# Types

The fields of every response and event type, and the enumerations they use.

## Lookup types

Except for `Timestamp`, code outside the crate cannot build the SDK's structs with a struct literal: the types that hold API data are `#[non_exhaustive]`, and the rest have private fields. The lookup, domain, account, export, and event types implement serde's `Serialize` and `Deserialize` with the API's field names, so values can be stored as JSON and read back.

### IpInfo

The intelligence Synthient holds for an IP address. See the [IP API](https://docs.synthient.com/ipapi) for how each field is derived.

- `ip` `IpAddr` — The address that was looked up.
- `network` `Option<Network>` — The network that announces the address, or `None` if the API has no network data.
- `location` `Option<Location>` — The geolocation of the address, or `None` if the API has no location data.
- `intelligence` `Option<Intelligence>` — The risk score and the proxy, VPN, and device observations for the address, or `None` if the API has no intelligence data.

### Network

The network that announces an address.

- `asn` `u32` — The autonomous system number, or `0` if the address is not routed.
- `isp` `String` — The name of the internet service provider.
- `r#type` `NetworkType` — The kind of network, such as `NetworkType::Residential`. See [Enumerations](#enumerations).
- `org` `Option<String>` — The organization the address is registered to, or `None` if unknown.
- `domain` `Option<String>` — The network operator's domain, or `None` if unknown.
- `abuse_email` `Option<String>` — The operator's abuse contact email, or `None` if unknown.
- `abuse_phone` `Option<String>` — The operator's abuse contact phone number, or `None` if unknown.

### Location

The geolocation of an address.

- `country` `String` — The ISO 3166-1 alpha-2 country code.
- `state` `String` — The state or region.
- `city` `String` — The city.
- `timezone` `String` — The IANA time zone name.
- `latitude` `f64` — The latitude in degrees.
- `longitude` `f64` — The longitude in degrees.
- `geo_hash` `String` — The geohash of the coordinates.

### Intelligence

Synthient's assessment of an address. See [Methodology](https://docs.synthient.com/methodology) for how it is built.

- `risk_score` `u8` — The risk of the address, from 0 to 100.
- `categories` `Vec<String>` — The kinds of services seen on the address, such as `RESIDENTIAL_PROXY`. New values may be added.
- `behavior` `Vec<String>` — Behaviors observed from the address. New values may be added.
- `providers` `Vec<Provider>` — The proxy, VPN, and anonymizer services seen using the address. An empty list does not mean the address is clean.
- `devices` `Vec<Device>` — The device types seen behind the address.

### Provider

A proxy, VPN, or anonymizer service seen using an address.

- `name` `String` — The service tag, such as `BRIGHTDATA`. The API names this field `provider`. See [Service Tags](https://docs.synthient.com/service-tags).
- `r#type` `String` — The service category, such as `RESIDENTIAL_PROXY`.
- `last_seen` `Timestamp` — When the service was last seen using the address.

### Device

A device type seen behind an address.

- `os` `Os` — The operating system. See [Enumerations](#enumerations).
- `version` `String` — The operating system version.
- `last_seen` `Timestamp` — When the device was last seen.

## Domain types

### DomainInfo

The honeypot traffic Synthient has observed for a domain.

- `domain` `String` — The domain that was looked up.
- `status` `DomainStatus` — Whether the domain had events in the last 24 hours.
- `stats` `DomainStats` — Aggregate event counts.
- `unique_ips` `UniqueIps` — Counts of the distinct source addresses.
- `time_series` `Vec<TimeSeriesPoint>` — Daily event counts.
- `top_asn` `Option<AsnCount>` — The network that sent the most events, or `None` when there are no events.
- `top_subdomains` `Vec<SubdomainCount>` — The most targeted subdomains.
- `top_ports` `Vec<PortCount>` — The most targeted ports.
- `geo_distribution` `Vec<CountryCount>` — Event counts by source country.
- `hour_dow_heatmap` `Vec<Vec<u64>>` — The last 30 days of events by UTC day of week and hour, indexed as `hour_dow_heatmap[day][hour]`. Day 0 is Monday.
- `activity_stats` `ActivityStats` — The hourly activity pattern.
- `recent_events` `Vec<DomainEvent>` — The most recent events, capped by the `limit` passed to `lookup_domain`.

### DomainStats

Aggregate event counts for a domain.

- `events_24h` `u64` — Events in the last 24 hours.
- `total_events_30d` `u64` — Events in the last 30 days.

### UniqueIps

The distinct source addresses seen for a domain.

- `value_24h` `u64` — Distinct source addresses in the last 24 hours.
- `value_30d` `u64` — Distinct source addresses in the last 30 days.
- `sparkline_24h` `Vec<u64>` — Hourly counts for the last 24 hours.

### TimeSeriesPoint

The event counts for one day.

- `date` `Timestamp` — The start of the day.
- `events` `u64` — Events that day.
- `unique_ips` `u64` — The number of distinct source addresses that day.

### AsnCount

- `asn` `u32` — The autonomous system number.
- `events` `u64` — Events from that network.

### SubdomainCount

- `subdomain` `String` — The targeted subdomain.
- `count` `u64` — The number of events that targeted it.

### PortCount

- `port` `u16` — The targeted port.
- `count` `u64` — The number of events that targeted it.

### CountryCount

- `country_code` `String` — The ISO 3166-1 alpha-2 country code.
- `events` `u64` — Events from that country.
- `unique_ips` `u64` — Distinct source addresses from that country.

### ActivityStats

The hourly activity pattern of a domain.

- `cadence` `Cadence` — How events are spread over the last 30 days. See [Enumerations](#enumerations).
- `median_per_hour` `u64` — The median number of events per hour.
- `p95_per_hour` `u64` — The 95th percentile of events per hour.
- `peak_hour` `u8` — The busiest UTC hour of the day.
- `quiet_hour` `u8` — The quietest UTC hour of the day.

### DomainEvent

A single honeypot event for a domain.

- `timestamp` `Timestamp` — When the event happened.
- `source_ip` `String` — The full proxy exit address that carried the event. The API names the field `source_ip_masked`, but the address is not masked.
- `target_subdomain` `String` — The subdomain that was targeted.
- `country_code` `String` — The source country.
- `port` `u16` — The targeted port.

## Account types

### Account

The account that owns the API key.

- `email` `String` — The account holder's email address.
- `first_name` `String` — The account holder's first name.
- `last_name` `String` — The account holder's last name.
- `organization` `Organization` — The organization the account belongs to.
- `scopes` `Vec<Scope>` — The permissions granted to the API key. See [Enumerations](#enumerations).
- `lookup_quota` `LookupQuota` — The remaining lookup credit balance.
- `api_key` `Option<AccountApiKey>` — The API key used for the request, or `None` if the response omits it.

### Organization

The organization an account belongs to.

- `id` `String` — The organization's UUID.
- `name` `String` — The organization's name.
- `relation` `Relation` — The account's role in the organization. See [Enumerations](#enumerations).

### LookupQuota

An account's lookup credit balance.

- `credits` `i64` — The number of lookup credits remaining.
- `resets_in` `i64` — The number of seconds until the credits reset.

### AccountApiKey

- `id` `String` — The key's UUID. It is not the secret key itself.
- `name` `String` — The key's display name.
- `created_at` `String` — When the key was created, as an RFC 3339 timestamp. The SDK does not parse it.

## Export types

### ExportPage

One page of a feed's exports, newest first.

- `stream` `String` — The feed's stream identifier, such as `proxies`.
- `exports` `Vec<Export>` — The exports on this page. The API names this field `feeds`.
- `next_cursor` `Option<String>` — The cursor of the next page, for `list_exports` or `all_exports`. It is `None` on the last page.

### Export

A Parquet export of a feed.

- `id` `String` — Identifies the export for `export_meta`, `download`, and `download_url`. On the first page, the newest hourly export may have the ID `latest`.
- `kind` `ExportKind` — Whether the export covers an hour or a day.
- `date` `String` — The UTC day of the export as `YYYY-MM-DD`.
- `hour` `Option<u8>` — The UTC hour of an hourly export, or `None` for a daily export.
- `size_bytes` `i64` — The size of the Parquet file in bytes.
- `row_count` `i64` — The number of rows in the file.
- `checksum` `String` — The hex-encoded SHA-256 of the Parquet file.
- `created_at` `Timestamp` — When the export was produced.
- `download_path` `String` — The API path of the export's download, including the version prefix.

### ExportMeta

A Parquet export's metadata.

- `id` `String` — Identifies the export.
- `stream` `String` — The feed's stream identifier.
- `kind` `ExportKind` — Whether the export covers an hour or a day.
- `format` `String` — The file format, `parquet`.
- `date` `Timestamp` — The start of the export's UTC day or hour.
- `hour` `Option<u8>` — The UTC hour of an hourly export, or `None` for a daily export.
- `rows` `i64` — The number of rows in the file.
- `size` `i64` — The size of the Parquet file in bytes.
- `checksum` `String` — The hex-encoded SHA-256 of the Parquet file.
- `created_at` `Timestamp` — When the export was produced.
- `schema` `ParquetSchema` — The Parquet columns.

### ParquetSchema

- `fields` `Vec<ParquetColumn>` — The columns in file order.

### ParquetColumn

- `name` `String` — The column name.
- `r#type` `ParquetType` — The column type. See [Enumerations](#enumerations).

## Event types

Event fields have the same names as the wire fields in the [Firehose](https://docs.synthient.com/enterprise/firehose) and [Helios](https://docs.synthient.com/enterprise/helios) documentation, with `type` spelled `r#type`. On `ProxyEvent`, `AnonymizerEvent`, `TorrentEvent`, `Ja4tEvent`, `HeliosMeta`, and `HttpRequestDetails`, the API may omit any field, so every field is an `Option`. Fields declared as `Option` are `None` when the API omits them.

### ProxyEvent

A proxy sighting from the `proxies` feed.

- `ip` `Option<String>` — The proxy exit address.
- `provider` `Option<String>` — The proxy service tag.
- `r#type` `Option<ProxyType>` — The proxy category. See [Enumerations](#enumerations).
- `country_code` `Option<String>` — The ISO 3166-1 alpha-2 country of the address.
- `asn` `Option<u32>` — The autonomous system number of the address.
- `timestamp` `Option<Timestamp>` — When the proxy was seen, in Unix seconds.

### AnonymizerEvent

A VPN or anonymizer IP range from the `anonymizers` feed.

- `range_start` `Option<String>` — The first address of the range.
- `range_end` `Option<String>` — The last address of the range.
- `provider` `Option<String>` — The service tag.
- `r#type` `Option<ProxyType>` — The service category, such as `ProxyType::CommercialVpn`.
- `country_code` `Option<String>` — The ISO 3166-1 alpha-2 country of `range_start`.
- `asn` `Option<u32>` — The autonomous system number of `range_start`.
- `timestamp` `Option<Timestamp>` — When the range was seen, in Unix milliseconds.

### TorrentEvent

A torrent observed on the BitTorrent DHT or a tracker.

- `info_hash` `Option<String>` — The hex-encoded SHA-1 info hash.
- `name` `Option<String>` — The torrent name.
- `magnet_uri` `Option<String>` — The torrent's magnet link.
- `total_size` `Option<i64>` — The total size of the torrent's files in bytes.
- `piece_length` `Option<i64>` — The piece size in bytes.
- `file_count` `Option<i64>` — The number of files in the torrent.
- `files` `Option<Vec<TorrentFile>>` — The torrent's files.
- `peers` `Option<Vec<TorrentPeer>>` — The peers seen sharing the torrent.
- `timestamp` `Option<Timestamp>` — When the torrent was seen, in Unix seconds.

### TorrentFile

A file in a torrent.

- `path` `Option<String>` — The file path within the torrent.
- `length` `Option<i64>` — The file size in bytes.

### TorrentPeer

A peer seen sharing a torrent.

- `ip` `Option<String>` — The peer's address.
- `port` `Option<u16>` — The peer's port.
- `source` `Option<String>` — Where the peer was found, such as `DHT`, `PEX`, or `tracker`.
- `encrypted` `Option<bool>` — Whether the peer supports encrypted connections.

### Ja4tEvent

A JA4T TCP fingerprint sighting.

- `ip` `Option<String>` — The address the fingerprint was seen from.
- `ja4t` `Option<String>` — The JA4T fingerprint.
- `provider` `Option<String>` — The service tag of the address.
- `r#type` `Option<ProxyType>` — The service category, such as `ProxyType::DatacenterProxy`.
- `country_code` `Option<String>` — The ISO 3166-1 alpha-2 country of the address.
- `asn` `Option<u32>` — The autonomous system number of the address.
- `timestamp` `Option<Timestamp>` — When the fingerprint was seen, in Unix seconds.

### HeliosMeta

The Helios honeypot sensor that captured an event.

- `proxy_ip` `Option<String>` — The proxy exit address the traffic arrived through.
- `server` `Option<String>` — The sensor that captured the traffic.
- `pool_id` `Option<String>` — The sensor pool.
- `provider` `Option<String>` — The proxy service the traffic arrived through.

### HeliosHttpEvent

An HTTP request captured by a Helios honeypot.

- `timestamp` `Timestamp` — When the request was captured, in Unix milliseconds.
- `tunnel_id` `u64` — The proxy tunnel the request arrived through. Live values use the full `u64` range.
- `domain` `String` — The host the tunnel was opened to.
- `port` `u16` — The destination port.
- `protocol` `String` — Always `http`.
- `meta` `HeliosMeta` — The capturing sensor.
- `details` `Option<HttpRequestDetails>` — The parsed request, or `None` if the API omits it.
- `raw` `Option<Vec<u8>>` — The raw request bytes, decoded from the API's base64, or `None` if the API omits them. Invalid base64 fails the event with `Error::Decode`.

### HttpRequestDetails

A parsed HTTP request. The API may omit any field.

- `method` `Option<String>` — The request method.
- `uri` `Option<String>` — The request target.
- `version` `Option<String>` — The HTTP version, such as `HTTP/1.1`.
- `headers` `Option<BTreeMap<String, String>>` — The request headers.

### HeliosHttpsEvent

A TLS ClientHello captured by a Helios honeypot.

- `timestamp` `Timestamp` — When the handshake was captured, in Unix milliseconds.
- `tunnel_id` `u64` — The proxy tunnel the handshake arrived through. Live values use the full `u64` range.
- `domain` `String` — The host the tunnel was opened to.
- `port` `u16` — The destination port.
- `protocol` `String` — Always `https`.
- `meta` `HeliosMeta` — The capturing sensor.
- `details` `Option<TlsClientHello>` — The parsed ClientHello, or `None` if the sensor could not parse the handshake.
- `raw` `Option<String>` — Always `None`, because the sensors do not capture handshake bytes.

### TlsClientHello

A TLS ClientHello parsed by a Helios sensor. Fields the sensor could not parse are `None`.

- `record_version` `Option<String>` — The record layer version, such as `TLS 1.0`.
- `handshake_version` `Option<String>` — The ClientHello version, such as `TLS 1.2`.
- `client_random` `Option<String>` — The hex-encoded 32-byte client random.
- `session_id` `Option<String>` — The hex-encoded session ID.
- `session_id_length` `Option<u8>` — The length of the session ID in bytes.
- `cipher_suites` `Option<Vec<TlsCodeName>>` — The offered cipher suites.
- `compression_methods` `Option<Vec<u8>>` — The offered compression methods.
- `extensions` `Option<Vec<TlsExtension>>` — The extensions in wire order.
- `sni` `Option<String>` — The `server_name` extension value.
- `alpn` `Option<Vec<String>>` — The offered application protocols.
- `supported_versions` `Option<Vec<String>>` — The offered TLS versions.
- `supported_groups` `Option<Vec<TlsCodeName>>` — The offered key exchange groups.
- `signature_algorithms` `Option<Vec<TlsCodeName>>` — The offered signature algorithms.
- `ec_point_formats` `Option<Vec<String>>` — The offered elliptic curve point formats.
- `key_share_groups` `Option<Vec<String>>` — The groups the client sent key shares for.
- `psk_key_exchange_modes` `Option<Vec<String>>` — The offered pre-shared key exchange modes.
- `compress_certificate` `Option<Vec<String>>` — The offered certificate compression algorithms.
- `has_grease` `Option<bool>` — Whether the ClientHello contains GREASE values.
- `application_settings` `Option<bool>` — Whether the client offered application settings (ALPS).
- `delegated_credentials` `Option<bool>` — Whether the client offered delegated credentials.
- `encrypt_then_mac` `Option<bool>` — Whether the client offered encrypt-then-MAC.
- `extended_master_secret` `Option<bool>` — Whether the client offered the extended master secret.
- `post_handshake_auth` `Option<bool>` — Whether the client offered post-handshake authentication.
- `renegotiation_info` `Option<bool>` — Whether the client sent renegotiation info.
- `signed_certificate_timestamps` `Option<bool>` — Whether the client requested signed certificate timestamps.
- `status_request` `Option<bool>` — Whether the client requested OCSP stapling.

### TlsCodeName

A TLS registry code point and its name. GREASE values are named `GREASE(0x....)`.

- `code` `Option<u16>` — The code point.
- `name` `Option<String>` — The code point's registered name.

### TlsExtension

An extension in a TLS ClientHello.

- `code` `Option<u16>` — The extension type.
- `name` `Option<String>` — The extension's registered name.
- `length` `Option<u16>` — The extension body length in bytes.

### HeliosDnsEvent

A destination that a Helios honeypot tunnel was asked to reach. Despite the feed's name, it is not a DNS query: names resolved inside a tunneled DNS session are not visible.

- `timestamp` `Timestamp` — When the event was captured, in Unix milliseconds.
- `tunnel_id` `u64` — The proxy tunnel. Live values use the full `u64` range.
- `domain` `String` — The host name or address literal the tunnel was opened to.
- `port` `u16` — The destination port.
- `protocol` `String` — Always `dns`.
- `meta` `HeliosMeta` — The capturing sensor.

### HeliosAdbEvent

An Android Debug Bridge shell command captured by a Helios honeypot. It has no timestamp because the sensor sends none.

- `session` `String` — The ADB session as 32 hex characters.
- `sequential_id` `u64` — The 1-based position of the command within its session.
- `command` `String` — The shell command. Invalid UTF-8 bytes are replaced with U+FFFD.
- `hash` `String` — The hex-encoded SHA-256 the sensor assigns to the session's payload. It is not a hash of `command`: every command in a session shares it, and sessions that replay the same script share it too.

## Enumerations

Each value set is an enum with a variant per value the API documents, plus `Unknown(String)`, which keeps any value this version of the SDK does not know so that new server values never break decoding.

- **Matching:** The enums are `#[non_exhaustive]`, so a `match` needs a wildcard arm.
- **Traits:** They implement `Clone`, `Eq`, and `Hash`, and serialize as the API's string.

`as_str` returns the value as the API sends it, and `Display` writes the same string.

```rust
pub fn as_str(&self) -> &str
```

```rust
use std::net::IpAddr;

use synthient::NetworkType;

let ip: IpAddr = "8.8.8.8".parse()?;
let info = client.lookup_ip(ip).await?;
if let Some(network) = &info.network {
    match &network.r#type {
        NetworkType::Residential | NetworkType::Mobile => println!("consumer network"),
        NetworkType::Unknown(value) => println!("{value} is new to this SDK"),
        other => println!("{other}"),
    }
}
```

### NetworkType

The kind of network that announces an address.

| Variant        | Value            | Description                      |
| -------------- | ---------------- | -------------------------------- |
| `Mobile`       | `MOBILE`         | A mobile carrier network.        |
| `Satellite`    | `SATELLITE`      | A satellite network.             |
| `InFlightWifi` | `IN_FLIGHT_WIFI` | An in-flight Wi-Fi network.      |
| `Residential`  | `RESIDENTIAL`    | A residential broadband network. |
| `Corporate`    | `CORPORATE`      | A corporate network.             |
| `Academic`     | `ACADEMIC`       | An academic network.             |
| `Datacenter`   | `DATACENTER`     | A hosting or cloud network.      |
| `Government`   | `GOVERNMENT`     | A government network.            |

### ProxyType

The kind of service seen on an address.

| Variant            | Value               | Description                                    |
| ------------------ | ------------------- | ---------------------------------------------- |
| `FreeVpn`          | `FREE_VPN`          | A free VPN.                                    |
| `CommercialVpn`    | `COMMERCIAL_VPN`    | A commercial VPN.                              |
| `EnterpriseVpn`    | `ENTERPRISE_VPN`    | An enterprise VPN.                             |
| `MobileProxy`      | `MOBILE_PROXY`      | A mobile proxy.                                |
| `BlockchainProxy`  | `BLOCKCHAIN_PROXY`  | A blockchain-based proxy network.              |
| `ResidentialProxy` | `RESIDENTIAL_PROXY` | A residential proxy.                           |
| `PublicProxy`      | `PUBLIC_PROXY`      | A public proxy.                                |
| `DatacenterProxy`  | `DATACENTER_PROXY`  | A datacenter proxy.                            |
| `TorNode`          | `TOR_NODE`          | A Tor node.                                    |
| `PrivateRelay`     | `PRIVATE_RELAY`     | A private relay, such as iCloud Private Relay. |
| `Botnet`           | `BOTNET`            | A botnet.                                      |
| `SearchEngine`     | `SEARCH_ENGINE`     | A search engine crawler.                       |
| `AiCrawler`        | `AI_CRAWLER`        | An AI crawler.                                 |
| `SocialMedia`      | `SOCIAL_MEDIA`      | A social media crawler.                        |
| `UptimeMonitor`    | `UPTIME_MONITOR`    | An uptime monitor.                             |
| `LinkPreview`      | `LINK_PREVIEW`      | A link preview fetcher.                        |
| `SeoCrawler`       | `SEO_CRAWLER`       | An SEO crawler.                                |
| `WebArchiver`      | `WEB_ARCHIVER`      | A web archiver.                                |
| `WebhookProvider`  | `WEBHOOK_PROVIDER`  | A webhook provider.                            |
| `PaymentProcessor` | `PAYMENT_PROCESSOR` | A payment processor.                           |
| `InternetScanner`  | `INTERNET_SCANNER`  | An internet scanner.                           |

### Os

A device operating system.

| Variant    | Value       |
| ---------- | ----------- |
| `Android`  | `Android`   |
| `ChromeOs` | `Chrome OS` |
| `FreeBsd`  | `FreeBSD`   |
| `Ios`      | `iOS`       |
| `Linux`    | `Linux`     |
| `MacOsX`   | `Mac OS X`  |
| `Windows`  | `Windows`   |

### Scope

A permission granted to an API key. `Basic` authorizes lookups and `account`. Each feed has one scope for its exports and one for its stream, as listed under [Feeds](https://docs.synthient.com/sdks/rust/feeds). See [Authentication](https://docs.synthient.com/authentication) for how scopes are granted.

| Variant               | Value                   | Description                    |
| --------------------- | ----------------------- | ------------------------------ |
| `Basic`               | `BASIC`                 | Lookups and account details.   |
| `ProxyFeeds`          | `PROXY_FEEDS`           | Proxy feed exports.            |
| `ProxyFirehose`       | `PROXY_FIREHOSE`        | The proxy feed stream.         |
| `AnonymizersFeed`     | `ANONYMIZERS_FEED`      | Anonymizer feed exports.       |
| `AnonymizersStream`   | `ANONYMIZERS_STREAM`    | The anonymizer feed stream.    |
| `Ja3Feed`             | `JA3_FEED`              | JA3 feed exports.              |
| `Ja3Stream`           | `JA3_STREAM`            | The JA3 feed stream.           |
| `TorrentsFeed`        | `TORRENTS_FEED`         | Torrent feed exports.          |
| `TorrentsStream`      | `TORRENTS_STREAM`       | The torrent feed stream.       |
| `HoneypotHttpFeed`    | `HONEYPOT_HTTP_FEED`    | Helios HTTP feed exports.      |
| `HoneypotHttpStream`  | `HONEYPOT_HTTP_STREAM`  | The Helios HTTP feed stream.   |
| `HoneypotHttpsFeed`   | `HONEYPOT_HTTPS_FEED`   | Helios HTTPS feed exports.     |
| `HoneypotHttpsStream` | `HONEYPOT_HTTPS_STREAM` | The Helios HTTPS feed stream.  |
| `HoneypotAdbFeed`     | `HONEYPOT_ADB_FEED`     | Helios ADB feed exports.       |
| `HoneypotAdbStream`   | `HONEYPOT_ADB_STREAM`   | The Helios ADB feed stream.    |
| `HoneypotDnsFeed`     | `HONEYPOT_DNS_FEED`     | Helios DNS feed exports.       |
| `HoneypotDnsStream`   | `HONEYPOT_DNS_STREAM`   | The Helios DNS feed stream.    |
| `Ja4Feed`             | `JA4_FEED`              | JA4 feed exports.              |
| `Ja4Stream`           | `JA4_STREAM`            | The JA4 feed stream.           |
| `Ja4tFeed`            | `JA4T_FEED`             | JA4T feed exports.             |
| `Ja4tStream`          | `JA4T_STREAM`           | The JA4T feed stream.          |
| `AdminProxies`        | `ADMIN_PROXIES`         | Internal proxy administration. |

### Relation

An account's role in its organization.

| Variant  | Value    | Description               |
| -------- | -------- | ------------------------- |
| `Owner`  | `OWNER`  | The organization's owner. |
| `Admin`  | `ADMIN`  | An administrator.         |
| `Member` | `MEMBER` | A member.                 |

### DomainStatus

Whether a domain has recent activity.

| Variant    | Value      | Description                                                                |
| ---------- | ---------- | -------------------------------------------------------------------------- |
| `Active`   | `active`   | The domain had events in the last 24 hours.                                |
| `Inactive` | `inactive` | The domain had no events in the last 24 hours, or has never been observed. |

### Cadence

How a domain's events are spread over time. The API sends each value as an English sentence.

| Variant             | Value                                                |
| ------------------- | ---------------------------------------------------- |
| `NoActivity`        | `No activity in the last 30 days.`                   |
| `EvenlyDistributed` | `Activity is evenly distributed across the day.`     |
| `BusinessHours`     | `Activity follows a weekday business-hours pattern.` |
| `Weekend`           | `Activity follows a weekend pattern.`                |
| `BurstDriven`       | `Activity is burst-driven with significant peaks.`   |

### ExportKind

Whether an export covers an hour or a day.

| Variant  | Value    | Description   |
| -------- | -------- | ------------- |
| `Hourly` | `hourly` | One UTC hour. |
| `Daily`  | `daily`  | One UTC day.  |

### ParquetType

The type of a Parquet column.

| Variant  | Value    | Description                 |
| -------- | -------- | --------------------------- |
| `String` | `string` | A UTF-8 string.             |
| `Int64`  | `int64`  | A signed 64-bit integer.    |
| `Uint32` | `uint32` | An unsigned 32-bit integer. |
| `Uint64` | `uint64` | An unsigned 64-bit integer. |
| `Bool`   | `bool`   | A boolean.                  |
| `Bytes`  | `bytes`  | A byte array.               |

## Timestamps

A Unix time exactly as the API encodes it, in the public field `0`.

```rust
pub struct Timestamp(pub i64);
```

- **Units:** It is in seconds, except on anonymizer and Helios HTTP, HTTPS, and DNS stream events, where it is in milliseconds.
- **Construction:** Unlike the model types, it can be built directly, as in `Timestamp(1_700_000_000)`.

`to_system_time` converts either unit to a `std::time::SystemTime`, which converts into the time types of crates such as `chrono`, `time`, and `jiff`.

```rust
pub fn to_system_time(self) -> Option<SystemTime>
```

```rust
let page = client.proxies().list_exports(Some(5), None).await?;
for export in &page.exports {
    if let Some(created) = export.created_at.to_system_time() {
        println!("{} was created {:?} ago", export.id, created.elapsed()?);
    }
}
```

- **Units:** Values of `1e12` or more are read as milliseconds.
- **Results:** It returns `None` if the time is out of the platform's range.
- **Zero value:** `Timestamp(0)` converts to the Unix epoch.