Types

The fields of every response and event type, and the enumerations they use.

Lookup types

Except for Timestamp, code outside the crate cannot build the SDK's structs with a struct literal: the types that hold API data are #[non_exhaustive], and the rest have private fields. The lookup, domain, account, export, and event types implement serde's Serialize and Deserialize with the API's field names, so values can be stored as JSON and read back.

IpInfo

The intelligence Synthient holds for an IP address. See the IP API for how each field is derived.

Name
ip
Type
IpAddr
Description
The address that was looked up.
Name
network
Type
Option<Network>
Description
The network that announces the address, or None if the API has no network data.
Name
location
Type
Option<Location>
Description
The geolocation of the address, or None if the API has no location data.
Name
intelligence
Type
Option<Intelligence>
Description
The risk score and the proxy, VPN, and device observations for the address, or None if the API has no intelligence data.

Network

The network that announces an address.

Name
asn
Type
u32
Description
The autonomous system number, or 0 if the address is not routed.
Name
isp
Type
String
Description
The name of the internet service provider.
Name
r#type
Type
NetworkType
Description
The kind of network, such as NetworkType::Residential. See Enumerations.
Name
org
Type
Option<String>
Description
The organization the address is registered to, or None if unknown.
Name
domain
Type
Option<String>
Description
The network operator's domain, or None if unknown.
Name
abuse_email
Type
Option<String>
Description
The operator's abuse contact email, or None if unknown.
Name
abuse_phone
Type
Option<String>
Description
The operator's abuse contact phone number, or None if unknown.

Location

The geolocation of an address.

Name
country
Type
String
Description
The ISO 3166-1 alpha-2 country code.
Name
state
Type
String
Description
The state or region.
Name
city
Type
String
Description
The city.
Name
timezone
Type
String
Description
The IANA time zone name.
Name
latitude
Type
f64
Description
The latitude in degrees.
Name
longitude
Type
f64
Description
The longitude in degrees.
Name
geo_hash
Type
String
Description
The geohash of the coordinates.

Intelligence

Synthient's assessment of an address. See Methodology for how it is built.

Name
risk_score
Type
u8
Description
The risk of the address, from 0 to 100.
Name
categories
Type
Vec<String>
Description
The kinds of services seen on the address, such as RESIDENTIAL_PROXY. New values may be added.
Name
behavior
Type
Vec<String>
Description
Behaviors observed from the address. New values may be added.
Name
providers
Type
Vec<Provider>
Description
The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.
Name
devices
Type
Vec<Device>
Description
The device types seen behind the address.

Provider

A proxy, VPN, or anonymizer service seen using an address.

Name
name
Type
String
Description
The service tag, such as BRIGHTDATA. The API names this field provider. See Service Tags.
Name
r#type
Type
String
Description
The service category, such as RESIDENTIAL_PROXY.
Name
last_seen
Type
Timestamp
Description
When the service was last seen using the address.

Device

A device type seen behind an address.

Name
os
Type
Os
Description
The operating system. See Enumerations.
Name
version
Type
String
Description
The operating system version.
Name
last_seen
Type
Timestamp
Description
When the device was last seen.

Domain types

DomainInfo

The honeypot traffic Synthient has observed for a domain.

Name
domain
Type
String
Description
The domain that was looked up.
Name
status
Type
DomainStatus
Description
Whether the domain had events in the last 24 hours.
Name
stats
Type
DomainStats
Description
Aggregate event counts.
Name
unique_ips
Type
UniqueIps
Description
Counts of the distinct source addresses.
Name
time_series
Type
Vec<TimeSeriesPoint>
Description
Daily event counts.
Name
top_asn
Type
Option<AsnCount>
Description
The network that sent the most events, or None when there are no events.
Name
top_subdomains
Type
Vec<SubdomainCount>
Description
The most targeted subdomains.
Name
top_ports
Type
Vec<PortCount>
Description
The most targeted ports.
Name
geo_distribution
Type
Vec<CountryCount>
Description
Event counts by source country.
Name
hour_dow_heatmap
Type
Vec<Vec<u64>>
Description
The last 30 days of events by UTC day of week and hour, indexed as hour_dow_heatmap[day][hour]. Day 0 is Monday.
Name
activity_stats
Type
ActivityStats
Description
The hourly activity pattern.
Name
recent_events
Type
Vec<DomainEvent>
Description
The most recent events, capped by the limit passed to lookup_domain.

DomainStats

Aggregate event counts for a domain.

Name
events_24h
Type
u64
Description
Events in the last 24 hours.
Name
total_events_30d
Type
u64
Description
Events in the last 30 days.

UniqueIps

The distinct source addresses seen for a domain.

Name
value_24h
Type
u64
Description
Distinct source addresses in the last 24 hours.
Name
value_30d
Type
u64
Description
Distinct source addresses in the last 30 days.
Name
sparkline_24h
Type
Vec<u64>
Description
Hourly counts for the last 24 hours.

TimeSeriesPoint

The event counts for one day.

Name
date
Type
Timestamp
Description
The start of the day.
Name
events
Type
u64
Description
Events that day.
Name
unique_ips
Type
u64
Description
The number of distinct source addresses that day.

AsnCount

Name
asn
Type
u32
Description
The autonomous system number.
Name
events
Type
u64
Description
Events from that network.

SubdomainCount

Name
subdomain
Type
String
Description
The targeted subdomain.
Name
count
Type
u64
Description
The number of events that targeted it.

PortCount

Name
port
Type
u16
Description
The targeted port.
Name
count
Type
u64
Description
The number of events that targeted it.

CountryCount

Name
country_code
Type
String
Description
The ISO 3166-1 alpha-2 country code.
Name
events
Type
u64
Description
Events from that country.
Name
unique_ips
Type
u64
Description
Distinct source addresses from that country.

ActivityStats

The hourly activity pattern of a domain.

Name
cadence
Type
Cadence
Description
How events are spread over the last 30 days. See Enumerations.
Name
median_per_hour
Type
u64
Description
The median number of events per hour.
Name
p95_per_hour
Type
u64
Description
The 95th percentile of events per hour.
Name
peak_hour
Type
u8
Description
The busiest UTC hour of the day.
Name
quiet_hour
Type
u8
Description
The quietest UTC hour of the day.

DomainEvent

A single honeypot event for a domain.

Name
timestamp
Type
Timestamp
Description
When the event happened.
Name
source_ip
Type
String
Description
The full proxy exit address that carried the event. The API names the field source_ip_masked, but the address is not masked.
Name
target_subdomain
Type
String
Description
The subdomain that was targeted.
Name
country_code
Type
String
Description
The source country.
Name
port
Type
u16
Description
The targeted port.

Account types

Account

The account that owns the API key.

Name
email
Type
String
Description
The account holder's email address.
Name
first_name
Type
String
Description
The account holder's first name.
Name
last_name
Type
String
Description
The account holder's last name.
Name
organization
Type
Organization
Description
The organization the account belongs to.
Name
scopes
Type
Vec<Scope>
Description
The permissions granted to the API key. See Enumerations.
Name
lookup_quota
Type
LookupQuota
Description
The remaining lookup credit balance.
Name
api_key
Type
Option<AccountApiKey>
Description
The API key used for the request, or None if the response omits it.

Organization

The organization an account belongs to.

Name
id
Type
String
Description
The organization's UUID.
Name
name
Type
String
Description
The organization's name.
Name
relation
Type
Relation
Description
The account's role in the organization. See Enumerations.

LookupQuota

An account's lookup credit balance.

Name
credits
Type
i64
Description
The number of lookup credits remaining.
Name
resets_in
Type
i64
Description
The number of seconds until the credits reset.

AccountApiKey

Name
id
Type
String
Description
The key's UUID. It is not the secret key itself.
Name
name
Type
String
Description
The key's display name.
Name
created_at
Type
String
Description
When the key was created, as an RFC 3339 timestamp. The SDK does not parse it.

Export types

ExportPage

One page of a feed's exports, newest first.

Name
stream
Type
String
Description
The feed's stream identifier, such as proxies.
Name
exports
Type
Vec<Export>
Description
The exports on this page. The API names this field feeds.
Name
next_cursor
Type
Option<String>
Description
The cursor of the next page, for list_exports or all_exports. It is None on the last page.

Export

A Parquet export of a feed.

Name
id
Type
String
Description
Identifies the export for export_meta, download, and download_url. On the first page, the newest hourly export may have the ID latest.
Name
kind
Type
ExportKind
Description
Whether the export covers an hour or a day.
Name
date
Type
String
Description
The UTC day of the export as YYYY-MM-DD.
Name
hour
Type
Option<u8>
Description
The UTC hour of an hourly export, or None for a daily export.
Name
size_bytes
Type
i64
Description
The size of the Parquet file in bytes.
Name
row_count
Type
i64
Description
The number of rows in the file.
Name
checksum
Type
String
Description
The hex-encoded SHA-256 of the Parquet file.
Name
created_at
Type
Timestamp
Description
When the export was produced.
Name
download_path
Type
String
Description
The API path of the export's download, including the version prefix.

ExportMeta

A Parquet export's metadata.

Name
id
Type
String
Description
Identifies the export.
Name
stream
Type
String
Description
The feed's stream identifier.
Name
kind
Type
ExportKind
Description
Whether the export covers an hour or a day.
Name
format
Type
String
Description
The file format, parquet.
Name
date
Type
Timestamp
Description
The start of the export's UTC day or hour.
Name
hour
Type
Option<u8>
Description
The UTC hour of an hourly export, or None for a daily export.
Name
rows
Type
i64
Description
The number of rows in the file.
Name
size
Type
i64
Description
The size of the Parquet file in bytes.
Name
checksum
Type
String
Description
The hex-encoded SHA-256 of the Parquet file.
Name
created_at
Type
Timestamp
Description
When the export was produced.
Name
schema
Type
ParquetSchema
Description
The Parquet columns.

ParquetSchema

Name
fields
Type
Vec<ParquetColumn>
Description
The columns in file order.

ParquetColumn

Name
name
Type
String
Description
The column name.
Name
r#type
Type
ParquetType
Description
The column type. See Enumerations.

Event types

Event fields have the same names as the wire fields in the Firehose and Helios documentation, with type spelled r#type. On ProxyEvent, AnonymizerEvent, TorrentEvent, Ja4tEvent, HeliosMeta, and HttpRequestDetails, the API may omit any field, so every field is an Option. Fields declared as Option are None when the API omits them.

ProxyEvent

A proxy sighting from the proxies feed.

Name
ip
Type
Option<String>
Description
The proxy exit address.
Name
provider
Type
Option<String>
Description
The proxy service tag.
Name
r#type
Type
Option<ProxyType>
Description
The proxy category. See Enumerations.
Name
country_code
Type
Option<String>
Description
The ISO 3166-1 alpha-2 country of the address.
Name
asn
Type
Option<u32>
Description
The autonomous system number of the address.
Name
timestamp
Type
Option<Timestamp>
Description
When the proxy was seen, in Unix seconds.

AnonymizerEvent

A VPN or anonymizer IP range from the anonymizers feed.

Name
range_start
Type
Option<String>
Description
The first address of the range.
Name
range_end
Type
Option<String>
Description
The last address of the range.
Name
provider
Type
Option<String>
Description
The service tag.
Name
r#type
Type
Option<ProxyType>
Description
The service category, such as ProxyType::CommercialVpn.
Name
country_code
Type
Option<String>
Description
The ISO 3166-1 alpha-2 country of range_start.
Name
asn
Type
Option<u32>
Description
The autonomous system number of range_start.
Name
timestamp
Type
Option<Timestamp>
Description
When the range was seen, in Unix milliseconds.

TorrentEvent

A torrent observed on the BitTorrent DHT or a tracker.

Name
info_hash
Type
Option<String>
Description
The hex-encoded SHA-1 info hash.
Name
name
Type
Option<String>
Description
The torrent name.
Name
magnet_uri
Type
Option<String>
Description
The torrent's magnet link.
Name
total_size
Type
Option<i64>
Description
The total size of the torrent's files in bytes.
Name
piece_length
Type
Option<i64>
Description
The piece size in bytes.
Name
file_count
Type
Option<i64>
Description
The number of files in the torrent.
Name
files
Type
Option<Vec<TorrentFile>>
Description
The torrent's files.
Name
peers
Type
Option<Vec<TorrentPeer>>
Description
The peers seen sharing the torrent.
Name
timestamp
Type
Option<Timestamp>
Description
When the torrent was seen, in Unix seconds.

TorrentFile

A file in a torrent.

Name
path
Type
Option<String>
Description
The file path within the torrent.
Name
length
Type
Option<i64>
Description
The file size in bytes.

TorrentPeer

A peer seen sharing a torrent.

Name
ip
Type
Option<String>
Description
The peer's address.
Name
port
Type
Option<u16>
Description
The peer's port.
Name
source
Type
Option<String>
Description
Where the peer was found, such as DHT, PEX, or tracker.
Name
encrypted
Type
Option<bool>
Description
Whether the peer supports encrypted connections.

Ja4tEvent

A JA4T TCP fingerprint sighting.

Name
ip
Type
Option<String>
Description
The address the fingerprint was seen from.
Name
ja4t
Type
Option<String>
Description
The JA4T fingerprint.
Name
provider
Type
Option<String>
Description
The service tag of the address.
Name
r#type
Type
Option<ProxyType>
Description
The service category, such as ProxyType::DatacenterProxy.
Name
country_code
Type
Option<String>
Description
The ISO 3166-1 alpha-2 country of the address.
Name
asn
Type
Option<u32>
Description
The autonomous system number of the address.
Name
timestamp
Type
Option<Timestamp>
Description
When the fingerprint was seen, in Unix seconds.

HeliosMeta

The Helios honeypot sensor that captured an event.

Name
proxy_ip
Type
Option<String>
Description
The proxy exit address the traffic arrived through.
Name
server
Type
Option<String>
Description
The sensor that captured the traffic.
Name
pool_id
Type
Option<String>
Description
The sensor pool.
Name
provider
Type
Option<String>
Description
The proxy service the traffic arrived through.

HeliosHttpEvent

An HTTP request captured by a Helios honeypot.

Name
timestamp
Type
Timestamp
Description
When the request was captured, in Unix milliseconds.
Name
tunnel_id
Type
u64
Description
The proxy tunnel the request arrived through. Live values use the full u64 range.
Name
domain
Type
String
Description
The host the tunnel was opened to.
Name
port
Type
u16
Description
The destination port.
Name
protocol
Type
String
Description
Always http.
Name
meta
Type
HeliosMeta
Description
The capturing sensor.
Name
details
Type
Option<HttpRequestDetails>
Description
The parsed request, or None if the API omits it.
Name
raw
Type
Option<Vec<u8>>
Description
The raw request bytes, decoded from the API's base64, or None if the API omits them. Invalid base64 fails the event with Error::Decode.

HttpRequestDetails

A parsed HTTP request. The API may omit any field.

Name
method
Type
Option<String>
Description
The request method.
Name
uri
Type
Option<String>
Description
The request target.
Name
version
Type
Option<String>
Description
The HTTP version, such as HTTP/1.1.
Name
headers
Type
Option<BTreeMap<String, String>>
Description
The request headers.

HeliosHttpsEvent

A TLS ClientHello captured by a Helios honeypot.

Name
timestamp
Type
Timestamp
Description
When the handshake was captured, in Unix milliseconds.
Name
tunnel_id
Type
u64
Description
The proxy tunnel the handshake arrived through. Live values use the full u64 range.
Name
domain
Type
String
Description
The host the tunnel was opened to.
Name
port
Type
u16
Description
The destination port.
Name
protocol
Type
String
Description
Always https.
Name
meta
Type
HeliosMeta
Description
The capturing sensor.
Name
details
Type
Option<TlsClientHello>
Description
The parsed ClientHello, or None if the sensor could not parse the handshake.
Name
raw
Type
Option<String>
Description
Always None, because the sensors do not capture handshake bytes.

TlsClientHello

A TLS ClientHello parsed by a Helios sensor. Fields the sensor could not parse are None.

Name
record_version
Type
Option<String>
Description
The record layer version, such as TLS 1.0.
Name
handshake_version
Type
Option<String>
Description
The ClientHello version, such as TLS 1.2.
Name
client_random
Type
Option<String>
Description
The hex-encoded 32-byte client random.
Name
session_id
Type
Option<String>
Description
The hex-encoded session ID.
Name
session_id_length
Type
Option<u8>
Description
The length of the session ID in bytes.
Name
cipher_suites
Type
Option<Vec<TlsCodeName>>
Description
The offered cipher suites.
Name
compression_methods
Type
Option<Vec<u8>>
Description
The offered compression methods.
Name
extensions
Type
Option<Vec<TlsExtension>>
Description
The extensions in wire order.
Name
sni
Type
Option<String>
Description
The server_name extension value.
Name
alpn
Type
Option<Vec<String>>
Description
The offered application protocols.
Name
supported_versions
Type
Option<Vec<String>>
Description
The offered TLS versions.
Name
supported_groups
Type
Option<Vec<TlsCodeName>>
Description
The offered key exchange groups.
Name
signature_algorithms
Type
Option<Vec<TlsCodeName>>
Description
The offered signature algorithms.
Name
ec_point_formats
Type
Option<Vec<String>>
Description
The offered elliptic curve point formats.
Name
key_share_groups
Type
Option<Vec<String>>
Description
The groups the client sent key shares for.
Name
psk_key_exchange_modes
Type
Option<Vec<String>>
Description
The offered pre-shared key exchange modes.
Name
compress_certificate
Type
Option<Vec<String>>
Description
The offered certificate compression algorithms.
Name
has_grease
Type
Option<bool>
Description
Whether the ClientHello contains GREASE values.
Name
application_settings
Type
Option<bool>
Description
Whether the client offered application settings (ALPS).
Name
delegated_credentials
Type
Option<bool>
Description
Whether the client offered delegated credentials.
Name
encrypt_then_mac
Type
Option<bool>
Description
Whether the client offered encrypt-then-MAC.
Name
extended_master_secret
Type
Option<bool>
Description
Whether the client offered the extended master secret.
Name
post_handshake_auth
Type
Option<bool>
Description
Whether the client offered post-handshake authentication.
Name
renegotiation_info
Type
Option<bool>
Description
Whether the client sent renegotiation info.
Name
signed_certificate_timestamps
Type
Option<bool>
Description
Whether the client requested signed certificate timestamps.
Name
status_request
Type
Option<bool>
Description
Whether the client requested OCSP stapling.

TlsCodeName

A TLS registry code point and its name. GREASE values are named GREASE(0x....).

Name
code
Type
Option<u16>
Description
The code point.
Name
name
Type
Option<String>
Description
The code point's registered name.

TlsExtension

An extension in a TLS ClientHello.

Name
code
Type
Option<u16>
Description
The extension type.
Name
name
Type
Option<String>
Description
The extension's registered name.
Name
length
Type
Option<u16>
Description
The extension body length in bytes.

HeliosDnsEvent

A destination that a Helios honeypot tunnel was asked to reach. Despite the feed's name, it is not a DNS query: names resolved inside a tunneled DNS session are not visible.

Name
timestamp
Type
Timestamp
Description
When the event was captured, in Unix milliseconds.
Name
tunnel_id
Type
u64
Description
The proxy tunnel. Live values use the full u64 range.
Name
domain
Type
String
Description
The host name or address literal the tunnel was opened to.
Name
port
Type
u16
Description
The destination port.
Name
protocol
Type
String
Description
Always dns.
Name
meta
Type
HeliosMeta
Description
The capturing sensor.

HeliosAdbEvent

An Android Debug Bridge shell command captured by a Helios honeypot. It has no timestamp because the sensor sends none.

Name
session
Type
String
Description
The ADB session as 32 hex characters.
Name
sequential_id
Type
u64
Description
The 1-based position of the command within its session.
Name
command
Type
String
Description
The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.
Name
hash
Type
String
Description
The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of command: every command in a session shares it, and sessions that replay the same script share it too.

Enumerations

Each value set is an enum with a variant per value the API documents, plus Unknown(String), which keeps any value this version of the SDK does not know so that new server values never break decoding.

Matching: The enums are #[non_exhaustive], so a match needs a wildcard arm.
Traits: They implement Clone, Eq, and Hash, and serialize as the API's string.

as_str returns the value as the API sends it, and Display writes the same string.

pub fn as_str(&self) -> &str

use std::net::IpAddr;

use synthient::NetworkType;

let ip: IpAddr = "8.8.8.8".parse()?;
let info = client.lookup_ip(ip).await?;
if let Some(network) = &info.network {
    match &network.r#type {
        NetworkType::Residential | NetworkType::Mobile => println!("consumer network"),
        NetworkType::Unknown(value) => println!("{value} is new to this SDK"),
        other => println!("{other}"),
    }
}

NetworkType

The kind of network that announces an address.

Variant	Value	Description
`Mobile`	`MOBILE`	A mobile carrier network.
`Satellite`	`SATELLITE`	A satellite network.
`InFlightWifi`	`IN_FLIGHT_WIFI`	An in-flight Wi-Fi network.
`Residential`	`RESIDENTIAL`	A residential broadband network.
`Corporate`	`CORPORATE`	A corporate network.
`Academic`	`ACADEMIC`	An academic network.
`Datacenter`	`DATACENTER`	A hosting or cloud network.
`Government`	`GOVERNMENT`	A government network.

ProxyType

The kind of service seen on an address.

Variant	Value	Description
`FreeVpn`	`FREE_VPN`	A free VPN.
`CommercialVpn`	`COMMERCIAL_VPN`	A commercial VPN.
`EnterpriseVpn`	`ENTERPRISE_VPN`	An enterprise VPN.
`MobileProxy`	`MOBILE_PROXY`	A mobile proxy.
`BlockchainProxy`	`BLOCKCHAIN_PROXY`	A blockchain-based proxy network.
`ResidentialProxy`	`RESIDENTIAL_PROXY`	A residential proxy.
`PublicProxy`	`PUBLIC_PROXY`	A public proxy.
`DatacenterProxy`	`DATACENTER_PROXY`	A datacenter proxy.
`TorNode`	`TOR_NODE`	A Tor node.
`PrivateRelay`	`PRIVATE_RELAY`	A private relay, such as iCloud Private Relay.
`Botnet`	`BOTNET`	A botnet.
`SearchEngine`	`SEARCH_ENGINE`	A search engine crawler.
`AiCrawler`	`AI_CRAWLER`	An AI crawler.
`SocialMedia`	`SOCIAL_MEDIA`	A social media crawler.
`UptimeMonitor`	`UPTIME_MONITOR`	An uptime monitor.
`LinkPreview`	`LINK_PREVIEW`	A link preview fetcher.
`SeoCrawler`	`SEO_CRAWLER`	An SEO crawler.
`WebArchiver`	`WEB_ARCHIVER`	A web archiver.
`WebhookProvider`	`WEBHOOK_PROVIDER`	A webhook provider.
`PaymentProcessor`	`PAYMENT_PROCESSOR`	A payment processor.
`InternetScanner`	`INTERNET_SCANNER`	An internet scanner.

Os

A device operating system.

Variant	Value
`Android`	`Android`
`ChromeOs`	`Chrome OS`
`FreeBsd`	`FreeBSD`
`Ios`	`iOS`
`Linux`	`Linux`
`MacOsX`	`Mac OS X`
`Windows`	`Windows`

Scope

A permission granted to an API key. Basic authorizes lookups and account. Each feed has one scope for its exports and one for its stream, as listed under Feeds. See Authentication for how scopes are granted.

Variant	Value	Description
`Basic`	`BASIC`	Lookups and account details.
`ProxyFeeds`	`PROXY_FEEDS`	Proxy feed exports.
`ProxyFirehose`	`PROXY_FIREHOSE`	The proxy feed stream.
`AnonymizersFeed`	`ANONYMIZERS_FEED`	Anonymizer feed exports.
`AnonymizersStream`	`ANONYMIZERS_STREAM`	The anonymizer feed stream.
`Ja3Feed`	`JA3_FEED`	JA3 feed exports.
`Ja3Stream`	`JA3_STREAM`	The JA3 feed stream.
`TorrentsFeed`	`TORRENTS_FEED`	Torrent feed exports.
`TorrentsStream`	`TORRENTS_STREAM`	The torrent feed stream.
`HoneypotHttpFeed`	`HONEYPOT_HTTP_FEED`	Helios HTTP feed exports.
`HoneypotHttpStream`	`HONEYPOT_HTTP_STREAM`	The Helios HTTP feed stream.
`HoneypotHttpsFeed`	`HONEYPOT_HTTPS_FEED`	Helios HTTPS feed exports.
`HoneypotHttpsStream`	`HONEYPOT_HTTPS_STREAM`	The Helios HTTPS feed stream.
`HoneypotAdbFeed`	`HONEYPOT_ADB_FEED`	Helios ADB feed exports.
`HoneypotAdbStream`	`HONEYPOT_ADB_STREAM`	The Helios ADB feed stream.
`HoneypotDnsFeed`	`HONEYPOT_DNS_FEED`	Helios DNS feed exports.
`HoneypotDnsStream`	`HONEYPOT_DNS_STREAM`	The Helios DNS feed stream.
`Ja4Feed`	`JA4_FEED`	JA4 feed exports.
`Ja4Stream`	`JA4_STREAM`	The JA4 feed stream.
`Ja4tFeed`	`JA4T_FEED`	JA4T feed exports.
`Ja4tStream`	`JA4T_STREAM`	The JA4T feed stream.
`AdminProxies`	`ADMIN_PROXIES`	Internal proxy administration.

Relation

An account's role in its organization.

Variant	Value	Description
`Owner`	`OWNER`	The organization's owner.
`Admin`	`ADMIN`	An administrator.
`Member`	`MEMBER`	A member.

DomainStatus

Whether a domain has recent activity.

Variant	Value	Description
`Active`	`active`	The domain had events in the last 24 hours.
`Inactive`	`inactive`	The domain had no events in the last 24 hours, or has never been observed.

Cadence

How a domain's events are spread over time. The API sends each value as an English sentence.

Variant	Value
`NoActivity`	`No activity in the last 30 days.`
`EvenlyDistributed`	`Activity is evenly distributed across the day.`
`BusinessHours`	`Activity follows a weekday business-hours pattern.`
`Weekend`	`Activity follows a weekend pattern.`
`BurstDriven`	`Activity is burst-driven with significant peaks.`

ExportKind

Whether an export covers an hour or a day.

Variant	Value	Description
`Hourly`	`hourly`	One UTC hour.
`Daily`	`daily`	One UTC day.

ParquetType

The type of a Parquet column.

Variant	Value	Description
`String`	`string`	A UTF-8 string.
`Int64`	`int64`	A signed 64-bit integer.
`Uint32`	`uint32`	An unsigned 32-bit integer.
`Uint64`	`uint64`	An unsigned 64-bit integer.
`Bool`	`bool`	A boolean.
`Bytes`	`bytes`	A byte array.

Timestamps

A Unix time exactly as the API encodes it, in the public field 0.

pub struct Timestamp(pub i64);

Units: It is in seconds, except on anonymizer and Helios HTTP, HTTPS, and DNS stream events, where it is in milliseconds.
Construction: Unlike the model types, it can be built directly, as in Timestamp(1_700_000_000).

to_system_time converts either unit to a std::time::SystemTime, which converts into the time types of crates such as chrono, time, and jiff.

pub fn to_system_time(self) -> Option<SystemTime>

let page = client.proxies().list_exports(Some(5), None).await?;
for export in &page.exports {
    if let Some(created) = export.created_at.to_system_time() {
        println!("{} was created {:?} ago", export.id, created.elapsed()?);
    }
}

Units: Values of 1e12 or more are read as milliseconds.
Results: It returns None if the time is out of the platform's range.
Zero value: Timestamp(0) converts to the Unix epoch.