openapi: 3.0.0
info:
  title: Sumo Logic accessKeyManagement samlConfigurationManagement API
  description: "# Getting Started\nWelcome to the Sumo Logic API reference. You can use these APIs to interact with the Sumo Logic platform. For information on Collector and Search Job APIs, see our [API home page](https://help.sumologic.com/docs/api).\n## API Endpoints\nSumo Logic has several deployments in different geographic locations. You'll need to use the Sumo Logic API endpoint corresponding to your geographic location. See the table below for the different API endpoints by deployment. For details determining your account's deployment, see [API endpoints](https://help.sumologic.com/?cid=3011).\n\n  <table>\n    <tr>\n      <td> <strong>Deployment</strong> </td>\n      <td> <strong>Endpoint</strong> </td>\n    </tr>\n    <tr>\n      <td> AU </td>\n      <td> https://api.au.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> CA </td>\n      <td> https://api.ca.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> DE </td>\n      <td> https://api.de.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> EU </td>\n      <td> https://api.eu.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> FED </td>\n      <td> https://api.fed.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> IN </td>\n      <td> https://api.in.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> JP </td>\n      <td> https://api.jp.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> KR </td>\n      <td> https://api.kr.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> US1 </td>\n      <td> https://api.sumologic.com/api/ </td>\n    </tr>\n    <tr>\n      <td> US2 </td>\n      <td> https://api.us2.sumologic.com/api/ </td>\n    </tr>\n  </table>\n\n## Authentication\nSumo Logic supports the following options for API authentication:\n- Access ID and Access Key\n- Base64 encoded Access ID and Access Key\n\nSee [Access Keys](https://help.sumologic.com/docs/manage/security/access-keys) to generate an Access Key. Make sure to copy the key you create, because it is displayed only once.\nWhen you have an Access ID and Access Key you can execute requests such as the following:\n  ```bash\n  curl -u \"<accessId>:<accessKey>\" -X GET https://api.<deployment>.sumologic.com/api/v1/users\n  ```\n\nWhere `deployment` is either `au`, `ca`, `de`, `eu`, `fed`, `in`, `jp`, `us1`, or `us2`. See [API endpoints](#section/API-Endpoints) for details.\n\nIf you prefer to use basic access authentication, you can do a Base64 encoding of your `<accessId>:<accessKey>` to authenticate your HTTPS request. The following is an example request, replace the placeholder `<encoded>` with your encoded Access ID and Access Key string:\n  ```bash\n  curl -H \"Authorization: Basic <encoded>\" -X GET https://api.<deployment>.sumologic.com/api/v1/users\n  ```\n\n\nRefer to [API Authentication](https://help.sumologic.com/?cid=3012) for a Base64 example.\n\n## Status Codes\nGeneric status codes that apply to all our APIs. See the [HTTP status code registry](https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) for reference.\n  <table>\n    <tr>\n      <td> <strong>HTTP Status Code</strong> </td>\n      <td> <strong>Error Code</strong> </td>\n      <td> <strong>Description</strong> </td>\n    </tr>\n    <tr>\n      <td> 301 </td>\n      <td> moved </td>\n      <td> The requested resource SHOULD be accessed through returned URI in Location Header. See [troubleshooting](https://help.sumologic.com/docs/api/troubleshooting/#api---301-error---moved) for details.</td>\n    </tr>\n    <tr>\n      <td> 401 </td>\n      <td> unauthorized </td>\n      <td> Credential could not be verified.</td>\n    </tr>\n    <tr>\n      <td> 403 </td>\n      <td> forbidden </td>\n      <td> This operation is not allowed for your account type or the user doesn't have the role capability to perform this action. See [troubleshooting](https://help.sumologic.com/docs/api/troubleshooting/#api---401-error---credential-could-not-be-verified) for details.</td>\n    </tr>\n    <tr>\n      <td> 404 </td>\n      <td> notfound </td>\n      <td> Requested resource could not be found. </td>\n    </tr>\n    <tr>\n      <td> 405 </td>\n      <td> method.unsupported </td>\n      <td> Unsupported method for URL. </td>\n    </tr>\n    <tr>\n      <td> 415 </td>\n      <td> contenttype.invalid </td>\n      <td> Invalid content type. </td>\n    </tr>\n    <tr>\n      <td> 429 </td>\n      <td> rate.limit.exceeded </td>\n      <td> The API request rate is higher than 4 request per second or inflight API requests are higher than 10 request per second. </td>\n    </tr>\n    <tr>\n      <td> 500 </td>\n      <td> internal.error </td>\n      <td> Internal server error. </td>\n    </tr>\n    <tr>\n      <td> 503 </td>\n      <td> service.unavailable </td>\n      <td> Service is currently unavailable. </td>\n    </tr>\n  </table>\n\n## Filtering\nSome API endpoints support filtering results on a specified set of fields. Each endpoint that supports filtering will list the fields that can be filtered. Multiple fields can be combined by using an ampersand `&` character.\n\nExample: To get user with email `john@demo.com`:\n  ```bash\n  api.sumologic.com/v1/users?email=john@demo.com\n  ```\n\n## Sorting\nSome API endpoints support sorting fields by using the `sortBy` query parameter. The default sort order is ascending. Prefix the field with a minus sign `-` to sort in descending order.\n\nFor example, to get 20 users sorted by their `email` in descending order:\n  ```bash\n  api.sumologic.com/v1/users?limit=20&sort=-email\n  ```\n\n## Asynchronous Request\nAsynchronous requests do not wait for results, instead they immediately respond back with a job identifier while the job runs in the background. You can use the job identifier to track the status of the asynchronous job request. Here is a typical flow for an asynchronous request.\n1. Start an asynchronous job. On success, a job identifier is returned. The job identifier uniquely identifies\n  your asynchronous job.\n\n2. Once started, use the job identifier from step 1 to track the status of your asynchronous job. An asynchronous\n  request will typically provide an endpoint to poll for the status of asynchronous job. A successful response\n  from the status endpoint will have the following structure:\n  ```json\n  {\n      \"status\": \"Status of asynchronous request\",\n      \"statusMessage\": \"Optional message with additional information in case request succeeds\",\n      \"error\": \"Error object in case request fails\"\n  }\n  ```\n  The `status` field can have one of the following values:\n    1. `Success`: The job succeeded. The `statusMessage` field might have additional information.\n    2. `InProgress`: The job is still running.\n    3. `Failed`: The job failed. The `error` field in the response will have more information about the failure.\n\n3. Some asynchronous APIs may provide a third endpoint (like [export result](#operation/getAsyncExportResult))\n  to fetch the result of an asynchronous job.\n\n\n### Example\nLet's say we want to export a folder with the identifier `0000000006A2E86F`. We will use the [async export](#operation/beginAsyncExport) API to export all the content under the folder with `id=0000000006A2E86F`.\n1. Start an export job for the folder\n  ```bash\n  curl -X POST -u \"<accessId>:<accessKey>\" https://api.<deployment>.sumologic.com/api/v2/content/0000000006A2E86F/export\n  ```\n  See [authentication section](#section/Authentication) for more details about `accessId`, `accessKey`, and\n  `deployment`.\n  On success, you will get back a job identifier. In the response below, `C03E086C137F38B4` is the job identifier.\n  ```bash\n  {\n      \"id\": \"C03E086C137F38B4\"\n  }\n  ```\n\n2. Now poll for the status of the asynchronous job with the [status](#operation/getAsyncExportStatus) endpoint.\n  ```bash\n  curl -X GET -u \"<accessId>:<accessKey>\" https://api.<deployment>.sumologic.com/api/v2/content/0000000006A2E86F/export/C03E086C137F38B4/status\n  ```\n  You may get a response like\n  ```json\n  {\n      \"status\": \"InProgress\",\n      \"statusMessage\": null,\n      \"error\": null\n  }\n  ```\n  It implies the job is still in progress. Keep polling till the status is either `Success` or `Failed`.\n\n3. When the asynchronous job completes (`status != \"InProgress\"`), you can fetch the results with the\n  [export result](#operation/getAsyncExportResult) endpoint.\n  ```bash\n  curl -X GET -u \"<accessId>:<accessKey>\" https://api.<deployment>.sumologic.com/api/v2/content/0000000006A2E86F/export/C03E086C137F38B4/result\n  ```\n\n  The asynchronous job may fail (`status == \"Failed\"`). You can look at the `error` field for more details.\n  ```json\n  {\n      \"status\": \"Failed\",\n      \"errors\": {\n          \"code\": \"content1:too_many_items\",\n          \"message\": \"Too many objects: object count(1100) was greater than limit 1000\"\n      }\n  }\n  ```\n\n\n## Rate Limiting\n* A rate limit of four API requests per second (240 requests per minute) applies to all API calls from a user.\n* A rate limit of 10 concurrent requests to any API endpoint applies to an access key.\n\nIf a rate is exceeded, a rate limit exceeded 429 status code is returned.\n\n## Generating Clients\nYou can use [OpenAPI Generator](https://openapi-generator.tech) to generate clients from the YAML file to access the API.\n\n### Using [NPM](https://www.npmjs.com/get-npm)\n1. Install [NPM package wrapper](https://github.com/openapitools/openapi-generator-cli) globally, exposing the CLI\n  on the command line:\n  ```bash\n  npm install @openapitools/openapi-generator-cli -g\n  ```\n  You can see detailed instructions [here](https://openapi-generator.tech/docs/installation#npm).\n\n2. Download the [YAML file](/docs/sumologic-api.yaml) and save it locally. Let's say the file is saved as `sumologic-api.yaml`.\n3. Use the following command to generate `python` client inside the `sumo/client/python` directory:\n  ```bash\n  openapi-generator generate -i sumologic-api.yaml -g python -o sumo/client/python\n  ```\n\n\n### Using [Homebrew](https://brew.sh/)\n1. Install OpenAPI Generator\n  ```bash\n  brew install openapi-generator\n  ```\n\n2. Download the [YAML file](/docs/sumologic-api.yaml) and save it locally. Let's say the file is saved as `sumologic-api.yaml`.\n3. Use the following command to generate `python` client side code inside the `sumo/client/python` directory:\n  ```bash\n  openapi-generator generate -i sumologic-api.yaml -g python -o sumo/client/python\n  ```\n"
  version: 1.0.0
  x-logo:
    url: ./sumologic_logo.png
servers:
- url: https://api.au.sumologic.com/api/
  description: AU deployment API server
- url: https://api.ca.sumologic.com/api/
  description: CA deployment API server
- url: https://api.de.sumologic.com/api/
  description: DE deployment API server
- url: https://api.eu.sumologic.com/api/
  description: EU deployment API server
- url: https://api.fed.sumologic.com/api/
  description: FED deployment API server
- url: https://api.jp.sumologic.com/api/
  description: JP deployment API server
- url: https://api.kr.sumologic.com/api/
  description: KR deployment API server
- url: https://api.in.sumologic.com/api/
  description: IN deployment API server
- url: https://api.sumologic.com/api/
  description: US1 deployment API server
- url: https://api.us2.sumologic.com/api/
  description: US2 deployment API server
security:
- basicAuth: []
tags:
- name: samlConfigurationManagement
  description: 'SAML configuration management API


    Organizations with Enterprise accounts can provision Security Assertion Markup Language (SAML) 2.0 to enable Single Sign-On (SSO) for user access to Sumo Logic. For more information, see [SAML Configuration](https://help.sumologic.com/?cid=4016).

    '
  x-displayName: SAML Configuration
paths:
  /v1/saml/identityProviders:
    get:
      tags:
      - samlConfigurationManagement
      summary: Get A List Of SAML Configurations.
      description: Get a list of all SAML configurations in the organization.
      operationId: getIdentityProviders
      responses:
        '200':
          description: A list of SAML configurations in the organization.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SamlIdentityProvider'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    post:
      tags:
      - samlConfigurationManagement
      summary: Create A New SAML Configuration.
      description: Create a new SAML configuration in the organization.
      operationId: createIdentityProvider
      parameters: []
      requestBody:
        description: The configuration of the SAML identity provider.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SamlIdentityProviderRequest'
        required: true
      responses:
        '200':
          description: The SAML configuration was successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SamlIdentityProvider'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/identityProviders/{id}:
    put:
      tags:
      - samlConfigurationManagement
      summary: Update A SAML Configuration.
      description: Update an existing SAML configuration in the organization.
      operationId: updateIdentityProvider
      parameters:
      - name: id
        in: path
        description: Identifier of the SAML configuration to update.
        required: true
        schema:
          type: string
      requestBody:
        description: Information to update in the SAML configuration.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SamlIdentityProviderRequest'
        required: true
      responses:
        '200':
          description: The SAML configuration was successfully modified.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SamlIdentityProvider'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    delete:
      tags:
      - samlConfigurationManagement
      summary: Delete A SAML Configuration.
      description: Delete a SAML configuration with the given identifier from the organization.
      operationId: deleteIdentityProvider
      parameters:
      - name: id
        in: path
        description: Identifier of the SAML configuration to delete.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: The SAML configuration was deleted successfully.
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/allowlistedUsers:
    get:
      tags:
      - samlConfigurationManagement
      summary: Get List Of Allowlisted Users.
      description: Get a list of allowlisted users.
      operationId: getAllowlistedUsers
      responses:
        '200':
          description: A list of allowlisted users from the organization.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AllowlistedUserResult'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/allowlistedUsers/{userId}:
    post:
      tags:
      - samlConfigurationManagement
      summary: Allowlist A User.
      description: Allowlist a user from SAML lockdown allowing them to sign in using a password in addition to SAML.
      operationId: createAllowlistedUser
      parameters:
      - name: userId
        in: path
        description: Identifier of the user.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: User was successfully allowlisted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AllowlistedUserResult'
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
    delete:
      tags:
      - samlConfigurationManagement
      summary: Remove An Allowlisted User.
      description: Remove an allowlisted user requiring them to sign in using SAML.
      operationId: deleteAllowlistedUser
      parameters:
      - name: userId
        in: path
        description: Identifier of user that will no longer be allowlisted from SAML Lockdown.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: User was successfully removed from the allowlist for SAML Lockdown.
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/lockdown/enable:
    post:
      tags:
      - samlConfigurationManagement
      summary: Require SAML For Sign-in.
      description: Enabling SAML lockdown requires users to sign in using SAML preventing them from logging in with an email and password.
      operationId: enableSamlLockdown
      responses:
        '204':
          description: SAML lockdown was enabled successfully.
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/lockdown/disable:
    post:
      tags:
      - samlConfigurationManagement
      summary: Disable SAML Lockdown.
      description: Disable SAML lockdown for the organization.
      operationId: disableSamlLockdown
      responses:
        '204':
          description: SAML lockdown was disabled successfully.
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/saml/identityProviders/{id}/metadata:
    get:
      tags:
      - samlConfigurationManagement
      summary: Get SAML Configuration Metadata XML.
      description: Get metadata XML for a specific SAML configuration within the organization.
      operationId: getSamlMetadata
      parameters:
      - name: id
        in: path
        description: Identifier of the SAML configuration for which metadata should be returned.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A SAML configuration metadata XML within the organization.
          content:
            application/xml:
              schema:
                type: string
        default:
          description: Operation failed with an error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    AuthnCertificateResult:
      required:
      - certificate
      type: object
      properties:
        certificate:
          type: string
          description: Authentication Request Signing Certificate for the user.
    OnDemandProvisioningInfo:
      required:
      - onDemandProvisioningRoles
      type: object
      properties:
        firstNameAttribute:
          type: string
          description: First name attribute of the new user account.
          example: http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname
          default: ''
        lastNameAttribute:
          type: string
          description: Last name attribute of the new user account.
          example: http://schemas.microsoft.com/ws/2008/06/identity/claims/surname
          default: ''
        onDemandProvisioningRoles:
          type: array
          description: Sumo Logic RBAC roles to be assigned when user accounts are provisioned.
          example: '["Analyst", "Administrator"]'
          items:
            type: string
          default: []
    MetadataModel:
      required:
      - createdAt
      - createdBy
      - modifiedAt
      - modifiedBy
      type: object
      properties:
        createdAt:
          type: string
          description: Creation timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
          format: date-time
          example: 2018-10-16 09:10:00+00:00
        createdBy:
          type: string
          description: Identifier of the user who created the resource.
          example: 0000000006743FDD
        modifiedAt:
          type: string
          description: Last modification timestamp in UTC.
          format: date-time
          example: 2018-10-16 09:10:00+00:00
        modifiedBy:
          type: string
          description: Identifier of the user who last modified the resource.
          example: 0000000006743FE8
    SamlIdentityProvider:
      type: object
      allOf:
      - $ref: '#/components/schemas/SamlIdentityProviderRequest'
      - $ref: '#/components/schemas/AuthnCertificateResult'
      - $ref: '#/components/schemas/MetadataModel'
      - required:
        - id
        properties:
          id:
            type: string
            description: Unique identifier of the SAML Identity Provider.
            example: 00000000361130F7
          assertionConsumerUrl:
            type: string
            description: The URL on Sumo Logic where the IdP will redirect to with its authentication response.
            example: https://service.sumologic.com/sumo/saml/consume/9483922
            default: ''
          entityId:
            type: string
            description: A unique identifier that is the intended audience of the SAML assertion.
            example: https://service.sumologic.com/sumo/saml/9483922
            default: ''
          metadataUrl:
            type: string
            description: The URL to fetch SAML metadata XML.
            example: https://api.sumologic.com/api/v1/saml/identityProviders/00000000361130F7/metadata
            default: ''
    AllowlistedUserResult:
      required:
      - canManageSaml
      - email
      - firstName
      - isActive
      - lastLogin
      - lastName
      - userId
      type: object
      properties:
        userId:
          type: string
          description: Unique identifier of the user.
        firstName:
          type: string
          description: First name of the user.
        lastName:
          type: string
          description: Last name of the user.
        email:
          type: string
          description: Email of the user.
          example: john@sumologic.com
        canManageSaml:
          type: boolean
          description: If the user can manage SAML Configurations.
        isActive:
          type: boolean
          description: Checks if the user is active.
        lastLogin:
          type: string
          description: Timestamp of the last login of the user.
          format: date-time
    ErrorDescription:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          description: An error code describing the type of error.
          example: auth:password_too_short
        message:
          type: string
          description: A short English-language description of the error.
          example: Your password was too short.
        detail:
          type: string
          description: An optional fuller English-language description of the error.
          example: Your password was 5 characters long, the minimum length is 12 characters. See http://example.com/password for more information.
        meta:
          type: object
          description: An optional list of metadata about the error.
          example:
            minLength: 12
            actualLength: 5
    ErrorResponse:
      required:
      - errors
      - id
      type: object
      properties:
        id:
          type: string
          description: An identifier for the error; this is unique to the specific API request.
          example: IUUQI-DGH5I-TJ045
        errors:
          type: array
          description: A list of one or more causes of the error.
          example:
          - code: auth:password_too_short
            message: Your password was too short.
          - code: auth:password_character_classes
            message: Your password did not contain any non-alphanumeric characters
          items:
            $ref: '#/components/schemas/ErrorDescription'
    SamlIdentityProviderRequest:
      required:
      - configurationName
      - issuer
      - x509cert1
      type: object
      properties:
        spInitiatedLoginPath:
          type: string
          description: This property has been deprecated and is no longer used.
          example: http://www.okta.com/abxcseyuiwelflkdjh
          deprecated: true
          default: ''
        configurationName:
          type: string
          description: Name of the SSO policy or another name used to describe the policy internally.
          example: SumoLogic
        issuer:
          type: string
          description: The unique URL assigned to the organization by the SAML Identity Provider.
          example: http://www.okta.com/abxcseyuiwelflkdjh
        spInitiatedLoginEnabled:
          type: boolean
          description: True if Sumo Logic redirects users to your identity provider with a SAML AuthnRequest when signing in.
          default: false
        authnRequestUrl:
          type: string
          description: The URL that the identity provider has assigned for Sumo Logic to submit SAML authentication requests to the identity provider.
          example: https://www.okta.com/app/sumologic/abxcseyuiwelflkdjh/sso/saml
          default: ''
        x509cert1:
          type: string
          description: The certificate is used to verify the signature in SAML assertions.
        x509cert2:
          type: string
          description: The backup certificate used to verify the signature in SAML assertions when x509cert1 expires.
          default: ''
        x509cert3:
          type: string
          description: The backup certificate used to verify the signature in SAML assertions when x509cert1 expires and x509cert2 is empty.
          default: ''
        onDemandProvisioningEnabled:
          $ref: '#/components/schemas/OnDemandProvisioningInfo'
        rolesAttribute:
          type: string
          description: The role that Sumo Logic will assign to users when they sign in.
          example: Sumo_Role
          default: ''
        logoutEnabled:
          type: boolean
          description: True if users are redirected to a URL after signing out of Sumo Logic.
          default: false
        logoutUrl:
          type: string
          description: The URL that users will be redirected to after signing out of Sumo Logic.
          example: https://www.sumologic.com
          default: ''
        emailAttribute:
          type: string
          description: The email address of the new user account.
          example: attribute/subject
          default: ''
        debugMode:
          type: boolean
          description: True if additional details are included when a user fails to sign in.
          default: false
        signAuthnRequest:
          type: boolean
          description: True if Sumo Logic will send signed Authn requests to the identity provider.
          default: false
        disableRequestedAuthnContext:
          type: boolean
          description: True if Sumo Logic will include the RequestedAuthnContext element of the SAML AuthnRequests it sends to the identity provider.
          default: false
        isRedirectBinding:
          type: boolean
          description: True if the SAML binding is of HTTP Redirect type.
          default: false
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
x-tagGroups:
- name: Archive Management
  tags:
  - archiveManagement
- name: Health Events
  tags:
  - healthEvents
- name: Infrequent Data Tier
  tags:
  - logSearchesEstimatedUsage
- name: Ingest Budgets Management V2
  tags:
  - ingestBudgetManagementV2
- name: Library Management
  tags:
  - appManagement
  - appManagementV2
  - contentManagement
  - dashboardManagement
  - folderManagement
  - lookupManagement
  - contentPermissions
  - logSearchesManagement
  - parsersLibraryManagement
- name: Metrics
  tags:
  - metricsSearchesManagement
  - transformationRuleManagement
  - metricsQuery
  - metricsSearchesManagementV2
- name: Security Management
  tags:
  - accessKeyManagement
  - oauthManagement
  - accountManagement
  - passwordPolicy
  - policiesManagement
  - samlConfigurationManagement
  - serviceAllowlistManagement
  - serviceAccountManagement
  - scimUserManagement
- name: Organizations Management
  tags:
  - orgsManagement
- name: Settings Management
  tags:
  - connectionManagement
  - dynamicParsingRuleManagement
  - extractionRuleManagement
  - fieldManagementV1
  - partitionManagement
  - scheduledViewManagement
  - logsDataForwardingManagement
  - dataDeletionRules
- name: Tokens Management
  tags:
  - tokensLibraryManagement
- name: Tracing
  tags:
  - traces
  - spanAnalytics
  - serviceMap
- name: Users and Roles Management
  tags:
  - roleManagement
  - roleManagementV2
  - userManagement
- name: Threat Intel Ingest Management
  tags:
  - threatIntelIngest
  - threatIntelIngestProducer
- name: OpenTelemetry Collector Management
  tags:
  - otCollectorManagementExternal
- name: Source Template Management
  tags:
  - sourceTemplateManagementExternal
- name: Schema Base Management
  tags:
  - schemaBaseManagement
- name: Event Analytics Management
  tags:
  - eventAnalytics
- name: Budget Management
  tags:
  - budgetManagement
- name: Macro Management
  tags:
  - macroManagement
- name: Muting Schedules Management
  tags:
  - mutingSchedulesLibraryManagement
- name: SLO Management
  tags:
  - slosLibraryManagement
- name: Monitor Management
  tags:
  - monitorsLibraryManagement