---
updatedAt: 2026-04-29T22:56:06.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# GNQL V3 Recall Stats

Get the number of unique IPs that match a GNQL query
per hour/day over a given time range.


# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.",
    "version": "3.0.0",
    "title": "GreyNoise API",
    "contact": {
      "email": "hello@greynoise.io"
    },
    "license": {
      "name": "Proprietary",
      "url": "https://www.greynoise.io/terms"
    }
  },
  "tags": [
    {
      "name": "Recall",
      "description": "Endpoint that are used for retrieving GNQL data over time. Allows users\nto view hourly snapshots of IP activity for IPs that return for any\nGNQL query.\n"
    }
  ],
  "security": [
    {
      "APIKeyHeaderAuth": []
    }
  ],
  "paths": {
    "/v3/gnql/timeseries/stats": {
      "get": {
        "tags": [
          "Recall"
        ],
        "summary": "GNQL V3 Recall Stats",
        "operationId": "gnqlTimeSeriesStats",
        "description": "Get the number of unique IPs that match a GNQL query\nper hour/day over a given time range.\n",
        "parameters": [
          {
            "$ref": "#/components/parameters/query"
          },
          {
            "in": "query",
            "name": "start",
            "description": "Start date for the desired time range",
            "required": false,
            "schema": {
              "type": "string",
              "format": "date-time"
            },
            "example": "2025-01-01T00:00:00Z"
          },
          {
            "in": "query",
            "name": "end",
            "description": "End date for the desired time range",
            "required": false,
            "schema": {
              "type": "string",
              "format": "date-time"
            },
            "example": "2025-01-07T23:59:59Z"
          },
          {
            "in": "query",
            "name": "format",
            "description": "Specifies the desired format of the results. Must be either csv or json.",
            "required": false,
            "schema": {
              "type": "string",
              "enum": [
                "csv",
                "json"
              ],
              "default": "json"
            }
          },
          {
            "in": "query",
            "name": "interval",
            "description": "Specifies the time interval over which to aggregate unique IPs that return the given GNQL query.",
            "required": true,
            "schema": {
              "type": "string",
              "enum": [
                "hour",
                "day"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Query successful.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TimeSeriesStatsResponse"
                }
              }
            }
          },
          "206": {
            "description": "Partial content - request partially successful.\nDue to plan limitations, your request only returned a subset of\nfields and/or data. Contact sales@greynoise.io to upgrade your\nplan and unlock full results.\n",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TimeSeriesStatsResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "429": {
            "$ref": "#/components/responses/ExceededLimit"
          }
        }
      }
    }
  },
  "servers": [
    {
      "url": "https://api.greynoise.io"
    },
    {
      "url": "http://api.greynoise.io"
    }
  ],
  "components": {
    "securitySchemes": {
      "APIKeyHeaderAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "key"
      }
    },
    "responses": {
      "BadRequest": {
        "description": "Bad request - request syntax is invalid for the specified endpoint.\nVerify request syntax and try again.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Invalid parameter"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Unauthorized. Please check your API key.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Unauthorized"
            }
          }
        }
      },
      "ExceededLimit": {
        "description": "Too many requests. You've hit the rate-limit.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "You've hit the rate limit for this endpoint."
            }
          }
        }
      }
    },
    "parameters": {
      "query": {
        "name": "query",
        "in": "query",
        "description": "GNQL query string",
        "required": true,
        "schema": {
          "type": "string"
        }
      }
    },
    "schemas": {
      "ErrorMessage": {
        "type": "object",
        "properties": {
          "message": {
            "type": "string"
          }
        },
        "required": [
          "message"
        ]
      },
      "TimeSeriesStatsResponse": {
        "type": "object",
        "description": "Response object for the timeseries stats/aggregation endpoint.\nThis provides aggregated IP counts over time intervals matching\na GNQL query.\n",
        "properties": {
          "count": {
            "type": "integer",
            "description": "The sum of all IP counts across all time intervals",
            "example": 1500
          },
          "min": {
            "type": "integer",
            "description": "The minimum IP count observed in any single time interval",
            "example": 10
          },
          "max": {
            "type": "integer",
            "description": "The maximum IP count observed in any single time interval",
            "example": 250
          },
          "data": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/TimeSeriesStatsRecord"
            },
            "description": "Array of aggregated data points, one per time interval"
          }
        },
        "example": {
          "count": 1500,
          "min": 10,
          "max": 250,
          "data": [
            {
              "date": "2025-11-10 14:00:00.000",
              "count": 125
            },
            {
              "date": "2025-11-10 15:00:00.000",
              "count": 250
            },
            {
              "date": "2025-11-10 16:00:00.000",
              "count": 180
            }
          ]
        }
      },
      "TimeSeriesStatsRecord": {
        "type": "object",
        "description": "A single aggregated data point in a timeseries stats response",
        "properties": {
          "date": {
            "type": "string",
            "description": "The starting timestamp for this time interval in format\n'YYYY-MM-DD HH:mm:ss.SSS'.\nFor hourly intervals, the time component represents the hour.\nFor daily intervals, the time will be 00:00:00.000.\n",
            "example": "2025-11-10 14:00:00.000"
          },
          "count": {
            "type": "integer",
            "description": "The number of unique IPs matching the query in this time\ninterval\n",
            "example": 125
          }
        }
      }
    }
  }
}
```