Name
asn
Type
?int
Description
The autonomous system number of rangeStart.
Name
timestamp
Type
?DateTimeImmutable
Description
When the range was seen.

TorrentEvent

A torrent from the torrents feed.

Name
infoHash
Type
?string
Description
The hex-encoded SHA-1 info hash.
Name
name
Type
?string
Description
The torrent's name.
Name
magnetUri
Type
?string
Description
The torrent's magnet link.
Name
totalSize
Type
?int
Description
The total size of the torrent's files in bytes.
Name
pieceLength
Type
?int
Description
The piece size in bytes.
Name
fileCount
Type
?int
Description
The number of files in the torrent.
Name
files
Type
list<TorrentFile>|null
Description
The files in the torrent.
Name
peers
Type
list<TorrentPeer>|null
Description
The peers seen sharing the torrent.
Name
timestamp
Type
?DateTimeImmutable
Description
When the torrent was seen.

TorrentFile

A file in a torrent.

Name
path
Type
?string
Description
The file path within the torrent.
Name
length
Type
?int
Description
The file size in bytes.

TorrentPeer

A peer sharing a torrent.

Name
ip
Type
?string
Description
The peer's address.
Name
port
Type
?int
Description
The peer's port.
Name
source
Type
?string
Description
Where the peer was found: "DHT", "PEX", or "tracker".
Name
encrypted
Type
?bool
Description
Whether the peer supports encrypted connections.

Ja4tEvent

A JA4T TCP fingerprint sighting from the ja4t feed.

Name
ip
Type
?string
Description
The address the fingerprint was seen from.
Name
ja4t
Type
?string
Description
The JA4T fingerprint.
Name
provider
Type
?string
Description
The service tag of the address.
Name
type
Type
?string
Description
The service category, such as ProxyType::DATACENTER_PROXY.
Name
countryCode
Type
?string
Description
The ISO 3166-1 alpha-2 country of the address.
Name
asn
Type
?int
Description
The autonomous system number of the address.
Name
timestamp
Type
?DateTimeImmutable
Description
When the fingerprint was seen.

HeliosMeta

Where a Helios honeypot capture came from.

Name
proxyIp
Type
?string
Description
The proxy address the traffic arrived from.
Name
server
Type
?string
Description
The sensor that captured the traffic.
Name
poolId
Type
?string
Description
The sensor pool.
Name
provider
Type
?string
Description
The proxy service the traffic arrived through.

HeliosHttpEvent

An HTTP request captured by a Helios honeypot.

Name
timestamp
Type
DateTimeImmutable
Description
When the request was captured.
Name
tunnelId
Type
string
Description
Identifies the proxy tunnel the request arrived through. It is a uint64 as a decimal string, because it can exceed PHP_INT_MAX.
Name
domain
Type
string
Description
The host the tunnel was opened to.
Name
port
Type
int
Description
The destination port.
Name
protocol
Type
string
Description
Always "http".
Name
meta
Type
HeliosMeta
Description
The capturing sensor.
Name
details
Type
?HttpRequestDetails
Description
The parsed request, or null if the API omits it.
Name
raw
Type
?string
Description
The raw request, still base64-encoded. Decode it with base64_decode().

HttpRequestDetails

The parsed request line and headers of a captured HTTP request.

Name
method
Type
?string
Description
The request method.
Name
uri
Type
?string
Description
The request target.
Name
version
Type
?string
Description
The HTTP version, such as "HTTP/1.1".
Name
headers
Type
array<array-key, string>|null
Description
The request headers by name. PHP stores a numeric name such as "123" as an int key.

HeliosHttpsEvent

A TLS handshake captured by a Helios honeypot.

Name
timestamp
Type
DateTimeImmutable
Description
When the handshake was captured.
Name
tunnelId
Type
string
Description
Identifies the proxy tunnel the handshake arrived through. It is a uint64 as a decimal string, because it can exceed PHP_INT_MAX.
Name
domain
Type
string
Description
The host the tunnel was opened to.
Name
port
Type
int
Description
The destination port.
Name
protocol
Type
string
Description
Always "https".
Name
meta
Type
HeliosMeta
Description
The capturing sensor.
Name
details
Type
?TlsClientHello
Description
The parsed ClientHello, or null when the sensor could not parse the handshake.
Name
raw
Type
?string
Description
Always null, because the sensors do not capture handshake bytes.

TlsClientHello

A parsed TLS ClientHello. Fields the sensor could not parse are null.

Name
recordVersion
Type
?string
Description
The record layer version, such as "TLS 1.0".
Name
handshakeVersion
Type
?string
Description
The ClientHello version, such as "TLS 1.2".
Name
clientRandom
Type
?string
Description
The hex-encoded 32-byte client random.
Name
sessionId
Type
?string
Description
The hex-encoded session ID.
Name
sessionIdLength
Type
?int
Description
The length of the session ID in bytes.
Name
cipherSuites
Type
list<TlsCodeName>|null
Description
The offered cipher suites.
Name
compressionMethods
Type
list<int>|null
Description
The offered compression methods.
Name
extensions
Type
list<TlsExtension>|null
Description
The extensions in wire order.
Name
sni
Type
?string
Description
The server_name extension value.
Name
alpn
Type
list<string>|null
Description
The offered application protocols.
Name
supportedVersions
Type
list<string>|null
Description
The offered TLS versions.
Name
supportedGroups
Type
list<TlsCodeName>|null
Description
The offered key exchange groups.
Name
signatureAlgorithms
Type
list<TlsCodeName>|null
Description
The offered signature algorithms.
Name
ecPointFormats
Type
list<string>|null
Description
The offered elliptic curve point formats.
Name
keyShareGroups
Type
list<string>|null
Description
The groups the client sent key shares for.
Name
pskKeyExchangeModes
Type
list<string>|null
Description
The offered pre-shared key exchange modes.
Name
compressCertificate
Type
list<string>|null
Description
The offered certificate compression algorithms.
Name
hasGrease
Type
?bool
Description
Whether the ClientHello contains GREASE values.
Name
applicationSettings
Type
?bool
Description
Whether the client offered application settings (ALPS).
Name
delegatedCredentials
Type
?bool
Description
Whether the client offered the delegated_credentials extension.
Name
encryptThenMac
Type
?bool
Description
Whether the client offered the encrypt_then_mac extension.
Name
extendedMasterSecret
Type
?bool
Description
Whether the client offered the extended_master_secret extension.
Name
postHandshakeAuth
Type
?bool
Description
Whether the client offered the post_handshake_auth extension.
Name
renegotiationInfo
Type
?bool
Description
Whether the client offered the renegotiation_info extension.
Name
signedCertificateTimestamps
Type
?bool
Description
Whether the client offered the signed_certificate_timestamp extension.
Name
statusRequest
Type
?bool
Description
Whether the client requested OCSP stapling.

TlsCodeName

A TLS code point and its name. GREASE values are named GREASE(0x....).

Name
code
Type
?int
Description
The code point.
Name
name
Type
?string
Description
The code point's registered name.

TlsExtension

A TLS extension in a ClientHello.

Name
code
Type
?int
Description
The extension type.
Name
name
Type
?string
Description
The extension's registered name.
Name
length
Type
?int
Description
The extension body length in bytes.

HeliosDnsEvent

A tunnel destination captured by a Helios honeypot. Despite the feed's name, these are destinations, not DNS queries.

Name
timestamp
Type
DateTimeImmutable
Description
When the event was captured.
Name
tunnelId
Type
string
Description
Identifies the proxy tunnel. It is a uint64 as a decimal string, because it can exceed PHP_INT_MAX.
Name
domain
Type
string
Description
The host the tunnel was opened to.
Name
port
Type
int
Description
The destination port.
Name
protocol
Type
string
Description
Always "dns".
Name
meta
Type
HeliosMeta
Description
The capturing sensor.

HeliosAdbEvent

A shell command captured by a Helios Android Debug Bridge honeypot. It has no timestamp because the sensor sends none.

Name
session
Type
string
Description
Identifies the ADB session as 32 hex characters.
Name
sequentialId
Type
int
Description
The 1-based position of the command within its session.
Name
command
Type
string
Description
The shell command as text. Invalid UTF-8 bytes become U+FFFD.
Name
hash
Type
string
Description
The hex-encoded SHA-256 of the session's payload. It is not a hash of command: every command in a session shares it.

Enumerations

Each value set is a final class of string constants in Synthient\Enum, not a native PHP enum, and the properties that hold these values are typed string. Compare them with === or match. The API may add values to the sets marked open, so handle unknown values instead of assuming a closed match.

use Synthient\Enum\NetworkType;

$info = $client->lookupIp('8.8.8.8');
echo match ($info->network?->type) {
    NetworkType::RESIDENTIAL, NetworkType::MOBILE => 'consumer',
    NetworkType::DATACENTER => 'hosting',
    default => 'other',
}, "\n";

NetworkType

The kind of network an address belongs to. Open.

Constant	Value
`NetworkType::MOBILE`	`MOBILE`
`NetworkType::SATELLITE`	`SATELLITE`
`NetworkType::IN_FLIGHT_WIFI`	`IN_FLIGHT_WIFI`
`NetworkType::RESIDENTIAL`	`RESIDENTIAL`
`NetworkType::CORPORATE`	`CORPORATE`
`NetworkType::ACADEMIC`	`ACADEMIC`
`NetworkType::DATACENTER`	`DATACENTER`
`NetworkType::GOVERNMENT`	`GOVERNMENT`

ProxyType

The kind of proxy, VPN, or automated service behind an address in a feed. Open.

Constant	Value
`ProxyType::FREE_VPN`	`FREE_VPN`
`ProxyType::COMMERCIAL_VPN`	`COMMERCIAL_VPN`
`ProxyType::ENTERPRISE_VPN`	`ENTERPRISE_VPN`
`ProxyType::MOBILE_PROXY`	`MOBILE_PROXY`
`ProxyType::BLOCKCHAIN_PROXY`	`BLOCKCHAIN_PROXY`
`ProxyType::RESIDENTIAL_PROXY`	`RESIDENTIAL_PROXY`
`ProxyType::PUBLIC_PROXY`	`PUBLIC_PROXY`
`ProxyType::DATACENTER_PROXY`	`DATACENTER_PROXY`
`ProxyType::TOR_NODE`	`TOR_NODE`
`ProxyType::PRIVATE_RELAY`	`PRIVATE_RELAY`
`ProxyType::BOTNET`	`BOTNET`
`ProxyType::SEARCH_ENGINE`	`SEARCH_ENGINE`
`ProxyType::AI_CRAWLER`	`AI_CRAWLER`
`ProxyType::SOCIAL_MEDIA`	`SOCIAL_MEDIA`
`ProxyType::UPTIME_MONITOR`	`UPTIME_MONITOR`
`ProxyType::LINK_PREVIEW`	`LINK_PREVIEW`
`ProxyType::SEO_CRAWLER`	`SEO_CRAWLER`
`ProxyType::WEB_ARCHIVER`	`WEB_ARCHIVER`
`ProxyType::WEBHOOK_PROVIDER`	`WEBHOOK_PROVIDER`
`ProxyType::PAYMENT_PROCESSOR`	`PAYMENT_PROCESSOR`
`ProxyType::INTERNET_SCANNER`	`INTERNET_SCANNER`

OperatingSystem

The operating system of a device seen behind an address. Open.

Constant	Value
`OperatingSystem::ANDROID`	`Android`
`OperatingSystem::CHROME_OS`	`Chrome OS`
`OperatingSystem::FREEBSD`	`FreeBSD`
`OperatingSystem::IOS`	`iOS`
`OperatingSystem::LINUX`	`Linux`
`OperatingSystem::MAC_OS_X`	`Mac OS X`
`OperatingSystem::WINDOWS`	`Windows`

Scope

A permission granted to an API key. Open. Scope::BASIC authorizes lookups and account details. Each feed has one scope for its exports and one for its stream, as listed under Feeds. See Authentication for how scopes are granted.

Constant	Value
`Scope::BASIC`	`BASIC`
`Scope::PROXY_FEEDS`	`PROXY_FEEDS`
`Scope::PROXY_FIREHOSE`	`PROXY_FIREHOSE`
`Scope::ANONYMIZERS_FEED`	`ANONYMIZERS_FEED`
`Scope::ANONYMIZERS_STREAM`	`ANONYMIZERS_STREAM`
`Scope::JA3_FEED`	`JA3_FEED`
`Scope::JA3_STREAM`	`JA3_STREAM`
`Scope::TORRENTS_FEED`	`TORRENTS_FEED`
`Scope::TORRENTS_STREAM`	`TORRENTS_STREAM`
`Scope::HONEYPOT_HTTP_FEED`	`HONEYPOT_HTTP_FEED`
`Scope::HONEYPOT_HTTP_STREAM`	`HONEYPOT_HTTP_STREAM`
`Scope::HONEYPOT_HTTPS_FEED`	`HONEYPOT_HTTPS_FEED`
`Scope::HONEYPOT_HTTPS_STREAM`	`HONEYPOT_HTTPS_STREAM`
`Scope::HONEYPOT_ADB_FEED`	`HONEYPOT_ADB_FEED`
`Scope::HONEYPOT_ADB_STREAM`	`HONEYPOT_ADB_STREAM`
`Scope::HONEYPOT_DNS_FEED`	`HONEYPOT_DNS_FEED`
`Scope::HONEYPOT_DNS_STREAM`	`HONEYPOT_DNS_STREAM`
`Scope::JA4_FEED`	`JA4_FEED`
`Scope::JA4_STREAM`	`JA4_STREAM`
`Scope::JA4T_FEED`	`JA4T_FEED`
`Scope::JA4T_STREAM`	`JA4T_STREAM`
`Scope::ADMIN_PROXIES`	`ADMIN_PROXIES`

Relation

An account's role in its organization.

Constant	Value
`Relation::OWNER`	`OWNER`
`Relation::ADMIN`	`ADMIN`
`Relation::MEMBER`	`MEMBER`

DomainStatus

Whether a domain had events in the last 24 hours.

Constant	Value	Meaning
`DomainStatus::ACTIVE`	`active`	The domain had events in the last 24 hours.
`DomainStatus::INACTIVE`	`inactive`	The domain had no events in the last 24 hours, or has never been observed.

Cadence

The activity pattern of a domain over the last 30 days, as a sentence.

Constant	Value
`Cadence::NO_ACTIVITY`	`No activity in the last 30 days.`
`Cadence::EVENLY_DISTRIBUTED`	`Activity is evenly distributed across the day.`
`Cadence::BUSINESS_HOURS`	`Activity follows a weekday business-hours pattern.`
`Cadence::WEEKEND`	`Activity follows a weekend pattern.`
`Cadence::BURST_DRIVEN`	`Activity is burst-driven with significant peaks.`

ExportKind

Whether an export covers an hour or a day.

Constant	Value
`ExportKind::HOURLY`	`hourly`
`ExportKind::DAILY`	`daily`

ParquetType

The type of a column in a Parquet export. Open.

Constant	Value
`ParquetType::STRING`	`string`
`ParquetType::INT64`	`int64`
`ParquetType::UINT32`	`uint32`
`ParquetType::UINT64`	`uint64`
`ParquetType::BOOL`	`bool`
`ParquetType::BYTES`	`bytes`