openapi: 3.1.0
info:
  title: Cribl As Code API Credentials API
  description: The Cribl As Code API enables developers to manage Cribl configurations programmatically using infrastructure-as-code principles. The management plane API provides endpoints for administrative tasks in Cribl Cloud including managing organizations, workspaces, and API credentials. Developers can use this API alongside SDKs for Python, Go, and TypeScript, or through Terraform providers, to onboard sources, build and maintain pipelines, and standardize workflows at scale. The management plane supports creating and configuring Cribl Cloud workspaces, managing API credentials, and controlling access to organizational resources.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
servers:
- url: https://gateway.cribl.cloud
  description: Cribl Cloud Management Plane
security:
- bearerAuth: []
tags:
- name: API Credentials
  description: Manage API credentials used for OAuth 2.0 client credentials authentication. Credentials consist of a client ID and client secret used to obtain bearer tokens for API access.
paths:
  /v1/organizations/{organizationId}/api-credentials:
    get:
      operationId: listApiCredentials
      summary: List API credentials
      description: Retrieves all API credentials configured for the specified organization. Each credential consists of a client ID and client secret used for OAuth 2.0 client credentials authentication.
      tags:
      - API Credentials
      parameters:
      - $ref: '#/components/parameters/organizationId'
      responses:
        '200':
          description: Successfully retrieved API credentials
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiCredential'
                  count:
                    type: integer
                    description: Total number of API credentials
        '401':
          description: Unauthorized
        '403':
          description: Forbidden - insufficient permissions
    post:
      operationId: createApiCredential
      summary: Create an API credential
      description: Creates a new API credential for the specified organization. The response includes the client secret which is only shown once and must be stored securely.
      tags:
      - API Credentials
      parameters:
      - $ref: '#/components/parameters/organizationId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiCredentialCreate'
      responses:
        '200':
          description: API credential created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiCredentialWithSecret'
        '400':
          description: Invalid credential configuration
        '401':
          description: Unauthorized
        '403':
          description: Forbidden - insufficient permissions
  /v1/organizations/{organizationId}/api-credentials/{credentialId}:
    get:
      operationId: getApiCredential
      summary: Get an API credential by ID
      description: Retrieves the metadata of a specific API credential. The client secret is not included in the response.
      tags:
      - API Credentials
      parameters:
      - $ref: '#/components/parameters/organizationId'
      - $ref: '#/components/parameters/credentialId'
      responses:
        '200':
          description: Successfully retrieved API credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiCredential'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden - insufficient permissions
        '404':
          description: API credential not found
    patch:
      operationId: updateApiCredential
      summary: Update an API credential
      description: Updates the metadata of an existing API credential such as its description or permissions scope.
      tags:
      - API Credentials
      parameters:
      - $ref: '#/components/parameters/organizationId'
      - $ref: '#/components/parameters/credentialId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApiCredentialUpdate'
      responses:
        '200':
          description: API credential updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiCredential'
        '400':
          description: Invalid credential configuration
        '401':
          description: Unauthorized
        '403':
          description: Forbidden - insufficient permissions
        '404':
          description: API credential not found
    delete:
      operationId: deleteApiCredential
      summary: Delete an API credential
      description: Deletes an API credential by its unique ID. Any applications using this credential will lose API access.
      tags:
      - API Credentials
      parameters:
      - $ref: '#/components/parameters/organizationId'
      - $ref: '#/components/parameters/credentialId'
      responses:
        '200':
          description: API credential deleted successfully
        '401':
          description: Unauthorized
        '403':
          description: Forbidden - insufficient permissions
        '404':
          description: API credential not found
components:
  parameters:
    credentialId:
      name: credentialId
      in: path
      required: true
      description: The API credential identifier
      schema:
        type: string
    organizationId:
      name: organizationId
      in: path
      required: true
      description: The Cribl Cloud organization identifier
      schema:
        type: string
  schemas:
    ApiCredentialUpdate:
      type: object
      properties:
        description:
          type: string
          description: Updated description
          maxLength: 256
    ApiCredential:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the API credential
        clientId:
          type: string
          description: The OAuth 2.0 client ID
        description:
          type: string
          description: A human-readable description of the credential
        organizationId:
          type: string
          description: The parent organization identifier
        createdAt:
          type: string
          description: Credential creation timestamp
          format: date-time
        updatedAt:
          type: string
          description: Credential last update timestamp
          format: date-time
    ApiCredentialCreate:
      type: object
      required:
      - description
      properties:
        description:
          type: string
          description: A human-readable description for the credential
          maxLength: 256
    ApiCredentialWithSecret:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the API credential
        clientId:
          type: string
          description: The OAuth 2.0 client ID
        clientSecret:
          type: string
          description: The OAuth 2.0 client secret. This value is only returned once at creation time and cannot be retrieved again.
        description:
          type: string
          description: A human-readable description
        organizationId:
          type: string
          description: The parent organization identifier
        createdAt:
          type: string
          description: Credential creation timestamp
          format: date-time
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant from https://login.cribl.cloud/oauth/token. Tokens expire after 24 hours (86400 seconds).
    oauth2:
      type: oauth2
      description: OAuth 2.0 client credentials flow for Cribl Cloud management plane authentication.
      flows:
        clientCredentials:
          tokenUrl: https://login.cribl.cloud/oauth/token
          scopes: {}
externalDocs:
  description: Cribl As Code Documentation
  url: https://docs.cribl.io/cribl-as-code/api/