Cribl Saved Searches API

openapi: 3.2.0
info:
  title: Cribl Search Saved Searches API
  description: The Cribl Search API provides programmatic access to Cribl Search, a tool for exploring and querying both live and stored observability data in real time. Developers can use the API to execute search queries, manage datasets, configure search jobs, and integrate federated search capabilities into their own applications and workflows. Cribl Search supports federated search across multiple data sources, enabling organizations to gain insights without needing to move or duplicate data into a single location.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Saved Searches
  description: Create and manage saved search queries for reuse and sharing across teams and workflows.
paths:
  /search/saved:
    get:
      operationId: listSavedSearches
      summary: List all saved searches
      description: Retrieves all saved search queries that can be reused and shared across teams.
      tags:
      - Saved Searches
      responses:
        '200':
          description: Successfully retrieved saved searches
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SavedSearch'
                  count:
                    type: integer
                    description: Total number of saved searches
        '401':
          description: Unauthorized
    post:
      operationId: createSavedSearch
      summary: Create a saved search
      description: Creates a new saved search query for reuse and sharing with other team members.
      tags:
      - Saved Searches
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
      responses:
        '200':
          description: Saved search created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '400':
          description: Invalid saved search configuration
        '401':
          description: Unauthorized
  /search/saved/{id}:
    get:
      operationId: getSavedSearch
      summary: Get a saved search by ID
      description: Retrieves the configuration of a specific saved search query.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved saved search
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
    patch:
      operationId: updateSavedSearch
      summary: Update a saved search
      description: Updates the configuration of an existing saved search query.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
      responses:
        '200':
          description: Saved search updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '400':
          description: Invalid saved search configuration
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
    delete:
      operationId: deleteSavedSearch
      summary: Delete a saved search
      description: Deletes a saved search by its unique ID.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Saved search deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
components:
  schemas:
    SavedSearch:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the saved search
        name:
          type: string
          description: Display name of the saved search
        description:
          type: string
          description: A human-readable description
        query:
          type: string
          description: The search query
        dataset:
          type: string
          description: The default dataset
        earliest:
          type: string
          description: Default earliest time range
        latest:
          type: string
          description: Default latest time range
        owner:
          type: string
          description: The owner of the saved search
  parameters:
    resourceId:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource
      schema:
        type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant (Cribl Cloud) or the /auth/login endpoint (on-premises).
externalDocs:
  description: Cribl Search Documentation
  url: https://docs.cribl.io/search/