RUM reference

Full request and response schemas are in the API Reference, and the browser SDK is in the SDK reference.

RUM application

Field	Type	Default	Description
name	string	required	Application name. 1 to 255 characters.
domain	string	none	Site domain, used by dashboard deep links.
allowed_origins	string[]	[]	Pages that may send data, up to 100; empty allows all. See allowed origins.
replay_monthly_target	int or null	null	Monthly replays Auto sampling aims this application at. 1 to 100,000,000.
settings.privacy.level	strict, balanced, relaxed or null	balanced for new applications	See privacy levels. Null (Custom) applies the flags below as stored.
settings.privacy.mask_inputs	bool	true	Mask input values in replay recordings. Under a level, written from the level. Read the stored value rather than trusting this default; see privacy settings.
settings.privacy.mask_text	bool	false	Mask all user-visible text in replay recordings. While off, page text is recorded unless the level is Strict.
settings.privacy.hide_action_text	bool	false	Store clicks with their selector only, without a name. See hiding element text in click names.
settings.privacy.pii_patterns	string[]	all three for new applications	email, card, digits9: what is scrubbed from text. Written from the level.
settings.privacy.mask_selectors, unmask_selectors, block_selectors, ignore_input_selectors	string[]	[]	Replay masking, blocking and input-ignoring CSS selectors, up to 50 each. unmask_selectors applies under Strict only.
settings.privacy.never_record_urls	string[]	[]	URL patterns where the SDK pauses replay and drops Analyze detail.
settings.privacy.require_consent, honor_gpc, cookieless, capture_user_email	bool	false, true for new applications, false, true	Consent and identity handling, applied by the SDK; capture_user_email is also applied at ingest.
settings.retention.observe_days	int or null	null	Keep this application’s page views and Web Vitals at most this many days. null keeps your plan’s full window. Can only shorten it; minimum 1.
settings.retention.analyze_days	int or null	null	Keep this application’s detail events at most this many days. null keeps your plan’s full window. Can only shorten it; minimum 1.
settings.retention.session_replay_days	7, 14, 30 or null	null	Shorter replay retention. Saving it queues cleanup; it does not confirm completion. See shorten retention.
settings.resource_exclusions	string[]	[]	Resource URLs never recorded as resource events. Up to 50 rules; see excluded resources.
settings.frustration_ignore_selectors	string[]	[]	CSS selectors whose clicks never count as rage or dead clicks. Up to 50 valid CSS selectors, each 1 to 256 printable characters; anything else returns 400. See frustration signals.
settings.capture.network	object	see network capture	header_allowlist, body_urls and trace_urls (URL prefixes), max_body_bytes.
settings.capture.console	string[]	["error", "warn"]	Console levels the SDK records, within the privacy level’s limit.
settings.capture.errors	object	empty	ignore and deny_urls patterns, and console_errors_as_issues.
settings.routes	object[]	[]	Route rules, { "pattern": "/profiles/:id", "name": "Profile" }, up to 100.
settings.observe_sample_rate	number	1	Share of sessions that send data at all, greater than 0 and at most 1.
settings.allow_requests_without_origin	bool	false	Accept requests without an Origin header, for server-side senders.

POST /rum takes name and domain. PATCH /rum/{app_id} takes any of name, domain, settings, allowed_origins and replay_monthly_target; settings holds only the keys to change, merges into the stored settings, and refuses unknown keys. PUT /rum/{app_id} takes name, domain and settings, merged the same way but ignoring unknown keys. Changing privacy, retention, capture.network.body_urls or capture.network.header_allowlist needs an account admin or an API key with no scope restriction (403 otherwise). A change that cannot be published to the SDK returns 503 and changes nothing.

Read-only fields on the response:

Field	Type	Description
id	uuid	Application ID. Passed to the SDK as applicationId.
account_id	uuid	Owning account.
client_token	string	Public token the SDK sends with every payload. Rotate via POST /rum/{app_id}/rotate-token.
config_revision	int	Revision of the published SDK configuration. Increases on every change.
data_region	string	Where the application’s data is stored (us).
created_at / updated_at	rfc3339	Timestamps.

Recording rules

Recording rules decide which sessions record Analyze detail and which record a replay. Managed under /rum/{app_id}/rules; see Configure recording rules for the conditions, Auto sampling and gates.

Field	Type	Default	Description
name	string	required	1 to 255 characters.
capture	analyze or replay	required	What a matching session records. Replay also records Analyze.
enabled	bool	true	Disabled rules are kept but never applied.
sample_rate	number	1	Share of matching sessions, 0.00001 to 1, kept to 5 decimals. The cap for an Auto rule.
auto_sample	bool	false	Replay rules only: the rate follows your replay quota. See Auto sampling.
conditions	object[]	[]	All must hold, at most 20; see conditions.
min_duration_ms	int	3000 for Replay, 0 for Analyze	0 to 600,000.
require_interaction	bool	true for Replay, false for Analyze	Wait for a click, tap or key press.
position	int	after the last rule	Display order. Every enabled rule is evaluated whatever its position.

Responses add id, application_id, effective_sample_rate (the rate in force when Auto or quota protection set one), effective_rate_at, created_by_user_id, created_at and updated_at. PUT /rum/{app_id}/rules/{rule_id} changes only the fields sent. At most 50 rules per application. A malformed body returns 422, an invalid rule 400, a 51st rule 409.

Source-map releases

Managed under /rum/{app_id}/releases. See Source maps.

Field	Type	Description
version	string	Release version, 1 to 255 characters. Must match the version passed to the SDK’s init.

GET /rum/{app_id}/releases/{version}/sourcemaps lists the maps recorded against a release: id, original_file (the name frames are matched against) and created_at.

SDK config

The SDK reads https://cdn.siteqwality.com/rum/config/v2/{app_id}.json, published on every change and cached for up to 6 minutes. Its schema is SdkConfigV2 in the API reference; a deleted application’s file is {"v":2,"status":"paused"}. See Change SDK behavior without redeploying.

Analytics conventions

Topic	Rule
Timestamps	Every timestamp in a RUM API response is ISO 8601 UTC ending in Z, such as 2026-10-03T13:00:00.000Z. Request params accept any ISO 8601 string.
Range	At most 90 days, and from must not be after to; anything else returns 400.
interval	5m, 1h, 6h or 1d. When absent it follows the span: up to 6 hours 5m, up to 48 hours 1h, up to 8 days 6h, longer 1d. An interval that would return more than 10,000 buckets returns 400.
tz	IANA time zone name such as Europe/Berlin, up to 64 characters; default UTC. Buckets align to it, which matters for 1d. A well-formed name the server does not know falls back to UTC; a malformed one returns 400.
Dimension filters	browser, os, country, device_type: exact, case-sensitive match.
url	Case-insensitive substring of the page URL.
Web Vitals	One value per page view (its latest valid value). Valid: lcp_ms, fcp_ms, inp_ms, ttfb_ms 0 to 600,000; cls 0 to 10. Anything else is ignored. Percentiles are approximate (t-digest).
Text params	search and url are trimmed and capped at 200 characters; empty means absent.
Session counts	session_count, error_session_count and the breakdowns are exact up to about 1,500 sessions and approximate above that, within about 0.2%. The session list’s totals and the facets are exact.

GET /rum/{app_id}/overview

Param	Description
from, to	Time range. Default: the 30 days ending now; maximum 90 days.
f, country, browser, os, device_type, url	Repeated shared Analytics filters, or the per-dimension params (see conventions).
device_class	all, desktop or mobile; mobile includes tablets.
compare	previous adds the preceding equal-length interval under previous.

Field	Description
session_count	Sessions with at least one page view in the range.
view_count	Page views in the range.
error_count, error_rate	Error events in the range, and errors per session.
error_session_count, error_session_rate	Sessions counted in session_count that have an error event in the range, and their share of session_count (0 to 1).
p75_lcp_ms, p75_inp_ms, p75_cls, p75_fcp_ms, p75_ttfb_ms	p75 per vital; null with no samples.
vitals_sample_rate	1 for the current per-view aggregation.
visitor_count, bounce_rate, median_active_ms	Visitors, the fraction of one-view sessions with known active time below 10 seconds, and nullable median active time.
session_query	Query string for Sessions that preserves this analytics cohort and its filters.
vitals_distribution	Per vital (lcp, inp, cls, fcp, ttfb): samples, good, needs_improvement, poor page-view counts, using the thresholds.
avg_lcp_ms, avg_fcp_ms, avg_cls, avg_inp_ms, avg_ttfb_ms	Deprecated. Means of the per-view values; prefer the p75 fields.
top_pages	Top 10 URLs by page views: url, view_count, p75_lcp_ms, p75_inp_ms, p75_cls, p75_load_time_ms (initial loads only), vitals_samples, and the deprecated avg_lcp_ms, avg_load_time_ms.
top_errors	Top 10 error groups by events, honoring the filters.
country_breakdown, browser_breakdown	Top 20 countries and top 10 browsers by sessions.

GET /rum/{app_id}/vitals

Param	Description
from, to	Time range. Default: the 30 days ending now; maximum 90 days.
vital	lcp (default), inp, cls, fcp or ttfb.
interval, tz	Bucket size and zone (see conventions).
country, browser, os, device_type, url	Optional filters, as on the overview.

Each point carries timestamp, p50, p75, p95 and count (page views). A page view lands in the bucket of its last valid sample. Buckets without samples are left out. A valid vital update inside the range can contribute even when the view started earlier.

Traffic, panels, pages and attribution

These endpoints accept the Overview range and Analytics filters. Requests that exceed the query time budget return 503. See analytics investigations.

Endpoint	Parameters and response
GET /rum/{app_id}/timeseries	metric=sessions|views|errors|sessions_with_errors_pct, interval, tz. Returns {timestamp,value}[]; only the percentage metric uses 0..100.
GET /rum/{app_id}/panels/{panel}	routes, entry, exit, referrers, channels, utm, countries, devices, browsers, os, releases, frustration_elements. Returns values, view/session/error counts, frustration counters and session_query.
GET /rum/{app_id}/pages	group_by=route|path. Returns route, view/session counts, nullable p75 vitals and load times, error rate and session_query.
GET /rum/{app_id}/pages/attribution	metric=lcp|inp|cls, optional exact route. Returns targets, scripts and resources, including sample counts, percentiles, example session IDs and session_query.

Panels and Pages accept limit (default 50, maximum 100) and offset (maximum 10000). Attribution accepts the same limit. Target poor_share is a fraction of all poor samples in the cohort. Resource rows expose approximate when representative resource timings were aggregated by the SDK.

Use the returned session_query verbatim for Sessions. Retain its opaque cohort parameter during pagination or sorting so the Sessions total matches the source row for unchanged data.

Saved views and comments

See saved views and comments for authorship, privacy, mention and queue-failure behavior.

Endpoint	Contract
GET /rum/{app_id}/views	Optional page=sessions|errors|overview|pages; returns visible shared and own private views.
POST /rum/{app_id}/views	page, name, query, optional shared (default true) and position (default 0). Returns 201 and the saved view.
PUT /rum/{app_id}/views/{id}	Replaces editable fields. Author, or administrator for shared views.
DELETE /rum/{app_id}/views/{id}	Deletes an accessible owned/shared-admin view; returns 204.
GET /rum/{app_id}/comments	Required target=session:<UUID> or error:<32hex>, optional limit (default 50, maximum 100) and cursor. Returns {comments,next_cursor}, oldest first.
POST /rum/{app_id}/comments	target, plain-text body, optional session at_ms and account user UUID mentions. Returns 201 and the comment.
PATCH /rum/{app_id}/comments/{id}	Changes body, mentions or resolved. Author or administrator only.
DELETE /rum/{app_id}/comments/{id}	Clears and soft-deletes the comment; returns 204.

Saved views and comments include can_edit. Comment writes include mention_delivery: {queued,failed}. A notification failure does not undo the saved comment. Queued is transport acceptance, not inbox delivery. Viewer/auditor roles and machine-only callers cannot write collaboration records.

GET /rum/{app_id}/sessions

A session is listed when it has a measure in [from, to] and at least one page view in the extended range (four hours either side). Its counts, first_seen, last_seen and duration cover its whole life, not only the part inside the range.

Param	Description
from, to	Time range. Default: the 30 days ending now.
f	Filters in the filter grammar, repeatable, at most 20. All must hold.
search	Case-insensitive match on part of any user ID or email the session carried (within the 30-day identity window), a session ID prefix, any visited URL, or any error message in the session (messages of errors captured from the console need body access).
url	Same as f=url:contains:<value>.
browser, os, country, device_type	Same as f=browser:eq:<value> (and os, country, device).
has_error, has_replay, has_frustration	true keeps only sessions with an error event, a replay that can still be played, or a rage, dead or error click. false means no filter.
error_fingerprint	Same as f=error_issue:eq:<value>.
sort	started (default), duration, active_time, errors, frustration (the score), friction (rage, dead and error clicks) or pages. Anything else returns 400.
order	desc (default) or asc. Anything else returns 400.
limit	Page size. Default 50, maximum 100.
cursor	next_cursor of the previous page. The rest of the query must be the same; from and to may be left out and then come from the cursor, so new sessions never shift later pages. A cursor from another query returns 400.
offset	Rows to skip, at most 10,000. Prefer cursor; the two cannot be combined.

total counts every session matching the query exactly, and total_with_replay those of them with a replay that can still be played. next_cursor is absent on the last page. Ties in the sort order break by session, so paging returns every session once.

Each session carries:

Field	Description
session_id, first_seen, last_seen, duration_ms	Start, last activity across page views, events and replay, and the time between, at most 4 hours 5 minutes.
live	Activity in the last 2 minutes.
active_ms	Time the user was active (input, visible tab).
user_id, user_email, anonymous_id	Identity, shown and matched only for sessions from the last 30 days.
entry_url, entry_route, exit_url	First and last page view.
view_count, window_count	Page views and browser tabs.
error_count, failed_request_count, console_error_count	Error events (repeats included), requests with status 0 or 400 and above, console errors.
action_count	User actions the SDK counted on its page views.
rage_click_count, dead_click_count, error_click_count	Frustration signals among clicks and taps.
frustration_score	Frustration score, 0 to 100.
browser, os, device_type, country, region	Device and location.
release, env, service, sdk_version	From the SDK’s context.
has_replay, replay_bytes	Whether a replay can still be played, and its stored size (a retried upload counts once).
replay_reason	Why there is no replay: expired (past the replay retention), or the SDK’s reason: not_sampled, consent, gpc, opted_out, privacy_url, too_large, request_budget. Absent when there is a replay or no reason is known.
viewed_by_me	You watched this session’s replay in the last 90 days.

Filtering on console_message needs body access. A query that runs past its time limit returns 503; narrow the range or the filters.

GET /rum/{app_id}/sessions/{session_id}

The session page’s summary: the session’s fields (as in the list), and:

Field	Description
views	Page views, oldest first, at most 1,000 (views_truncated): view_id, url, route, start, time_spent_ms, the latest valid lcp_ms, inp_ms and cls, and error_count.
windows	Browser tabs: window_id, first_seen, last_seen.
counts	Rows per kind over the whole session, as /events counts them (a retried upload counts once): action, network, resource, console, error, long_frame, custom.
referrer_host, utm, channel, viewport	Acquisition and screen, from the first page views.
attributes	The session’s latest global attributes, without the reserved sq. keys.
user_name, traits	From setUser, for sessions from the last 30 days.
other_session_count	Sessions of the same user (or anonymous visitor, without a user) that started up to 30 days before or after this one.
events, events_truncated	The first 2,000 rows (and about 2.5 MB of JSON) of detail events and page views, oldest first, in the shape below. Their user_id and user_email are null past the 30-day identity window. Page through /events for the rest.

events rows: one type: "view" row per page view (event_id and view_id are the view’s ID; fields that do not apply are null). A session without a page view is returned too, with view_count 0; an unknown session returns 404.

GET /rum/{app_id}/sessions/{session_id}/events

One page of the session’s events, oldest first, in the shapes of the ingest kinds.

Param	Description
kinds	Comma-separated: view, view_end, custom, action, error, network, resource, console, long_frame, status. Default: all.
from_ms, to_ms	Bounds in milliseconds from the session’s start, inclusive.
q	Case-insensitive substring of a page URL or route, a request URL, an error type, title or message, an action name or selector, a custom event name, or (with body access) a console message or the message of an error captured from the console.
collapse	true folds repeated successful requests, resources and identical console lines of one page view into their first row.
cursor	next_cursor of the previous page; the other params must be the same.
limit	Page size. Default 500, maximum 1,000. A page also ends at about 2.5 MB of JSON.

Every event carries id, kind, t, offset_ms (from the session’s start), view_id, window_id, page_load_id, and the page it happened on, page_url and page_route, plus its kind’s fields: for example method, url, status, timings, trace_id and n (requests a row aggregates) on network; error_type, message, stack, frames, cause, breadcrumbs, fingerprint and attributes on error; level, message and repeat on console. A collapsed row that stands for more than one stored row adds group: rows, count (occurrences) and last_offset_ms. The schemas are in the API reference.

counts gives rows per kind over the whole session for this q and collapse, on every page. next_cursor is absent on the last page.

Body access

Request and response bodies and headers, console messages, error breadcrumbs, and the message, title, stack and cause of errors captured from the console need body access. Members and above have it unless the account limits it to admins. Viewers and auditors can read session metadata but cannot read these fields. API keys and M2M clients need the read:rum_replay scope, even unrestricted keys; connected apps never get it. Without access those fields are left out (in the summary, such error messages are empty), they cannot be searched or filtered on, and bodies_withheld is true. A response that shows any of them is recorded in the audit log as rum.network_body.viewed, once per person, key or client, application and session every 30 minutes. If the audit cannot be recorded, the API refuses the response with 500 and returns no captured content.

GET /rum/{app_id}/errors

Param	Description
since	Start of the range (required).
to	End of the range. Default now.
search	Case-insensitive match on any error message in the range. Returns every group with a matching event.
sort	count (default), sessions, last_seen or first_seen, all descending. Anything else returns 400.
limit	Page size. Default 100, maximum 500.
offset	Page offset. Default 0.
resolved	Accepted and ignored.

Each group carries count (events), session_count (sessions) and user_count (identified users), all within the range, plus first_seen and last_seen in the range.

GET /rum/{app_id}/errors/{fingerprint}

Param	Description
from, to	Time range. Default: the 30 days ending now. Every count, the timeline and the affected sessions follow it.
interval, tz	Timeline bucket size and zone (see conventions). Empty buckets come back with count: 0.

Adds session_count and affected_session_count (equal). affected_sessions lists up to 50 sessions, newest first, each with timestamp and error_ts_ms (the error’s first occurrence in that session, ISO and Unix milliseconds), event_id (that error event) and has_replay. Use the last two to link to the replay at the error.

GET /rum/{app_id}/facets

The values the session filters can take, with session counts: up to 50 non-empty values per list, by listed sessions active in the range.

Param	Description
from, to	Time range. Default: the 30 days ending now.
field	Comma-separated lists to fill: browser, os, country, device_type, region, release, env, route (sessions per visited route), channel, referrer_host, sdk_version. Default: the first four.
q	Case-insensitive substring the values must contain, for autocomplete.
f	Session filters in the filter grammar. A list ignores the filters on its own field, so every value stays pickable.

Each list is { value, session_count }. browser, os, country and device_type are always present (empty when not asked for); the others only when asked for.

Filter grammar

f=<field>:<op>[:<value>], repeatable, at most 20, values at most 512 characters, URL-encoded. In in, values are comma separated, with \, for a comma and \\ for a backslash. An unknown field or operator, or one that does not apply to the field, returns 400.

Op	Meaning
eq, neq	Equal, not equal (exact, case-sensitive).
in	One of the listed values.
contains, ncontains	Case-insensitive substring, and its negation.
starts	Starts with (case-sensitive).
gt, gte, lt, lte	Numeric comparison.
exists, nexists	Has a value (non-zero for numbers), and has none.

Session fields:

Field	Kind	Matches
user	text	User ID or email, for sessions from the last 30 days.
anonymous_id	text	The session’s anonymous ID, for sessions from the last 30 days.
referrer_host, channel, utm_source, utm_medium, utm_campaign, country, region, device, browser, os, release, env, service, sdk_version	text	The session’s value.
device_class	desktop, mobile	mobile includes tablets.
url, route	text	Any page the session visited (the first 100 of each upload).
entry_url, entry_route, exit_url	text	First or last page view.
has_replay, has_error, live	true, false	A playable replay, an error event, activity in the last 2 minutes.
error_issue	text	An error group (fingerprint) the session hit.
error_type, error_message	text	Any error event. Without body access, error_message skips errors captured from the console.
network_status	number	Any request’s status (0 for a network failure).
network_url	text	Any request’s URL.
console_level	error, warn, info, log, debug	Any console line.
console_message	text	Any console line; needs body access.
frustration	rage_click, dead_click, error_click	Any such click.
frustration_score, duration_ms, active_ms, views	number	The session’s value.
commented	true, false	A comment on the session.
viewed_by_me	true, false	You watched its replay in the last 90 days.
attr.<key>	text	A global attribute, such as attr.plan:eq:pro. Reserved sq. keys (user name, traits) return 400.

Negations (neq, ncontains, nexists) mean no match: error_type:neq:TypeError keeps sessions without a TypeError. Event fields (error_*, network_*, console_*) look back as far as Analyze data is kept (30 days by default).

Frustration score

round(100 × (1 − e^(−(3 × rage clicks + 2 × error clicks + dead clicks + 2 × errors + failed requests) / 10))), from 0 (none) to 100. One rage click scores 26, a session with an error, a failed request and a rage click 45. The inputs are the session’s rage_click_count, error_click_count, dead_click_count, error_count and failed_request_count.

GET /rum/{app_id}/ingest-status

No params. Returns last_seen_at (the newest page view or vital in the last 24 hours, null if none), sessions_last_hour and sessions_last_24h. Use it to check an install.

Endpoints

Method	Path	Purpose
POST	/rum	Create application.
GET	/rum	List applications.
GET / PUT / PATCH / DELETE	/rum/{app_id}	Detail / update / partial update / delete.
POST	/rum/{app_id}/rotate-token	Rotate the client token.
POST / GET	/rum/{app_id}/rules	Create / list recording rules.
PUT / DELETE	/rum/{app_id}/rules/{rule_id}	Update / delete a recording rule.
POST	/rum/{app_id}/rules/preview	Estimate what a rule would record. Read access.
POST / GET	/rum/{app_id}/releases	Create / list source-map releases.
POST	/rum/{app_id}/releases/{version}/sourcemaps	Request an upload URL for a source map.
GET	/rum/{app_id}/releases/{version}/sourcemaps	List the source maps recorded against a release.
DELETE	/rum/{app_id}/releases/{version}	Delete a release.
GET	/rum/{app_id}/overview	Aggregate overview (p75 vitals and their distribution, top pages, top errors, breakdowns).
GET	/rum/{app_id}/vitals	Vital timeseries (p50/p75/p95).
GET	/rum/{app_id}/sessions	Session list.
GET	/rum/{app_id}/sessions/{session_id}	Session summary.
GET	/rum/{app_id}/sessions/{session_id}/events	A page of a session’s events.
GET	/rum/{app_id}/errors	Error groups.
GET	/rum/{app_id}/errors/{fingerprint}	Error detail, timeline, affected sessions.
GET	/rum/{app_id}/facets	Dimension values seen in a range, with session counts.
GET	/rum/{app_id}/ingest-status	When data last arrived, and recent session counts.
GET	/rum/{app_id}/sessions/{session_id}/replay	Replay manifest. See Replay reference.
POST	/rum/{app_id}/sessions/{session_id}/replay/chunks	Short-lived URLs for replay chunks.

See also

• RUM overview for the concept and capture tiers.
• Recording rules for activation patterns.
• SDK reference for init options and the browser API.