> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Flow dnshoneypot > Security → DNS Queries: every query the node DNS logged **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:project:{project}:security:*`. ## OpenAPI ````yaml /openapi.json get /api/supervisors/{name}/projects/{project}/security/flows/dns-honeypot openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/projects/{project}/security/flows/dns-honeypot: get: tags: - projects summary: Flow dnshoneypot description: >- Security → DNS Queries: every query the node DNS logged **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:project:{project}:security:*`. operationId: get_supervisors_byName_projects_byProject_security_flows_dnsHoneypot parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string - description: '' in: path name: project required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.dnsHoneypotResponse' description: Success. '401': description: Not authenticated — no valid session cookie or API token. '403': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '502': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Gateway. components: schemas: api.dnsHoneypotResponse: properties: events: items: $ref: '#/components/schemas/clickhouse.HoneypotEvent' nullable: true type: array honeypot: $ref: '#/components/schemas/api.dnsHoneypotStatus' mode: type: string noTable: type: boolean note: type: string other: items: $ref: '#/components/schemas/clickhouse.HoneypotFlow' nullable: true type: array since: type: string sources: items: $ref: '#/components/schemas/clickhouse.HoneypotSource' nullable: true type: array totals: $ref: '#/components/schemas/clickhouse.HoneypotTotals' truncated: type: boolean required: - events - mode - other - since - sources - totals type: object x-go-type: backend/internal/api.dnsHoneypotResponse api.ErrorBody: properties: error: type: string required: - error type: object clickhouse.HoneypotEvent: properties: alpn: items: type: string nullable: true type: array bytes: format: int32 minimum: 0 type: integer durationMs: format: int32 minimum: 0 type: integer guestCluster: type: string httpHost: type: string httpMethod: type: string httpPath: type: string name: type: string nameFrom: type: string namespace: type: string node: type: string pod: type: string port: format: int32 minimum: 0 type: integer preview: type: string project: type: string protocol: type: string sni: type: string sourceIp: type: string sourcePort: format: int32 minimum: 0 type: integer time: format: date-time type: string tlsVersion: type: string transport: type: string userAgent: type: string workload: type: string workloadKind: type: string required: - alpn - bytes - durationMs - port - protocol - sourceIp - sourcePort - time - transport type: object x-go-type: backend/internal/clickhouse.HoneypotEvent api.dnsHoneypotStatus: properties: address: type: string allPorts: type: boolean image: type: string message: type: string podAddress: type: string ready: type: boolean required: - allPorts - ready type: object x-go-type: backend/internal/api.dnsHoneypotStatus clickhouse.HoneypotFlow: properties: first: format: date-time type: string flows: format: int64 minimum: 0 type: integer last: format: date-time type: string namespace: type: string pod: type: string port: format: int32 minimum: 0 type: integer protocol: type: string sourceIp: type: string verdict: type: string workload: type: string required: - first - flows - last - port - protocol - sourceIp - verdict type: object x-go-type: backend/internal/clickhouse.HoneypotFlow clickhouse.HoneypotSource: properties: addresses: items: type: string nullable: true type: array events: format: int64 minimum: 0 type: integer first: format: date-time type: string guestCluster: type: string last: format: date-time type: string names: items: type: string nullable: true type: array namespace: type: string pods: items: type: string nullable: true type: array ports: items: type: string nullable: true type: array project: type: string protocols: items: type: string nullable: true type: array workload: type: string workloadKind: type: string required: - addresses - events - first - last - names - pods - ports - protocols type: object x-go-type: backend/internal/clickhouse.HoneypotSource clickhouse.HoneypotTotals: properties: events: format: int64 minimum: 0 type: integer names: format: int64 minimum: 0 type: integer required: - events - names type: object x-go-type: backend/internal/clickhouse.HoneypotTotals securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.