Cribl Edge Sources API

openapi: 3.2.0
info:
  title: Cribl Edge Edge Sources API
  description: The Cribl Edge API provides programmatic access to Cribl Edge, which extends Stream capabilities to the network edge by deploying lightweight agents on endpoints. The API allows developers to manage edge fleets, configure data collection from endpoints, and control data processing closer to the source. This reduces bandwidth consumption and latency by filtering and transforming data at the point of origin before forwarding it to centralized destinations. Edge API endpoints are accessed through the Cribl Cloud control plane using fleet context paths.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Edge Sources
  description: Manage data input sources on edge nodes including file monitors, Windows Event Log, system metrics, AppScope, and other local collection methods.
paths:
  /m/{fleetId}/system/sources:
    get:
      operationId: listEdgeSources
      summary: List edge sources in a fleet
      description: Retrieves all data input sources configured for an edge fleet including file monitors, Windows Event Log, system metrics, AppScope, and other local collection sources.
      tags:
      - Edge Sources
      parameters:
      - $ref: '#/components/parameters/fleetId'
      responses:
        '200':
          description: Successfully retrieved edge sources
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/EdgeSource'
                  count:
                    type: integer
                    description: Total number of sources
        '401':
          description: Unauthorized
        '404':
          description: Fleet not found
    post:
      operationId: createEdgeSource
      summary: Create an edge source in a fleet
      description: Creates a new data input source for an edge fleet to collect data from endpoints.
      tags:
      - Edge Sources
      parameters:
      - $ref: '#/components/parameters/fleetId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EdgeSource'
      responses:
        '200':
          description: Edge source created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeSource'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
components:
  parameters:
    fleetId:
      name: fleetId
      in: path
      required: true
      description: The edge fleet identifier
      schema:
        type: string
  schemas:
    EdgeSource:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the edge source
        type:
          type: string
          description: The source type such as file_monitor, windows_event_log, system_metrics, appscope, syslog, or journald
        disabled:
          type: boolean
          description: Whether the source is disabled
        description:
          type: string
          description: A human-readable description
        pipeline:
          type: string
          description: The pipeline to process events
        streamtags:
          type: array
          items:
            type: string
          description: Tags applied to events from this source
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant (Cribl Cloud) or the /auth/login endpoint (on-premises).
externalDocs:
  description: Cribl Edge Documentation
  url: https://docs.cribl.io/edge/