Panther

Panther s3 source API

The S3 source API handles all operations for AWS S3 log sources

Documentation GitHub OpenAPI

Operations 4

POST /log-sources/s3 create s3 source #

DELETE /log-sources/s3/{id} delete s3 source #

GET /log-sources/s3/{id} get s3 source #

PUT /log-sources/s3/{id} put s3 source #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/panther-s3-source-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Panther REST alert s3 source API
  version: '1.0'
  description: The alert api handles all operations for alerts
servers:
- url: https://{api_host}
  variables:
    api_host:
      default: your-api-host
security:
- ApiKeyAuth: []
tags:
- name: s3 source
  description: The S3 source API handles all operations for AWS S3 log sources
paths:
  /log-sources/s3:
    post:
      tags:
      - s3 source
      summary: create s3 source
      operationId: s3 source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/S3SourceAPI.CreateS3Source'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
  /log-sources/s3/{id}:
    delete:
      tags:
      - s3 source
      summary: delete s3 source
      operationId: s3 source#delete
      parameters:
      - name: id
        in: path
        description: ID of the S3 source to delete
        required: true
        schema:
          type: string
          description: ID of the S3 source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
    get:
      tags:
      - s3 source
      summary: get s3 source
      operationId: s3 source#get
      parameters:
      - name: id
        in: path
        description: ID of the S3 source to fetch
        required: true
        schema:
          type: string
          description: ID of the S3 source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
    put:
      tags:
      - s3 source
      summary: put s3 source
      operationId: s3 source#put
      parameters:
      - name: id
        in: path
        description: ID of the S3 source to update
        required: true
        schema:
          type: string
          description: ID of the S3 source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/S3SourceAPI.ModifyS3Source'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
components:
  schemas:
    S3SourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    S3SourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    S3SourceAPI.ModifyS3Source:
      type: object
      properties:
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
          - Auto
          - JSON
          - JsonArray
          - Lines
          - XML
          - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
      required:
      - integrationLabel
      - s3PrefixLogTypes
      - managedBucketNotifications
      - logProcessingRole
      - logStreamType
    S3SourceAPI.S3Source:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The AWS account ID where the S3 bucket resides
        integrationId:
          type: string
          description: The unique ID of the S3 log source
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
          - Auto
          - JSON
          - JsonArray
          - Lines
          - XML
          - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3Bucket:
          type: string
          description: The S3 bucket name
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
    S3SourceAPI.S3LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the JSON array field to extract records from. Only applicable when logStreamType is JsonArray. Omit if the input is already a top-level array.
        retainEnvelopeFields:
          type: boolean
          description: Preserve CloudWatch Logs envelope metadata (accountId, logGroup, subscriptionFilters) in a p_header column. Only applicable when logStreamType is CloudWatchLogs.
        xmlRootElement:
          type: string
          description: Root element wrapping XML events. Only applicable when logStreamType is XML. Omit if events are not enclosed in a root element.
    S3SourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    S3SourceAPI.PrefixLogTypesMapping:
      type: object
      properties:
        excludedPrefixes:
          type: array
          items:
            type: string
          description: Prefixes to exclude from matching. Use '*' as a wildcard for dynamic path segments.
        logTypes:
          type: array
          items:
            type: string
          description: The log types (schemas) to apply for this prefix
        prefix:
          type: string
          description: S3 prefix to match. Leave empty to match all objects in the bucket.
    S3SourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
      - message
    S3SourceAPI.CreateS3Source:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The 12-digit AWS account ID where the S3 bucket resides
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
          - Auto
          - JSON
          - JsonArray
          - Lines
          - XML
          - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3Bucket:
          type: string
          description: The S3 bucket name
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
      required:
      - awsAccountId
      - s3Bucket
      - integrationLabel
      - s3PrefixLogTypes
      - managedBucketNotifications
      - logProcessingRole
      - logStreamType
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: X-API-Key
      in: header