Cribl

Cribl Sources API

Manage data input sources that collect events from various systems including Syslog, HTTP, Kafka, Splunk, and other protocols.

Documentation GitHub OpenAPI

Operations 7

GET /system/sources List all sources #

POST /system/sources Create a new source #

GET /system/sources/{id} Get a source by ID #

PATCH /system/sources/{id} Update a source #

DELETE /system/sources/{id} Delete a source #

GET /m/{groupId}/system/sources List Stream sources in a worker group #

POST /m/{groupId}/system/sources Create a Stream source in a worker group #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/cribl-sources-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Cribl Sources API
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
  description: 'Operations tagged Sources across 2 of this provider''s published API definitions: cribl-cloud-api-openapi.yml, cribl-stream-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Sources
  description: Manage data input sources that collect events from various systems including Syslog, HTTP, Kafka, Splunk, and other protocols.
paths:
  /system/sources:
    get:
      operationId: listSources
      summary: List all sources
      description: Retrieves a list of all configured data input sources in the current context, including their type, status, and configuration details.
      tags:
      - Sources
      responses:
        '200':
          description: Successfully retrieved sources
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Source'
                  count:
                    type: integer
                    description: Total number of sources
        '401':
          description: Unauthorized
    post:
      operationId: createSource
      summary: Create a new source
      description: Creates a new data input source with the specified type and configuration. The source type determines which configuration properties are required.
      tags:
      - Sources
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Source'
      responses:
        '200':
          description: Source created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
    - url: https://{hostname}:{port}/api/v1
      description: On-Premises Deployment
      variables:
        hostname:
          default: localhost
          description: The hostname of the Cribl instance
        port:
          default: '9000'
          description: The port of the Cribl instance
  /system/sources/{id}:
    get:
      operationId: getSource
      summary: Get a source by ID
      description: Retrieves the configuration and status of a specific data input source identified by its unique ID.
      tags:
      - Sources
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved source
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '401':
          description: Unauthorized
        '404':
          description: Source not found
    patch:
      operationId: updateSource
      summary: Update a source
      description: Updates the configuration of an existing data input source. Only provided fields are modified.
      tags:
      - Sources
      parameters:
      - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Source'
      responses:
        '200':
          description: Source updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
        '404':
          description: Source not found
    delete:
      operationId: deleteSource
      summary: Delete a source
      description: Deletes a data input source by its unique ID. The source must not be actively receiving data.
      tags:
      - Sources
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Source deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Source not found
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
    - url: https://{hostname}:{port}/api/v1
      description: On-Premises Deployment
      variables:
        hostname:
          default: localhost
          description: The hostname of the Cribl instance
        port:
          default: '9000'
          description: The port of the Cribl instance
  /m/{groupId}/system/sources:
    get:
      operationId: listStreamSources
      summary: List Stream sources in a worker group
      description: Retrieves all data input sources configured within a specific worker group including Syslog, HTTP, Kafka, and other sources.
      tags:
      - Sources
      parameters:
      - $ref: '#/components/parameters/groupId'
      responses:
        '200':
          description: Successfully retrieved sources
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Source_2'
                  count:
                    type: integer
                    description: Total number of sources
        '401':
          description: Unauthorized
        '404':
          description: Worker group not found
    post:
      operationId: createStreamSource
      summary: Create a Stream source in a worker group
      description: Creates a new data input source within a worker group with the specified type and configuration for data collection.
      tags:
      - Sources
      parameters:
      - $ref: '#/components/parameters/groupId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Source_2'
      responses:
        '200':
          description: Source created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source_2'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
    - url: https://{hostname}:{port}/api/v1
      description: On-Premises Deployment
      variables:
        hostname:
          default: localhost
          description: The hostname of the Cribl instance
        port:
          default: '9000'
          description: The port of the Cribl instance
components:
  parameters:
    resourceId:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource
      schema:
        type: string
    groupId:
      name: groupId
      in: path
      required: true
      description: The worker group or fleet identifier
      schema:
        type: string
  schemas:
    Source:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the source
        type:
          type: string
          description: The source type such as syslog, http, kafka, splunk_tcp, tcp_json, file_monitor, or others
        disabled:
          type: boolean
          description: Whether the source is disabled
        host:
          type: string
          description: The host or address to listen on
        port:
          type: integer
          description: The port number to listen on
        description:
          type: string
          description: A human-readable description of the source
        pipeline:
          type: string
          description: The pipeline to send events to
        environment:
          type: string
          description: The environment context
        streamtags:
          type: array
          items:
            type: string
          description: Tags applied to events from this source
    Source_2:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the source
        type:
          type: string
          description: The source type such as syslog, http, kafka, splunk_tcp, tcp_json, file_monitor, or others
        disabled:
          type: boolean
          description: Whether the source is disabled
        host:
          type: string
          description: The host or address to listen on
        port:
          type: integer
          description: The port number to listen on
        pipeline:
          type: string
          description: The pipeline to process events from this source
        description:
          type: string
          description: A human-readable description
        streamtags:
          type: array
          items:
            type: string
          description: Tags applied to events from this source
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant (Cribl Cloud) or the /auth/login endpoint (on-premises).
    oauth2:
      type: oauth2
      description: OAuth 2.0 client credentials flow for Cribl Cloud authentication. Tokens expire after 24 hours.
      flows:
        clientCredentials:
          tokenUrl: https://login.cribl.cloud/oauth/token
          scopes: {}
x-refined-from:
- cribl-cloud-api-openapi.yml
- cribl-stream-api-openapi.yml