Cribl Saved Searches API

openapi: 3.2.0
info:
  title: Cribl Search Saved Searches API
  description: The Cribl Search API provides programmatic access to Cribl Search, a tool for exploring and querying both live and stored observability data in real time.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Saved Searches
  description: Create and manage saved search queries for reuse and sharing across teams and workflows.
paths:
  /search/saved:
    get:
      operationId: listSavedSearches
      summary: List all saved searches
      description: Retrieves all saved search queries that can be reused and shared across teams.
      tags:
      - Saved Searches
      responses:
        '200':
          description: Successfully retrieved saved searches
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SavedSearch'
                  count:
                    type: integer
                    description: Total number of saved searches
        '401':
          description: Unauthorized
    post:
      operationId: createSavedSearch
      summary: Create a saved search
      description: Creates a new saved search query for reuse and sharing with other team members.
      tags:
      - Saved Searches
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
      responses:
        '200':
          description: Saved search created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '400':
          description: Invalid saved search configuration
        '401':
          description: Unauthorized
  /search/saved/{id}:
    get:
      operationId: getSavedSearch
      summary: Get a saved search by ID
      description: Retrieves the configuration of a specific saved search query.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved saved search
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
    patch:
      operationId: updateSavedSearch
      summary: Update a saved search
      description: Updates the configuration of an existing saved search query.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SavedSearch'
      responses:
        '200':
          description: Saved search updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SavedSearch'
        '400':
          description: Invalid saved search configuration
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
    delete:
      operationId: deleteSavedSearch
      summary: Delete a saved search
      description: Deletes a saved search by its unique ID.
      tags:
      - Saved Searches
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Saved search deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Saved search not found
components:
  parameters:
    resourceId:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource
      schema:
        type: string
  schemas:
    SavedSearch:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the saved search
        name:
          type: string
          description: Display name of the saved search
        description:
          type: string
          description: A human-readable description
        query:
          type: string
          description: The search query
        dataset:
          type: string
          description: The default dataset
        earliest:
          type: string
          description: Default earliest time range
        latest:
          type: string
          description: Default latest time range
        owner:
          type: string
          description: The owner of the saved search
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant (Cribl Cloud) or the /auth/login endpoint (on-premises).
externalDocs:
  description: Cribl Search Documentation
  url: https://docs.cribl.io/search/