# Certificate Transparency Log Firehose (`jungle_synthesizer/certificate-transparency-log-firehose-scraper`) Actor Streams newly-issued certificates from public CT logs (Google, Cloudflare, DigiCert, Sectigo, TrustAsia) with a keyword/pattern watch-list match — delta-since-last-run, not a one-domain lookup. - **URL**: https://apify.com/jungle\_synthesizer/certificate-transparency-log-firehose-scraper.md - **Developed by:** [BowTiedRaccoon](https://apify.com/jungle_synthesizer) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Certificate Transparency Log Firehose Stream newly-issued certificates from the public [Certificate Transparency](https://certificate.transparency.dev/) log ecosystem — Google, Cloudflare, DigiCert, Sectigo, and TrustAsia's currently-usable RFC6962 logs — matched against your own watch-list of domains, brand names, or keywords. Every run picks up exactly where the last one left off (a saved cursor per log), so scheduled runs only cost you for genuinely new certificates, not the same firehose over and over. This is not a one-domain crt.sh lookup. It reads the logs themselves and emits only the certificates that match what you're watching for — the phishing-cert / typosquat / newly-observed-subdomain surface that a single-domain tool can't see. --- ### Certificate Transparency Log Firehose Features - **Delta-since-last-run** — a per-log cursor (Merkle tree index) is saved automatically between runs, so a scheduled job only pays for certificates issued since the last check - **Multi-log fan-out** — scans every currently-usable log across Google, Cloudflare, DigiCert, Sectigo, and TrustAsia in one run (or restrict to specific operators) - **Watch-list matching** — substring or regex match against each certificate's Common Name and every Subject Alternative Name; only matches are returned (and billed) — everything else is scanned-and-discarded - **Precertificate + final-cert coverage** — both CT log entry types are parsed, so you see a domain the moment its precert is logged, not just the final issued cert - **Optional typosquat detection** — supply a defended brand list and get a `typosquat_flag` on certs whose SAN/CN fuzzy-matches (near-miss or contains) one of your brands - **Passive, read-only** — reads public, append-only RFC6962 log endpoints only. No scanning, probing, or contact with any certificate subject or domain owner - **No proxy, no auth needed** — CT logs are public infrastructure; this actor is cheap to run --- ### What Can You Do With CT Log Data? - **Security / brand-protection teams** — catch phishing certs and typosquat domains the moment they're issued, before a campaign goes live - **Attack-surface management (ASM)** — discover newly-registered subdomains for your own apex domains as soon as a cert is issued, before the site is public - **Threat intel researchers** — build a continuous feed of certs matching infrastructure keywords (hosting providers, C2 naming patterns, campaign-specific strings) - **M&A / due-diligence teams** — track a target company's certificate issuance as a signal of new product launches or infrastructure changes --- ### How Certificate Transparency Log Firehose Works 1. Provide a `watchList` of domains, brand names, or keywords to match. 2. The actor fetches the Google-maintained list of all CT logs, filters to currently-usable logs (optionally restricted to specific operators), and reads each log's current size (`get-sth`). 3. For each log, it fetches new entries since the last saved cursor (`get-entries`), parses each certificate (both final certs and precertificates), and tests the Common Name + all Subject Alternative Names against your watch-list. 4. Only matching certificates are saved to the dataset. The cursor advances past every entry scanned — matched or not — so nothing is ever re-scanned or re-billed. --- ### Input ```json { "watchList": ["yourbrand", "your-apex-domain.com"], "matchMode": "substring", "typosquatBrands": ["yourbrand"], "logOperators": [], "maxEntriesPerLogPerRun": 5000, "bootstrapLookback": 2000, "maxItems": 25 } ```` | Field | Type | Required | Default | Description | |-------|------|----------|---------|-------------| | `watchList` | `array` | Yes | — | Domains, brand names, or keywords to match against each cert's CN + SANs. A cert is only returned (and billed) if it matches. | | `matchMode` | `string` | No | `"substring"` | `"substring"` = case-insensitive contains match. `"regex"` = each watch-list entry is a case-insensitive regular expression. | | `typosquatBrands` | `array` | No | `[]` | Defended brand names to fuzzy-match (edit distance ≤2, or substring) against each SAN's registrable-domain label. Sets `typosquat_flag` on matches. Leave empty to skip. | | `logOperators` | `array` | No | `[]` (all) | Restrict the scan to specific CT log operators (`Google`, `Cloudflare`, `DigiCert`, `Sectigo`, `Let's Encrypt`, `TrustAsia`, `Geomys`, `IPng Networks`). Empty = every currently-usable log. | | `maxEntriesPerLogPerRun` | `integer` | No | `5000` | Safety cap on how many leaf entries are scanned per log per run, independent of `maxItems`. | | `bootstrapLookback` | `integer` | No | `2000` | For a log with no saved cursor yet, how many entries back from the current tree tip to start. CT logs hold billions of entries — a from-genesis backfill is never useful. | | `maxItems` | `integer` | No | `25` | Maximum number of matched (and billed) certificate records this run. | *** ### Certificate Transparency Log Firehose Output Fields ```json { "log_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "leaf_index": 1964624416, "cert_sha256": "ca6c8cb3ca89bedcba576819d3ed405633e8f00a7a7ed4587cfdc975b714137b", "serial_number": "055DFD94E7DA6B695FB9401E45CAAFF34069", "common_name": "yourbrand-secure-login.com", "subject_alt_names": ["yourbrand-secure-login.com"], "matched_pattern": "yourbrand", "issuer_cn": "R11", "issuer_org": "Let's Encrypt", "not_before": "2026-07-13T05:34:43.000Z", "not_after": "2026-10-11T05:34:42.000Z", "is_precert": false, "is_wildcard": false, "entry_timestamp": "2026-07-13T06:33:14.185Z", "first_seen_at": "2026-07-13T06:35:00.911Z", "typosquat_flag": true, "scraped_at": "2026-07-13T06:35:00.911Z" } ``` | Field | Type | Description | |-------|------|-------------| | `log_url` | `string` | Base URL of the CT log this certificate was read from | | `leaf_index` | `integer` | Index of this entry in the log's Merkle tree | | `cert_sha256` | `string` | SHA-256 fingerprint of the certificate DER | | `serial_number` | `string` | Certificate serial number | | `common_name` | `string` | Subject Common Name (CN), if present | | `subject_alt_names` | `array` | All dNSName Subject Alternative Names — the newly-observed-subdomain surface | | `matched_pattern` | `string` | Which watch-list term/pattern matched | | `issuer_cn` | `string` | Issuing CA's Common Name | | `issuer_org` | `string` | Issuing CA's Organization | | `not_before` | `string` | Certificate validity start (ISO 8601) | | `not_after` | `string` | Certificate validity end (ISO 8601) | | `is_precert` | `boolean` | `true` if this is a precertificate (logged before the final cert was issued) | | `is_wildcard` | `boolean` | `true` if the CN or any SAN is a wildcard (`*.example.com`) | | `entry_timestamp` | `string` | The CT log's own timestamp for this entry (ISO 8601) — when the log accepted it | | `first_seen_at` | `string` | When this actor first observed the entry (ISO 8601) — the delta anchor | | `typosquat_flag` | `boolean` | `true` if a SAN/CN fuzzy-matched your `typosquatBrands` list | | `scraped_at` | `string` | When this record was scraped (ISO 8601) | *** ### FAQ #### How do I monitor Certificate Transparency logs for my brand? Set `watchList` to your brand name(s) and apex domain(s), and optionally `typosquatBrands` to the same brand names for fuzzy phishing-cert detection. Schedule the actor to run on a recurring basis (hourly or daily) — each run only returns certificates issued since the last run, so you're notified of new matches as they appear in the logs. #### What's the difference between this and a crt.sh lookup? A crt.sh lookup is a point-in-time query for one domain. This actor streams the CT logs themselves — Google, Cloudflare, DigiCert, Sectigo, and TrustAsia — and emits a continuous, delta-since-last-run feed of every certificate matching your watch-list, across every domain those logs see. It's built for continuous monitoring, not a single lookup. #### Does this actor scan or contact my domain (or anyone else's)? No. It only reads public, append-only Certificate Transparency log endpoints (`get-sth` / `get-entries`) — the same data every browser and CT monitor relies on. It never sends a request to any certificate subject's domain. #### What are precertificates, and why do they matter? CAs log a "precertificate" to CT logs before issuing the final certificate (required by the CT policy that makes certs trusted by Chrome/Safari). This actor parses precertificates too, so a matching domain shows up in your feed the moment the precert is logged — often seconds before the final certificate is even issued. #### How does the cursor / delta work between runs? Each log gets its own saved cursor (its Merkle tree index) in a persistent key-value store tied to your actor. Every run picks up from where the last run for that log stopped, so you're never re-billed for a certificate you've already seen. A log with no saved cursor yet (first run) starts near the tree's current tip, not from the log's genesis — CT logs hold billions of entries, so a from-genesis backfill would never finish and wouldn't be useful anyway. #### Can I restrict which CT log operators are scanned? Yes — set `logOperators` to a subset (e.g. `["Google", "Cloudflare"]`) to scan only those operators' logs. Leave it empty to scan every currently-usable log across all operators. *** ### Need More Features? Need historical backfill beyond the default lookback window, or a webhook/alert integration on match? [File an issue](https://console.apify.com/actors/issues) or get in touch. ### Why Use Certificate Transparency Log Firehose? - **Pay only for matches** — every certificate scanned that doesn't match your watch-list costs nothing; you only pay for the delta that actually matters to you - **No re-billing on schedule** — the saved per-log cursor means a recurring run never re-charges for certificates you've already seen - **Passive and safe** — reads public log infrastructure only, no scanning or contact with any domain *** **Further reading:** [Which Web Scraper Do I Need?](https://orbtop.com/articles/which-scraper-do-i-need/) # Actor input Schema ## `sp_intended_usage` (type: `string`): Please describe how you plan to use the data extracted by this crawler. ## `sp_improvement_suggestions` (type: `string`): Provide any feedback or suggestions for improvements. ## `sp_contact` (type: `string`): Provide your email address so we can get in touch with you. ## `maxItems` (type: `integer`): Maximum number of matched (and billed) certificate records to return this run. ## `watchList` (type: `array`): Apex domains, brand names, or keywords to match against each certificate's Common Name and Subject Alternative Names. A cert only gets emitted (and billed) when it matches one of these. ## `matchMode` (type: `string`): 'substring' = case-insensitive substring match (recommended for brand/keyword watch-lists). 'regex' = treat each watch-list entry as a case-insensitive regular expression. ## `typosquatBrands` (type: `array`): Defended brand names (e.g. 'paypal', 'yourbank') to fuzzy-match against each SAN's registrable-domain label for phishing-cert / typosquat detection. Sets typosquat\_flag on matched records. Leave empty to skip. ## `logOperators` (type: `array`): Restrict the scan to specific CT log operators from the Google-maintained log list. Leave empty to scan every currently-usable log across all operators. ## `maxEntriesPerLogPerRun` (type: `integer`): Safety/cost cap on how many leaf entries this run will scan per log, independent of Max Items (which caps matched/billed records). Keeps a broad operator selection from running unbounded. ## `bootstrapLookback` (type: `integer`): For a log with no saved cursor yet, how many entries back from the current tree tip to start scanning. CT logs hold billions of entries — a from-genesis backfill is never useful. ## Actor input object example ```json { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 25, "watchList": [ "example-brand" ], "matchMode": "substring", "maxEntriesPerLogPerRun": 5000, "bootstrapLookback": 2000 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 25, "watchList": [ "example-brand" ], "maxEntriesPerLogPerRun": 5000, "bootstrapLookback": 2000 }; // Run the Actor and wait for it to finish const run = await client.actor("jungle_synthesizer/certificate-transparency-log-firehose-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 25, "watchList": ["example-brand"], "maxEntriesPerLogPerRun": 5000, "bootstrapLookback": 2000, } # Run the Actor and wait for it to finish run = client.actor("jungle_synthesizer/certificate-transparency-log-firehose-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 25, "watchList": [ "example-brand" ], "maxEntriesPerLogPerRun": 5000, "bootstrapLookback": 2000 }' | apify call jungle_synthesizer/certificate-transparency-log-firehose-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=jungle_synthesizer/certificate-transparency-log-firehose-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Certificate Transparency Log Firehose", "description": "Streams newly-issued certificates from public CT logs (Google, Cloudflare, DigiCert, Sectigo, TrustAsia) with a keyword/pattern watch-list match — delta-since-last-run, not a one-domain lookup.", "version": "0.1", "x-build-id": "X9cgcdtm6BQkOoeo4" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/jungle_synthesizer~certificate-transparency-log-firehose-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-jungle_synthesizer-certificate-transparency-log-firehose-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/jungle_synthesizer~certificate-transparency-log-firehose-scraper/runs": { "post": { "operationId": "runs-sync-jungle_synthesizer-certificate-transparency-log-firehose-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/jungle_synthesizer~certificate-transparency-log-firehose-scraper/run-sync": { "post": { "operationId": "run-sync-jungle_synthesizer-certificate-transparency-log-firehose-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "watchList" ], "properties": { "sp_intended_usage": { "title": "What is the intended usage of this data?", "minLength": 1, "type": "string", "description": "Please describe how you plan to use the data extracted by this crawler." }, "sp_improvement_suggestions": { "title": "How can we improve this crawler for you?", "minLength": 1, "type": "string", "description": "Provide any feedback or suggestions for improvements." }, "sp_contact": { "title": "Contact Email", "minLength": 1, "type": "string", "description": "Provide your email address so we can get in touch with you." }, "maxItems": { "title": "Max Items", "type": "integer", "description": "Maximum number of matched (and billed) certificate records to return this run." }, "watchList": { "title": "Watch List (domains / brands / keywords)", "type": "array", "description": "Apex domains, brand names, or keywords to match against each certificate's Common Name and Subject Alternative Names. A cert only gets emitted (and billed) when it matches one of these.", "items": { "type": "string" } }, "matchMode": { "title": "Match Mode", "enum": [ "substring", "regex" ], "type": "string", "description": "'substring' = case-insensitive substring match (recommended for brand/keyword watch-lists). 'regex' = treat each watch-list entry as a case-insensitive regular expression.", "default": "substring" }, "typosquatBrands": { "title": "Typosquat Brand List (optional)", "type": "array", "description": "Defended brand names (e.g. 'paypal', 'yourbank') to fuzzy-match against each SAN's registrable-domain label for phishing-cert / typosquat detection. Sets typosquat_flag on matched records. Leave empty to skip.", "items": { "type": "string" } }, "logOperators": { "title": "CT Log Operators (optional)", "type": "array", "description": "Restrict the scan to specific CT log operators from the Google-maintained log list. Leave empty to scan every currently-usable log across all operators.", "items": { "type": "string", "enum": [ "Google", "Cloudflare", "DigiCert", "Sectigo", "Let's Encrypt", "TrustAsia", "Geomys", "IPng Networks" ] } }, "maxEntriesPerLogPerRun": { "title": "Max Entries Scanned per Log per Run", "type": "integer", "description": "Safety/cost cap on how many leaf entries this run will scan per log, independent of Max Items (which caps matched/billed records). Keeps a broad operator selection from running unbounded." }, "bootstrapLookback": { "title": "First-Run Lookback (entries)", "type": "integer", "description": "For a log with no saved cursor yet, how many entries back from the current tree tip to start scanning. CT logs hold billions of entries — a from-genesis backfill is never useful." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```