Panther

Panther gcs source API

The GCS source API handles all operations for Google Cloud Storage log sources

GitHub OpenAPI

Documentation

📖
Authentication
https://raw.githubusercontent.com/api-evangelist/panther/refs/heads/main/authentication/panther-authentication.yml
📖
APIReference
https://docs.panther.com/panther-developer-workflows/api/rest

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/panther/refs/heads/main/openapi/panther-gcs-source-api-openapi.yml

Other Resources

🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/panther/refs/heads/main/conventions/panther-conventions.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/panther/refs/heads/main/errors/panther-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/panther/refs/heads/main/data-model/panther-data-model.yml
🔗
Sandbox
https://docs.panther.com/panther-developer-workflows/api/api-playground

OpenAPI Specification

panther-gcs-source-api-openapi.yml Raw ↑ 
openapi: 3.0.3
info:
  title: Panther REST alert gcs source API
  version: '1.0'
  description: The alert api handles all operations for alerts
servers:
- url: https://{api_host}
  variables:
    api_host:
      default: your-api-host
security:
- ApiKeyAuth: []
tags:
- name: gcs source
  description: The GCS source API handles all operations for Google Cloud Storage log sources
paths:
  /log-sources/gcs:
    post:
      tags:
      - gcs source
      summary: create gcs source
      operationId: gcs source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcsSourceAPI.ModifyGcsSource'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
  /log-sources/gcs/{id}:
    delete:
      tags:
      - gcs source
      summary: delete gcs source
      operationId: gcs source#delete
      parameters:
      - name: id
        in: path
        description: ID of the GCS source to delete
        required: true
        schema:
          type: string
          description: ID of the GCS source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
    get:
      tags:
      - gcs source
      summary: get gcs source
      operationId: gcs source#get
      parameters:
      - name: id
        in: path
        description: ID of the GCS source to fetch
        required: true
        schema:
          type: string
          description: ID of the GCS source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
    put:
      tags:
      - gcs source
      summary: put gcs source
      operationId: gcs source#put
      parameters:
      - name: id
        in: path
        description: ID of the GCS source to update
        required: true
        schema:
          type: string
          description: ID of the GCS source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcsSourceAPI.ModifyGcsSource'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
components:
  schemas:
    GcsSourceAPI.ModifyGcsSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
          - service_account
          - wif
        gcsBucket:
          type: string
          description: The GCS bucket name
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
          - Auto
          - JSON
          - JsonArray
          - Lines
          - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/GcsSourceAPI.LogStreamTypeOptions'
        prefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials. Required for WIF.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID used to receive GCS bucket notifications
      required:
      - integrationLabel
      - subscriptionId
      - gcsBucket
      - prefixLogTypes
      - logStreamType
      - credentialsType
    GcsSourceAPI.GcsSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
          - service_account
          - wif
        gcsBucket:
          type: string
          description: The GCS bucket name
        integrationId:
          type: string
          description: The id of the GCS source
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
          - Auto
          - JSON
          - JsonArray
          - Lines
          - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/GcsSourceAPI.LogStreamTypeOptions'
        prefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials. Required for WIF.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID used to receive GCS bucket notifications
    GcsSourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    GcsSourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    GcsSourceAPI.PrefixLogTypesMapping:
      type: object
      properties:
        excludedPrefixes:
          type: array
          items:
            type: string
          description: Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments.
        logTypes:
          type: array
          items:
            type: string
          description: The log types (schemas) to apply for this prefix
        prefix:
          type: string
          description: GCS prefix to match. Leave empty to match all files in the bucket.
    GcsSourceAPI.LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
        xmlRootElement:
          type: string
          description: The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
    GcsSourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    GcsSourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: X-API-Key
      in: header