openapi: 3.0.3 info: title: Splunk Observability Cloud — Org tokens version: 4.5.0 description: 'API for creating, updating, retrieving, deleting, and rotating org tokens. Requirements You must have an organization access token with the API permission or a session token to use the API. You have to have the Splunk Observability Cloud admin role to use the POST /token, PUT /token/{name}, DELETE /token/{name}, and POST /token/{name}/rotate operations. You have to have the Splunk Observability Cloud admin or power role to use the GET /token and GET /token/{name} operations.' x-provenance: method: reconstructed authored_by: Splunk (content) / API Evangelist (assembly) reconstructed_by: API Evangelist reconstructed_on: '2026-08-19' first_party: false provider_published: false note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's. Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset path, including invented control paths — so this is NOT first-party publication and is not graded as such. x-evidence: - type: source url: https://dev.splunk.com/observability/reference/ - type: source url: https://dev.splunk.com/observability/docs/apibasics/api_list/ servers: - url: https://api.{REALM}.observability.splunkcloud.com/v2 description: Org Token API endpoint URL variables: REALM: default: us0 description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0). security: - SessionToken: [] components: securitySchemes: SessionToken: type: apiKey in: header name: X-SF-Token description: Splunk Observability Cloud session token or org access token. paths: /token: get: summary: Retrieve Tokens Using Query description: 'Search for one or more org tokens by specifying all or part of the token name. If you''ve set token limits for the token, they''re returned in the response body. Note: Splunk Observability Cloud returns a maximum of 10,000 objects, even if your organization contains more than 10,000. To learn more, see the Considerations for retrieve operations section in the developer guide.' parameters: - name: offset in: query description: 'The object in the result set at which the API should start returning results to you. Each object contains the properties of an org access token.' schema: type: integer format: int32 - name: limit in: query description: 'The number of results to return from the result set. The default is 20, and Splunk Observability Cloud uses this value if you specify an invalid value.' schema: type: integer format: int32 default: 20 - name: name in: query description: All or part of the org token name schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. If you use an org token, it must have an authorization scope that includes API, and the API only returns information for the org token you use.' required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Response body for Retrieve Tokens operation type: object properties: count: type: integer format: int32 description: 'Number of token objects that matched your query, also known as the result set. This isn''t always the number of token objects in results. If you specify offset or limit or both, the number of objects you receive may be different from the value of count.' results: type: array items: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' exceedingLimits: title: Token exceeding limits flag type: boolean example: false description: Indicates whether the token is exceeding its usage limits. If set to true, the token is exceeding one or more of its usage limits. expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' orgId: title: Organization ID type: string example: myOrg description: ID of the organization associated with the token. permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Current roles associated with the token type: array items: title: Token roles items properties: capabilities: type: array items: type: array items: type: string example: CREATE_DASHBOARD description: List of capabilities associated with the token's role. created: type: string example: 232329 description: 'Time of creation, in milliseconds. This value is set by the system, and you can''t change it.' creator: type: string example: user1 description: 'User who created the role, if applicable. This value is set by the system, and you can''t change it.' description: type: string example: Built-in power role description: Description of the token's role. id: type: string example: abcd1234 description: ID of the associated token role. immutable: type: boolean example: true description: Whether the token's role is immutable. Immutable roles can't be edited. lastUpdated: type: string example: 34343 description: 'Time of the most recent update, in milliseconds. This value is set by the system, and you can''t change it.' lastUpdatedBy: type: string example: User1 description: 'The user who most recently updated the role. This value is set by the system, and you can''t change it.' organizationId: type: string example: F2394DY description: ID of the organization that's associated with this role. title: type: string enum: - power - usage - read_only example: power description: Name of the token's role. Tokens can have the "power", "usage", or "read_only" roles. description: Values for the roles field of the GET, PUT, and POST endpoints for access tokens. description: List of roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. authScopes: title: Authorization scope type: array items: type: string enum: - API - INGEST - RUM description: 'The type of endpoint for which the token is authorized. Authorization scopes cannot be updated. Note: Assign only one authorization scope to a token. Applying both the API and INGEST authorization scopes to the same token might raise a security concern. Splunk Observability Cloud accepts the following values for the authScopes field: API: Use this authorization scope for the token to authenticate with Infrastructure Monitoring endpoints. Example use cases are Terraform, programmatic usage of the API for business objects, and so on. These endpoints use the following base URLs: https://api..observability.splunkcloud.com wss://stream..observability.splunkcloud.com To learn more, see Summary of Splunk Observability Cloud API Endpoints. INGEST: Use this authorization scope for the token to authenticate with data ingestion endpoints. These endpoints use the following base URLs: POST https://ingest..observability.splunkcloud.com/v2/datapoint POST https://ingest..observability.splunkcloud.com/v2/event POST https://ingest..observability.splunkcloud.com/v1/trace To learn more, see Send Monitoring Metrics and Custom Events. RUM: Use this authorization scope for the token to authenticate with RUM ingestion endpoints. These endpoints use the following base URL: https://rum-ingest..observability.splunkcloud.com/v1/rum. Note: RUM displays the RUM token in URIs that are visible in a browser. To preserve security, you can''t assign the INGEST or API authorization scope to a RUM token.' description: Properties of an org token, in the form of a JSON object description: List of results, in the form of a JSON array description: 'Org tokens that match the specified criteria, in the form of a JSON object' examples: example: value: count: 0 results: - authScopes: - API created: 1556746230000 creator: string description: string disabled: true exceedingLimits: false expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge orgId: myOrg permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - capabilities: - - CREATE_DASHBOARD created: 232329 creator: user1 description: Built-in power role id: abcd1234 immutable: true lastUpdated: 34343 lastUpdatedBy: User1 organizationId: F2394DY title: power secret: string security: - SessionToken: [] tags: - Org tokens post: summary: Create Single Token description: 'Creates an org token from the properties specified in the request body.' parameters: - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token. Must be a session token (User API access token). required: true schema: type: string requestBody: required: true content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Roles associated with the token. type: array items: title: Fields for updating token roles with the API. properties: title: type: string enum: - power - usage - read_only example: read_only description: 'Name of the token''s role. Tokens can have the "power", "usage", or "read_only" roles. If a title isn''t provided, the token will automatically have the power role.' description: Options for updating token roles with the API. description: Roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' secondsUntilExpiry: title: Time period until the rotated token expires, in seconds. type: integer format: int64 minimum: 0 maximum: 5676000000 example: 5184000 description: 'Time period, in seconds, until the rotated token expires. This time period must be greater than 0 seconds and less than 18 years (5,676,000,000 seconds). If you leave this value unspecified, the API uses the org''s defaultTokenLifespanMs value, which is 18 years by default. You can change this default value in the Splunk Observability Cloud access token page.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. description: Properties of an org token, in the form of a JSON object examples: example: value: created: 1556746230000 creator: string description: string disabled: true expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - title: read_only secondsUntilExpiry: 5184000 secret: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' exceedingLimits: title: Token exceeding limits flag type: boolean example: false description: Indicates whether the token is exceeding its usage limits. If set to true, the token is exceeding one or more of its usage limits. expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' orgId: title: Organization ID type: string example: myOrg description: ID of the organization associated with the token. permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Current roles associated with the token type: array items: title: Token roles items properties: capabilities: type: array items: type: array items: type: string example: CREATE_DASHBOARD description: List of capabilities associated with the token's role. created: type: string example: 232329 description: 'Time of creation, in milliseconds. This value is set by the system, and you can''t change it.' creator: type: string example: user1 description: 'User who created the role, if applicable. This value is set by the system, and you can''t change it.' description: type: string example: Built-in power role description: Description of the token's role. id: type: string example: abcd1234 description: ID of the associated token role. immutable: type: boolean example: true description: Whether the token's role is immutable. Immutable roles can't be edited. lastUpdated: type: string example: 34343 description: 'Time of the most recent update, in milliseconds. This value is set by the system, and you can''t change it.' lastUpdatedBy: type: string example: User1 description: 'The user who most recently updated the role. This value is set by the system, and you can''t change it.' organizationId: type: string example: F2394DY description: ID of the organization that's associated with this role. title: type: string enum: - power - usage - read_only example: power description: Name of the token's role. Tokens can have the "power", "usage", or "read_only" roles. description: Values for the roles field of the GET, PUT, and POST endpoints for access tokens. description: List of roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. authScopes: title: Authorization scope type: array items: type: string enum: - API - INGEST - RUM description: 'The type of endpoint for which the token is authorized. Authorization scopes cannot be updated. Note: Assign only one authorization scope to a token. Applying both the API and INGEST authorization scopes to the same token might raise a security concern. Splunk Observability Cloud accepts the following values for the authScopes field: API: Use this authorization scope for the token to authenticate with Infrastructure Monitoring endpoints. Example use cases are Terraform, programmatic usage of the API for business objects, and so on. These endpoints use the following base URLs: https://api..observability.splunkcloud.com wss://stream..observability.splunkcloud.com To learn more, see Summary of Splunk Observability Cloud API Endpoints. INGEST: Use this authorization scope for the token to authenticate with data ingestion endpoints. These endpoints use the following base URLs: POST https://ingest..observability.splunkcloud.com/v2/datapoint POST https://ingest..observability.splunkcloud.com/v2/event POST https://ingest..observability.splunkcloud.com/v1/trace To learn more, see Send Monitoring Metrics and Custom Events. RUM: Use this authorization scope for the token to authenticate with RUM ingestion endpoints. These endpoints use the following base URL: https://rum-ingest..observability.splunkcloud.com/v1/rum. Note: RUM displays the RUM token in URIs that are visible in a browser. To preserve security, you can''t assign the INGEST or API authorization scope to a RUM token.' description: Properties of an org token, in the form of a JSON object examples: example: value: authScopes: - API created: 1556746230000 creator: string description: string disabled: true exceedingLimits: false expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge orgId: myOrg permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - capabilities: - - CREATE_DASHBOARD created: 232329 creator: user1 description: Built-in power role id: abcd1234 immutable: true lastUpdated: 34343 lastUpdatedBy: User1 organizationId: F2394DY title: power secret: string '400': description: HTTP 400 response content: application/json: schema: title: Response body returned for an invalid request type: object properties: code: title: Error code type: integer example: 400 description: HTTP response code for the error message: title: Error message type: string example: Please provide a name for this token. description: 'Cause of the error. The following list describes the error message and its cause: Please provide a name for this token.: In the request body, the name field is missing or null. Unable to create or update the given token. Please try again later.: An internal error occurred, and Splunk Observability Cloud can''t create the token. A token with the same name already exists!: For a POST request, you specified a value for name that''s the same as the name of an existing token. DPM quota cannot be set on a Hosts subscription plan: Your organization uses host-based pricing, but you tried to set a DPM limit. Category quota cannot be set on a DPM subscription plan: Your organization uses DPM-based pricing, but you tried to set a host-based limit. Host/Container quota cannot be set on a MTS subscription plan: Your organization uses custom metric-based pricing, but you tried to set a host or container limit. A principalId is required and may not be empty for acl entry: Problem with a field in permissions -- principalId is either missing or empty. One or more of provided users could not be validated [sf.domain.accesscontrol.ObjectPermissions[\"acl\"]->java.util.HashSet[0]->sf.domain.accesscontrol.AclEntry[\"actions\"]->java.util.HashSet[0]: Problem with a field in permissions -- The value of the actions field isn''t READ or WRITE. Failed to deserialize payload at: sf.rest.shared.model.NamedToken[\"permissions\"]->sf.domain.accesscontrol.ObjectPermissions[\"acl\"]->java.util.HashSet[0]->sf.domain.accesscontrol.AclEntry[\"principalType\"] Problem with a field in permissions -- The value of the principalType field isn''t USER, TEAM, or ORG.' description: Response error code and message, in the form of a JSON object examples: example: value: code: 400 message: Please provide a name for this token. security: - SessionToken: [] tags: - Org tokens /token/{name}: get: summary: Retrieve Token Using Name description: 'Retrieves an existing org token based on the name you specify in the name path parameter' parameters: - name: name in: path description: Name of the org token you want to retrieve required: true schema: type: string - name: X-SF-TOKEN in: header description: 'Authentication token. If you use an org token, it needs to have an authorization scope that includes API, and the API only returns information for the org token you use.' required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' exceedingLimits: title: Token exceeding limits flag type: boolean example: false description: Indicates whether the token is exceeding its usage limits. If set to true, the token is exceeding one or more of its usage limits. expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' orgId: title: Organization ID type: string example: myOrg description: ID of the organization associated with the token. permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Current roles associated with the token type: array items: title: Token roles items properties: capabilities: type: array items: type: array items: type: string example: CREATE_DASHBOARD description: List of capabilities associated with the token's role. created: type: string example: 232329 description: 'Time of creation, in milliseconds. This value is set by the system, and you can''t change it.' creator: type: string example: user1 description: 'User who created the role, if applicable. This value is set by the system, and you can''t change it.' description: type: string example: Built-in power role description: Description of the token's role. id: type: string example: abcd1234 description: ID of the associated token role. immutable: type: boolean example: true description: Whether the token's role is immutable. Immutable roles can't be edited. lastUpdated: type: string example: 34343 description: 'Time of the most recent update, in milliseconds. This value is set by the system, and you can''t change it.' lastUpdatedBy: type: string example: User1 description: 'The user who most recently updated the role. This value is set by the system, and you can''t change it.' organizationId: type: string example: F2394DY description: ID of the organization that's associated with this role. title: type: string enum: - power - usage - read_only example: power description: Name of the token's role. Tokens can have the "power", "usage", or "read_only" roles. description: Values for the roles field of the GET, PUT, and POST endpoints for access tokens. description: List of roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. authScopes: title: Authorization scope type: array items: type: string enum: - API - INGEST - RUM description: 'The type of endpoint for which the token is authorized. Authorization scopes cannot be updated. Note: Assign only one authorization scope to a token. Applying both the API and INGEST authorization scopes to the same token might raise a security concern. Splunk Observability Cloud accepts the following values for the authScopes field: API: Use this authorization scope for the token to authenticate with Infrastructure Monitoring endpoints. Example use cases are Terraform, programmatic usage of the API for business objects, and so on. These endpoints use the following base URLs: https://api..observability.splunkcloud.com wss://stream..observability.splunkcloud.com To learn more, see Summary of Splunk Observability Cloud API Endpoints. INGEST: Use this authorization scope for the token to authenticate with data ingestion endpoints. These endpoints use the following base URLs: POST https://ingest..observability.splunkcloud.com/v2/datapoint POST https://ingest..observability.splunkcloud.com/v2/event POST https://ingest..observability.splunkcloud.com/v1/trace To learn more, see Send Monitoring Metrics and Custom Events. RUM: Use this authorization scope for the token to authenticate with RUM ingestion endpoints. These endpoints use the following base URL: https://rum-ingest..observability.splunkcloud.com/v1/rum. Note: RUM displays the RUM token in URIs that are visible in a browser. To preserve security, you can''t assign the INGEST or API authorization scope to a RUM token.' description: Properties of an org token, in the form of a JSON object examples: example: value: authScopes: - API created: 1556746230000 creator: string description: string disabled: true exceedingLimits: false expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge orgId: myOrg permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - capabilities: - - CREATE_DASHBOARD created: 232329 creator: user1 description: Built-in power role id: abcd1234 immutable: true lastUpdated: 34343 lastUpdatedBy: User1 organizationId: F2394DY title: power secret: string security: - SessionToken: [] tags: - Org tokens put: summary: Update Single Token description: 'Updates properties of an org token you specify in the name path parameter. You have to have the Splunk Observability Cloud admin role to use this endpoint.' parameters: - name: name in: path description: Name of the org token you want to update required: true schema: type: string - name: Content-Type in: header description: Format of the request body. Always "application/json". required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token. This token must be a session token. required: true schema: type: string requestBody: required: true content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Roles associated with the token. type: array items: title: Fields for updating token roles with the API. properties: title: type: string enum: - power - usage - read_only example: read_only description: 'Name of the token''s role. Tokens can have the "power", "usage", or "read_only" roles. If a title isn''t provided, the token will automatically have the power role.' description: Options for updating token roles with the API. description: Roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' secondsUntilExpiry: title: Time period until the rotated token expires, in seconds. type: integer format: int64 minimum: 0 maximum: 5676000000 example: 5184000 description: 'Time period, in seconds, until the rotated token expires. This time period must be greater than 0 seconds and less than 18 years (5,676,000,000 seconds). If you leave this value unspecified, the API uses the org''s defaultTokenLifespanMs value, which is 18 years by default. You can change this default value in the Splunk Observability Cloud access token page.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. description: Properties of an org token, in the form of a JSON object examples: example: value: created: 1556746230000 creator: string description: string disabled: true expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - title: read_only secondsUntilExpiry: 5184000 secret: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' exceedingLimits: title: Token exceeding limits flag type: boolean example: false description: Indicates whether the token is exceeding its usage limits. If set to true, the token is exceeding one or more of its usage limits. expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' orgId: title: Organization ID type: string example: myOrg description: ID of the organization associated with the token. permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Current roles associated with the token type: array items: title: Token roles items properties: capabilities: type: array items: type: array items: type: string example: CREATE_DASHBOARD description: List of capabilities associated with the token's role. created: type: string example: 232329 description: 'Time of creation, in milliseconds. This value is set by the system, and you can''t change it.' creator: type: string example: user1 description: 'User who created the role, if applicable. This value is set by the system, and you can''t change it.' description: type: string example: Built-in power role description: Description of the token's role. id: type: string example: abcd1234 description: ID of the associated token role. immutable: type: boolean example: true description: Whether the token's role is immutable. Immutable roles can't be edited. lastUpdated: type: string example: 34343 description: 'Time of the most recent update, in milliseconds. This value is set by the system, and you can''t change it.' lastUpdatedBy: type: string example: User1 description: 'The user who most recently updated the role. This value is set by the system, and you can''t change it.' organizationId: type: string example: F2394DY description: ID of the organization that's associated with this role. title: type: string enum: - power - usage - read_only example: power description: Name of the token's role. Tokens can have the "power", "usage", or "read_only" roles. description: Values for the roles field of the GET, PUT, and POST endpoints for access tokens. description: List of roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. authScopes: title: Authorization scope type: array items: type: string enum: - API - INGEST - RUM description: 'The type of endpoint for which the token is authorized. Authorization scopes cannot be updated. Note: Assign only one authorization scope to a token. Applying both the API and INGEST authorization scopes to the same token might raise a security concern. Splunk Observability Cloud accepts the following values for the authScopes field: API: Use this authorization scope for the token to authenticate with Infrastructure Monitoring endpoints. Example use cases are Terraform, programmatic usage of the API for business objects, and so on. These endpoints use the following base URLs: https://api..observability.splunkcloud.com wss://stream..observability.splunkcloud.com To learn more, see Summary of Splunk Observability Cloud API Endpoints. INGEST: Use this authorization scope for the token to authenticate with data ingestion endpoints. These endpoints use the following base URLs: POST https://ingest..observability.splunkcloud.com/v2/datapoint POST https://ingest..observability.splunkcloud.com/v2/event POST https://ingest..observability.splunkcloud.com/v1/trace To learn more, see Send Monitoring Metrics and Custom Events. RUM: Use this authorization scope for the token to authenticate with RUM ingestion endpoints. These endpoints use the following base URL: https://rum-ingest..observability.splunkcloud.com/v1/rum. Note: RUM displays the RUM token in URIs that are visible in a browser. To preserve security, you can''t assign the INGEST or API authorization scope to a RUM token.' description: Properties of an org token, in the form of a JSON object examples: example: value: authScopes: - API created: 1556746230000 creator: string description: string disabled: true exceedingLimits: false expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge orgId: myOrg permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - capabilities: - - CREATE_DASHBOARD created: 232329 creator: user1 description: Built-in power role id: abcd1234 immutable: true lastUpdated: 34343 lastUpdatedBy: User1 organizationId: F2394DY title: power secret: string '400': description: HTTP 400 response content: application/json: schema: title: Response body returned for an invalid request type: object properties: code: title: Error code type: integer example: 400 description: HTTP response code for the error message: title: Error message type: string example: Please provide a name for this token. description: 'Cause of the error. The following list describes the error message and its cause: Please provide a name for this token.: In the request body, the name field is missing or null. Unable to create or update the given token. Please try again later.: An internal error occurred, and Splunk Observability Cloud can''t create the token. A token with the same name already exists!: For a POST request, you specified a value for name that''s the same as the name of an existing token. DPM quota cannot be set on a Hosts subscription plan: Your organization uses host-based pricing, but you tried to set a DPM limit. Category quota cannot be set on a DPM subscription plan: Your organization uses DPM-based pricing, but you tried to set a host-based limit. Host/Container quota cannot be set on a MTS subscription plan: Your organization uses custom metric-based pricing, but you tried to set a host or container limit. A principalId is required and may not be empty for acl entry: Problem with a field in permissions -- principalId is either missing or empty. One or more of provided users could not be validated [sf.domain.accesscontrol.ObjectPermissions[\"acl\"]->java.util.HashSet[0]->sf.domain.accesscontrol.AclEntry[\"actions\"]->java.util.HashSet[0]: Problem with a field in permissions -- The value of the actions field isn''t READ or WRITE. Failed to deserialize payload at: sf.rest.shared.model.NamedToken[\"permissions\"]->sf.domain.accesscontrol.ObjectPermissions[\"acl\"]->java.util.HashSet[0]->sf.domain.accesscontrol.AclEntry[\"principalType\"] Problem with a field in permissions -- The value of the principalType field isn''t USER, TEAM, or ORG.' description: Response error code and message, in the form of a JSON object examples: example: value: code: 400 message: Please provide a name for this token. security: - SessionToken: [] tags: - Org tokens delete: summary: Delete Single Token description: 'Deletes the org token you specify in the name path parameter You have to have the Splunk Observability Cloud admin role to use this endpoint.' parameters: - name: name in: path description: Name of the org token you want to delete required: true schema: type: string - name: X-SF-TOKEN in: header description: Authentication token. Must be a session token. required: true schema: type: string responses: '204': description: HTTP 204 response security: - SessionToken: [] tags: - Org tokens /token/{name}/rotate: post: summary: Rotate Token Secret description: 'Generates a new token secret for the token specified by the name path parameter, and de-authorizes the previous token secret. You can also define a grace period for the previous token before it expires. During the grace period, both the old and new token secrets are authorized for the token. For example: https://api.{realm}.observability.splunkcloud.com/v2/token/{name}/rotate?graceful=5184000 Note: You can''t rotate a token that is past its expiration date. You have to have the Splunk Observability Cloud admin role to use this endpoint.' parameters: - name: name in: path description: Name of the org token you want to update with a new secret required: true schema: type: string - name: graceful in: query description: 'Time interval, in seconds, during which the old secret continues to function. After the time expires, the API rejects requests using the old secret. If you don''t specify a value, it defaults to 0, and the old secret immediately stops working. The maximum allowed interval is 5,184,000 seconds (60 days).' schema: type: integer format: int64 minimum: 0 maximum: 5184000 example: 5184000 - name: secondsUntilExpiry in: query description: 'Time period, in seconds, until the rotated token expires. This time period must be greater than 0 seconds and less than 18 years (5,676,000,000 seconds). If you leave this value unspecified, the API uses the org''s defaultTokenLifespanMs value, which is 30 days by default. You can change this default value in the Splunk Observability Cloud access token page.' schema: type: integer format: int64 minimum: 0 maximum: 5676000000 example: 5184000 - name: X-SF-TOKEN in: header description: Authentication token. Must be a session token. required: true schema: type: string responses: '200': description: HTTP 200 response content: application/json: schema: title: Properties of an org access token type: object properties: created: title: Token creation timestamp type: integer format: int64 example: 1556746230000 readOnly: true description: 'The token creation date and time, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' creator: type: string readOnly: true description: 'ID of the user that created this token. The system sets this value, and you can''t modify it.' description: title: Token description type: string description: 'Extended description of the token. You assign this value when you create or update the token.' disabled: title: Token disabled flag type: boolean description: 'Flag that controls enabling the token. If set to true, the token is disabled, and you can''t use it for authentication.' exceedingLimits: title: Token exceeding limits flag type: boolean example: false description: Indicates whether the token is exceeding its usage limits. If set to true, the token is exceeding one or more of its usage limits. expiry: title: Token expiration timestamp type: integer format: int64 example: 1558474230000 readOnly: true description: 'Date and time that the token expires in *nix time in milliseconds. The system sets this value to one year after the creation date, and you can''t modify it. Note: For access tokens that the system created with a five-year lifetime, the original expiration date remains the same.' id: title: Token ID type: string readOnly: true description: 'Token ID The system sets this value, and you can''t modify it.' lastUpdated: type: integer format: int64 example: 1557696630000 readOnly: true description: 'The date and time that the token was last updated, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' lastUpdatedBy: type: string readOnly: true description: 'ID of the user that last updated this token The system sets this value, and you can''t modify it.' latestRotation: title: Timestamp of latest rotation type: integer format: int64 example: 1556832630000 readOnly: true description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token, in *nix time in milliseconds. The system sets this value, and you can''t modify it.' limits: title: Limits associated with the org token type: object properties: categoryQuota: title: Usage Limits for usage-based and host-based pricing type: object properties: '1': title: Max number of hosts type: number format: int32 description: Max number of hosts that can use this token (ignored for usage-based pricing) '2': title: Max number of Docker containers type: number format: int32 description: Max number of Docker containers that can use this token (ignored for usage-based pricing) '3': title: Max number of custom metrics that can be sent with this token type: number format: int32 description: Max number of custom metrics that can be sent with this token '4': title: Max number of hi-res metrics that can be sent with this token type: number format: int32 description: Max number of hi-res metrics that can be sent with this token description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each limit is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the limit: The key is one of the following values: "1": Max number of hosts that can use this token (ignored for usage-based pricing) "2": Max number of Docker containers that can use this token (ignored for usage-based pricing) "3": Max number of custom metrics that can be sent with this token "4": Max number of hi-res metrics that can be sent with this token To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' categoryNotificationThreshold: title: Thresholds at which Splunk Observability Cloud sends a notification type: object properties: '1': title: Notification threshold for the host limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the host limit (ignored for usage-based pricing) '2': title: Notification threshold for the Docker container limit (ignored for usage-based pricing) type: number format: int32 description: Notification threshold for the Docker container limit (ignored for usage-based pricing) '3': title: Notification threshold for the custom metrics limit type: number format: int32 description: Notification threshold for the custom metrics limit '4': title: Notification threshold for the hi-res metrics limit type: number format: int32 description: Notification threshold for the hi-res metrics limit description: 'Threshold values at which Splunk Observability Cloud sends a notification that you''re about to exceed the corresponding limit. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification. Each threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value that sets the threshold: "1": Notification threshold for the host limit (ignored for usage-based pricing) "2": Notification threshold for the Docker container limit (ignored for usage-based pricing) "3": Notification threshold for the custom metrics limit "4": Notification threshold for the hi-res metrics limit To learn more, see the Control Your Resource Usage using Token Limits topic in the Developer guide.' dpmQuota: title: The data points per minute limit for this token type: integer format: int32 description: 'The data points per minute (dpm) limit for this token. If you exceed this limit, Splunk Observability Cloud sends out an alert.' dpmNotificationThreshold: title: Threshold at which Splunk Observability Cloud sends a notification type: integer format: int32 description: 'DPM level at which Splunk Observability Cloud sends the notification for this token. If you don''t specify a notification, Splunk Observability Cloud sends the generic notification.' eventSearchesPerMinute: title: Limit of the rate of event searches type: integer description: 'Rate at which API requests that use the token can search for events using the GET /v2/event API' jobsPerMinuteLimit: title: Limit of rate of analytics jobs starts type: integer description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when you authenticate the WebSocket connection using the token. Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.' mtsmLimit: title: MTS creation rate per minute limit type: integer format: int64 example: 500 description: 'The maximum number of MTS per minute that clients using this token can create. After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for clients that are using this token. Splunk Observability Cloud also drops data points for the MTS that the clients are trying to create.' description: 'Specifies org token limits and thresholds. The system uses the following limits, regardless of your pricing model: eventSearchesPerMinute jobsPerMinuteLimit mtsmLimit The system uses the following limits based on your pricing model: If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values. If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and categoryNotificationThreshold values. For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.' notifications: type: array items: oneOf: - title: Amazon EventBridge Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: AmazonEventBridge description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Amazon EventBridge notification, this is always "AmazonEventBridge".' credentialId: type: string description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing Amazon EventBridge-to-Splunk Observability Cloud integration' - title: BigPanda Threshold Notification type: object required: - type - credentialId properties: type: type: string example: BigPanda description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a BigPanda notification, this is always "BigPanda".' credentialId: type: string description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Specifies the properties needed to send a notification for a limit threshold to an existing BigPanda integration' - title: Jira Cloud or Jira Server Threshold Notification type: object required: - type - credentialId properties: type: type: string readOnly: false writeOnly: false example: Jira description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Jira Cloud or Jira Server notification, this is always "Jira".' credentialId: type: string readOnly: false writeOnly: false description: 'Jira integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties of a limit threshold notification sent via a Jira Cloud or Jira Server integration, in the form of a JSON object. These notifications take the form of a new Jira ticket whose properties are specified in the Jira integration object. To learn more, see the Integrate Jira with Splunk Observability Cloud topic in the Developer guide.' - title: Email Threshold Notification type: object required: - email - type properties: type: type: string example: Email description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an email notification, this is always "Email".' email: type: string description: 'Destination address for the notification. This address isn''t validated, so you must ensure it''s correct before you add it to a request. Splunk Observability Cloud may not save invalid values and may try to send the notification with an empty address. In either case, the notification won''t go out.' description: Properties of a limit threshold notification sent via email - title: Microsoft Teams Threshold Notification type: object required: - type - credentialId properties: type: type: string example: Office365 description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. To ensure backwards compatibility, the value is always "Office365".' credentialId: type: string description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent using a Microsoft Teams integration' - title: Opsgenie Threshold Notification type: object required: - credentialId - type properties: type: type: string example: Opsgenie description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an Opsgenie notification, this is always "Opsgenie".' credentialId: type: string description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when you add the integration The system sets this value, and you can''t modify it.' credentialName: type: string example: My Opsgenie Integration description: 'Descriptive name of the Opsgenie credential, which you assign when you add the integration' responderName: type: string description: 'Name of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderName, you don''t have to specify responderId. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderId: type: string readOnly: false writeOnly: false description: 'ID of a responder you created in Opsgenie. Notifications you send using the Opsgenie integration go to this responder. If you specify responderId, you don''t have to specify responderName. If you specify neither, Opsgenie uses the defaults for your Opsgenie account.' responderType: type: string example: Team description: Opsgenie responder type. The only valid value is "Team". description: Properties for a limit threshold notification sent via Opsgenie - title: PagerDuty Threshold Notification type: object required: - type - credentialId properties: type: type: string example: PagerDuty description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a PagerDuty notification, this is always "PagerDuty".' credentialId: type: string description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via PagerDuty - title: ServiceNow Threshold Notification type: object required: - credentialId - type properties: type: type: string example: ServiceNow description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a ServiceNow notification, this is always "ServiceNow".' credentialId: type: string description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via ServiceNow - title: Slack Threshold Notification type: object required: - channel - credentialId - type properties: type: type: string example: Slack description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For a Slack notification, this is always "Slack".' channel: type: string example: channel-notifications description: 'Name of the Slack channel in which to display the notification. Omit the leading "#" symbol. For example, specify "#critical-notifications" as "critical-notifications".' credentialId: type: string description: 'Slack integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a notification sent via Slack - title: Team Email Threshold Notification type: object required: - type properties: type: type: string example: TeamEmail description: 'Tells Splunk Observability Cloud which system it should use to send the notification. For a TeamEmail notification, this is always "TeamEmail".' team: type: string description: 'A team ID. Splunk Observability Cloud sends the threshold alert message to each team member, using the email address used to invite the member to the organization. The system sets this value, and you can''t modify it.' description: 'Properties for a limit threshold notification sent to one or more entire teams via email.' - title: Team Threshold Notification type: object required: - team - type properties: type: type: string example: Team description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a team notification, this is always "Team".' team: type: string example: DevOps description: 'A team ID. Splunk Observability Cloud sends the threshold alert message using the team''s notification policy, which specifies one or more notification services for each alert severity.' description: 'Properties of a limit threshold notification using a team''s notification policy' - title: Splunk On-Call Threshold Notification type: object required: - credentialId - routingKey - type properties: type: type: string example: VictorOps description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a VictorOps notification, this is always "VictorOps".' credentialId: type: string description: 'Splunk On-Call integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' routingKey: type: string description: 'Routing key used to determine how to process the notification message. This key controls where the notification is posted and how related alerts are escalated. For more information see the Splunk On-Call knowledge base.' description: Properties of a limit threshold notification sent via Splunk On-Call - title: Webhook URL Threshold Notification type: object required: - type properties: type: type: string example: Webhook description: 'Tells Splunk Observability Cloud which system to use to send the notification. For a Webhook notification, this is always "Webhook".' credentialId: type: string description: 'The Webhook integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' secret: type: string description: 'Secret value that identifies the Webhook integration to use when sending notifications. This value also indicates that the notification has permission to use the integration. If rules.notifications.credentialId is set, this property is ignored.' url: type: string description: 'The URL of a Webhook integration. You must provide the mechanism for processing notifications sent to the URL and routing them to the proper chat or incident management system. If credentialId is set, this property is ignored.' description: Properties of a limit threshold notification sent via a Webhook - title: xMatters Threshold Notification type: object required: - type - credentialId properties: type: type: string example: XMatters description: 'Tells Splunk Observability Cloud which external system it should use to send the notification. For an xMatters notification, this is always "XMatters" (Note the capital "X").' credentialId: type: string description: 'xMatters integration identifier, which Splunk Observability Cloud assigns when you add the integration. Use the UI or the Integrations API to find the value of credentialId. The system sets this value, and you can''t modify it.' description: Properties of a limit threshold notification sent via xMatters description: 'Array of notification settings. Each element defines a notification that Splunk Observability Cloud sends when your organization is within 90% of exceeding an org token limit. You can specify more than one object, and each object can be of a different type. To send email notifications, use one of the following types: For one or more individual users, use "type": "Email". For a single team, use "type": "TeamEmail". For multiple teams, use multiple array elements, each with "type": "TeamEmail" and the team ID. To send emails to a team, the team must already exist. Note: "Team" sends notification messages using the team''s notification policy, which may or may not send an email to team members. To learn more, see the description of the "Team" notification type.' orgId: title: Organization ID type: string example: myOrg description: ID of the organization associated with the token. permissions: title: Access control list type: object nullable: true properties: acl: title: List of access controls for this token type: array minItems: 1 nullable: false items: title: Single access control type: object required: - actions - principalId - principalType properties: actions: title: List of authorizations for an ID type: array minItems: 1 maxItems: 2 nullable: false example: - READ - WRITE items: type: string enum: - READ - WRITE description: 'List of authorizations for the ID (principal) specified in the principalId field, in the form of a JSON array of strings. The following values are allowed: READ: The principal can view the token, but can''t modify it. WRITE: The principal can view the token and update it. The token is only visible to users or teams that you specify in the access control list. However, if you specify "principalType": "ORG", the token is visible to everyone in the organization. If you specify "actions": null, Splunk Observability Cloud returns HTTP response code 400, indicating that actions can''t be null.' principalId: title: ID of an Splunk Observability Cloud user or organization type: string nullable: false example: X_xxxx9XXXX description: The Splunk Observability Cloud-assigned ID of a user or organization principalType: title: Type of ID specified by the `principalId` field type: string nullable: false enum: - USER - ORG - TEAM example: USER description: 'String that describes the type of ID specified in the principalId field. Splunk Observability Cloud accepts the following values for principalType: USER: principalId represents an individual user TEAM: principalId represents an Splunk Observability Cloud team ORG: principalId represents the entire organization If you set "principalType": null, Splunk Observability Cloud returns HTTP response code 400, indicating that principalType can''t be null.' description: Describes the authorizations for the ID specified by the principalId and principalType fields. description: 'List of access controls, in the form of a JSON array of JSON objects. If you specify "acl": null, Splunk Observability Cloud returns HTTP response code 400 indicating that acl can''t be null.' parent: type: string title: PermissionParent description: 'Not used. Splunk Observability Cloud ignores values you specify. In response bodies, the field value is always null.' description: 'List of authorizations for this org token, in the form of a JSON array of JSON objects. Each object specifies an authorization, the ID that can perform the action, and the type of ID. If you specify null for the value of permissions, Splunk Observability Cloud takes the following actions: POST /v2/token: Only admin users can access the token. PUT /v2/token: Splunk Observability Cloud removes all permissions for the token.' roles: title: Current roles associated with the token type: array items: title: Token roles items properties: capabilities: type: array items: type: array items: type: string example: CREATE_DASHBOARD description: List of capabilities associated with the token's role. created: type: string example: 232329 description: 'Time of creation, in milliseconds. This value is set by the system, and you can''t change it.' creator: type: string example: user1 description: 'User who created the role, if applicable. This value is set by the system, and you can''t change it.' description: type: string example: Built-in power role description: Description of the token's role. id: type: string example: abcd1234 description: ID of the associated token role. immutable: type: boolean example: true description: Whether the token's role is immutable. Immutable roles can't be edited. lastUpdated: type: string example: 34343 description: 'Time of the most recent update, in milliseconds. This value is set by the system, and you can''t change it.' lastUpdatedBy: type: string example: User1 description: 'The user who most recently updated the role. This value is set by the system, and you can''t change it.' organizationId: type: string example: F2394DY description: ID of the organization that's associated with this role. title: type: string enum: - power - usage - read_only example: power description: Name of the token's role. Tokens can have the "power", "usage", or "read_only" roles. description: Values for the roles field of the GET, PUT, and POST endpoints for access tokens. description: List of roles associated with the token. secret: title: Current authentication secret for the token type: string readOnly: true description: 'Authentication secret used to send requests to Splunk Observability Cloud. The system sets this value, and you can''t modify it.' name: title: Name (displayed) type: string minLength: 1 readOnly: false writeOnly: false description: Displayed name of the org token in the UI. authScopes: title: Authorization scope type: array items: type: string enum: - API - INGEST - RUM description: 'The type of endpoint for which the token is authorized. Authorization scopes cannot be updated. Note: Assign only one authorization scope to a token. Applying both the API and INGEST authorization scopes to the same token might raise a security concern. Splunk Observability Cloud accepts the following values for the authScopes field: API: Use this authorization scope for the token to authenticate with Infrastructure Monitoring endpoints. Example use cases are Terraform, programmatic usage of the API for business objects, and so on. These endpoints use the following base URLs: https://api..observability.splunkcloud.com wss://stream..observability.splunkcloud.com To learn more, see Summary of Splunk Observability Cloud API Endpoints. INGEST: Use this authorization scope for the token to authenticate with data ingestion endpoints. These endpoints use the following base URLs: POST https://ingest..observability.splunkcloud.com/v2/datapoint POST https://ingest..observability.splunkcloud.com/v2/event POST https://ingest..observability.splunkcloud.com/v1/trace To learn more, see Send Monitoring Metrics and Custom Events. RUM: Use this authorization scope for the token to authenticate with RUM ingestion endpoints. These endpoints use the following base URL: https://rum-ingest..observability.splunkcloud.com/v1/rum. Note: RUM displays the RUM token in URIs that are visible in a browser. To preserve security, you can''t assign the INGEST or API authorization scope to a RUM token.' description: Properties of an org token, in the form of a JSON object examples: example: value: authScopes: - API created: 1556746230000 creator: string description: string disabled: true exceedingLimits: false expiry: 1558474230000 id: string lastUpdated: 1557696630000 lastUpdatedBy: string latestRotation: 1556832630000 limits: categoryNotificationThreshold: '1': 0 '2': 0 '3': 0 '4': 0 categoryQuota: '1': 0 '2': 0 '3': 0 '4': 0 dpmNotificationThreshold: 0 dpmQuota: 0 eventSearchesPerMinute: 0 jobsPerMinuteLimit: 0 mtsmLimit: 500 name: string notifications: - credentialId: string type: AmazonEventBridge orgId: myOrg permissions: acl: - actions: - READ - WRITE principalId: X_xxxx9XXXX principalType: USER parent: string roles: - capabilities: - - CREATE_DASHBOARD created: 232329 creator: user1 description: Built-in power role id: abcd1234 immutable: true lastUpdated: 34343 lastUpdatedBy: User1 organizationId: F2394DY title: power secret: string '401': description: HTTP 401 response security: - SessionToken: [] tags: - Org tokens