Splunk Observability Cloud Incidents and alerts
API for retrieving or clearing incidents and muting "critical-notifications".
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Incidents and alerts
version: 3.7.1
description: 'API for retrieving or clearing incidents and muting "critical-notifications".
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You have to have the Splunk Observability Cloud admin, power, or read_only role to use the GET /incident, GET /incident/{id},
GET /alertmuting, and GET /alertmuting/{id} operations.
You have to have the Splunk Observability Cloud admin or power role to use the PUT /incident/clear, PUT /incident/{id}/clear,
POST /alertmuting, PUT /alertmuting/{id}, DELETE /alertmuting/{id}, and PUT /alertmuting/{id}/unmute operations.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Incident/Notification API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/alertmuting:
get:
summary: Retrieve Muting Rules Using Query
description: 'Retrieves muting rules based on the query
you specify in the query query parameter.
This endpoint retrieves muting rules regardless of the version
of the detector associated with the rule.
Note: Splunk Observability Cloud returns a maximum of 10,000 rules, even if your organization contains more than 10,000.
To learn more, see the
Considerations for retrieve operations section in the developer guide.'
parameters:
- name: include
in: query
description: 'Specifies the type of muting rules you want to retrieve. The allowed values are:
Past: Retrieve expired muting rules
Future: Retrieve muting rules scheduled to start in the future
Ongoing: Retrieve currently active muting rules
Open: Retrieve muting rules with no scheduled end date
All: Retrieve muting rules of all types'
schema:
type: string
enum:
- Past
- Future
- Ongoing
- Open
- All
example: All
- name: limit
in: query
description: 'The number of results to return from the
result set.'
schema:
type: integer
format: int32
example: 50
- name: offset
in: query
description: 'The result object in the result set at which
the API should start returning results to you.
If omitted, the API starts at the first result
in the set.'
schema:
type: integer
format: int32
example: 0
- name: order_by
in: query
description: 'The metadata property on which the API should
sort the results. You don''t have to include
this property in the query, but the name must
be a property of muting rules.
Prepend a - character to the property name to sort in descending order. If you want to apply order_by to non-custom
property fields like timestamp, prepend the field with sf_. For example: order_by=-sf_timestamp.'
schema:
type: string
example: sf_timestamp
- name: query
in: query
description: 'Specify which muting rules to retrieve based on description and filters.
You can retrieve muting rules with description containing specific keywords using this format: query=sf_description:<pattern>.
For example, this is a query for muting rules with description related to CPU: query=sf_description:cpu_*.
You can retrieve muting rules with filters containing specific keywords using this format: query=sf_filters.lowercase:<pattern>.
For example, this is a query for muting rules with filters for the AWS US East region: query=sf_filters.lowercase:us-east-2a.
To search for muting rules by specific values of a dimension or custom property, use query=<name>:<value>. If <value>
contains non-alphanumeric characters, encode the non-alphanumeric characters and surround the value with double
quotes. For example, the region custom property value US East must be passed in the parameter as region:"US%20East".
Note: The value for sf_description is case sensitive.'
schema:
type: string
example: sf_description:cpu_*
- name: X-SF-TOKEN
in: header
description: Authentication token.
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
count:
title: Count of matched muting rules
type: integer
format: int64
readOnly: true
description: 'Number of muting rules that match the search criteria.
This property is read-only.
Note: Count is not the same as the number of objects returned
in the response body:
sizeOf(results): Size of the array returned in the response body.
count: Number of rules that match the search criteria'
results:
type: array
items:
type: object
properties:
created:
title: Creation time
type: integer
format: int64
example: 1556825430000
readOnly: true
description: 'The time the muting rule was created, in *nix time in milliseconds.
This property is read-only; it''s always set by the system.'
creator:
title: Creator user ID
type: string
example: AAXYAAAAAZ3
readOnly: true
description: 'User ID of the muting rule creator.
This property is read-only; it''s always set by the system.'
description:
type: string
readOnly: false
writeOnly: false
description: Description of the muting rule. It is best practice to provide a descriptive reason
for the muting rule.
filters:
type: array
items:
type: object
properties:
NOT:
type: boolean
default: false
description: 'Flag that controls the filter semantics. If true, the filter
does a not equals comparison. Otherwise, the filter does an
equals comparison. The default is false.'
property:
type: string
description: 'Name (key) of a dimension or custom property that one or more detectors
are monitoring for anomalies. The filter compares the value of property
to the value or values of propertyValue.'
propertyValue:
anyOf:
- title: Boolean
type: boolean
description: Boolean value
- title: Integer or Float
type: number
description: Integer or floating point number
- title: String
type: string
description: String value
- title: Array
type: array
items:
anyOf:
- type: number
- type: string
- type: boolean
description: 'List of numbers, strings, or booleans, as a JSON array. You can
specify multiple types in the same array.'
description: Value that the API compares to the value of property.
example: "[\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
: \"us-east-1a\"\n },\n {\n \"NOT\": true,\n \"property\": \"cpu.utilization\",\n \
\ \"propertyValue\": 10.7\n },\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\"\
,\n \"propertyValue\":\n [\n \"us-east-2a\",\n \"us-west-1a\",\n \
\ \"emea-west-2a\"\n ]\n }\n]\n"
title: AlertMutingFilter
description: 'Single muting filter for a rule, in the form of a JSON
object. Specifies the dimension or custom property to filter on, the
value or values to match, and a boolean value that controls the match semantics.
The filter mutes an alert based on the following:
NOT = false: Value of property EQ propertyValue
NOT = true: Value of property NE propertyValue
If propertyValue is an array, then the filter mutes an alert based on
the following:
NOT = false: Value of property matches any element of propertyValue
NOT = true: Value of property matches none of the elements of propertyValue'
description: 'List of muting filters for this rule, in the form of a JSON
array. Each array element specifies a single filter.
A muting filter JSON specifies the following:
property: The dimension or custom property to compare to
propertyValue
propertyValue: A number, string, or array
NOT: A flag that controls the comparison.
A filter mutes an alert based on the following:
NOT = false: value of property EQ propertyValue
NOT = true: value of property NE propertyValue
If propertyValue is an array, then the filter mutes an alert based on
the following:
NOT = false: value of property matches any element of
propertyValue
NOT = true: value of property matches none of the elements of
propertyValue'
id:
title: Muting rule ID
type: string
readOnly: true
description: 'ID of a muting rule.
This property is read-only; it''s always set by the system.'
lastUpdated:
title: Muting rule last updated time
type: integer
format: int64
example: 1557689430000
readOnly: true
description: 'The last time the muting rule was last updated, in *nix time in milliseconds.
This property is read-only; it''s always set by the system.'
lastUpdatedBy:
title: ID of user who last updated the muting rule
type: string
readOnly: true
description: 'The ID of the last user who updated the
muting rule. If Splunk Observability Cloud made the last update, the value is
"AAAAAAAAAA". This property is read-only; it''s always set by the system.'
recurrence:
type: object
properties:
unit:
example: d
type: string
enum:
- d
- w
description: Unit of the period. Can be days (d) or weeks (w).
value:
example: 2
type: integer
minimum: 1
description: Amount of time, expressed as an integer applicable to the unit.
title: recurrence
description: 'Recurrence period of the muting rule. Recurrence can be daily, weekly,
or custom, based on the number of days or weeks you provide. Note that
the recurrence period must be larger than the muting duration.'
linkedTeams:
title: IDs of teams linked to the detector that created the incident.
type: array
items:
type: string
readOnly: true
example:
- AbcdEf1ABCD
- FO1Vq3ABXYZ
description: IDs of teams linked to the detector that created the incident. If the incident is created
by a detector that is not linked to a team, the value is null. This is a JSON array of strings,
where each string is a team ID. This property is read-only; it's always set by the system. For
information about how to link detectors to teams, see Detectors linked to teams.
sendAlertsOnceMutingPeriodHasEnded:
type: boolean
default: true
example: true
readOnly: false
title: SendAlertsOnceMutingPeriodHasEnded
description: 'Controls notifications after the muting period ends.
To learn more, see Mute alert notifications
in the user documentation.'
startTime:
type: integer
format: int64
minimum: 0
readOnly: false
writeOnly: false
title: StartTime
description: 'Starting time of a muting rule, in *nix time in milliseconds. If not specified,
defaults to the current time. read/write.'
stopTime:
type: integer
format: int64
minimum: 0
default: 0
readOnly: false
writeOnly: false
title: StopTime
description: 'Stop time of a muting rule, in *nix time in milliseconds. If set to 0, detectors
that match this rule are muted indefinitely. The default value is 0.
read/write'
title: AlertMutingRule
description: 'Properties of a muting rule, in the form of a JSON object.
Note: You can''t create or update properties marked read-only. You
receive read-only properties in response bodies for the following:
GET /alertmuting
POST /alertmuting
GET /alertmuting/{id}
PUT /alertmuting/{id}
The response body for this request contains a string representation of
any non-string values you specify for propertyValue.'
description: 'Query results, in the form of a JSON array of
objects. Each element is a muting rule.'
title: RetrieveAlertMutingRulesResponse
description: Response body for GET /alertmuting, in the form of a JSON object.
examples:
example:
value:
count: 0
results:
- created: 1556825430000
creator: AAXYAAAAAZ3
description: string
filters:
- "[\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
: \"us-east-1a\"\n },\n {\n \"NOT\": true,\n \"property\": \"cpu.utilization\",\n \"propertyValue\"\
: 10.7\n },\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
:\n [\n \"us-east-2a\",\n \"us-west-1a\",\n \"emea-west-2a\"\n ]\n\
\ }\n]\n"
id: string
lastUpdated: 1557689430000
lastUpdatedBy: string
linkedTeams:
- AbcdEf1ABCD
- FO1Vq3ABXYZ
recurrence:
unit: d
value: 2
sendAlertsOnceMutingPeriodHasEnded: true
startTime: 0
stopTime: 0
security:
- SessionToken: []
tags:
- Incidents and alerts
post:
summary: Create Single Muting Rule
description: 'Creates a new muting rule, based on the
specifications in the request body. Unlike the detector APIs, you can
use the muting APIs with detectors you create in the UI as
well as detectors you create with the API.
Note: In some cases, Splunk Observability Cloud may send notifications during a muting period.
To learn more, see the section
Mute alert notifications
in the user documentation.
When you create a muting rule, you can resolve all of the alerts for the
muting rule you created by setting the optional resolveMatchingActiveAlerts
query parameter to true. The flag''s default value is false.'
parameters:
- name: resolveMatchingActiveAlerts
in: query
description: 'Optional resolve alerts flag. If you set the flag to true,
Splunk Observability Cloud resolves the alerts that match the muting rule you created.
If you leave out the parameter or set it to false, Splunk Observability Cloud takes no action.'
schema:
type: boolean
- name: Content-Type
in: header
description: Format of the request body. Always "application/json".
required: true
schema:
type: string
- name: X-SF-TOKEN
in: header
description: Authentication token.
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
created:
title: Creation time
type: integer
format: int64
example: 1556825430000
readOnly: true
description: 'The time the muting rule was created, in *nix time in milliseconds.
This property is read-only; it''s always set by the system.'
creator:
title: Creator user ID
type: string
example: AAXYAAAAAZ3
readOnly: true
description: 'User ID of the muting rule creator.
This property is read-only; it''s always set by the system.'
description:
type: string
readOnly: false
writeOnly: false
description: Description of the muting rule. It is best practice to provide a descriptive reason for the
muting rule.
filters:
type: array
items:
type: object
properties:
NOT:
type: boolean
default: false
description: 'Flag that controls the filter semantics. If true, the filter
does a not equals comparison. Otherwise, the filter does an
equals comparison. The default is false.'
property:
type: string
description: 'Name (key) of a dimension or custom property that one or more detectors
are monitoring for anomalies. The filter compares the value of property
to the value or values of propertyValue.'
propertyValue:
anyOf:
- title: Boolean
type: boolean
description: Boolean value
- title: Integer or Float
type: number
description: Integer or floating point number
- title: String
type: string
description: String value
- title: Array
type: array
items:
anyOf:
- type: number
- type: string
- type: boolean
description: 'List of numbers, strings, or booleans, as a JSON array. You can
specify multiple types in the same array.'
description: Value that the API compares to the value of property.
example: "[\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
: \"us-east-1a\"\n },\n {\n \"NOT\": true,\n \"property\": \"cpu.utilization\",\n \"propertyValue\"\
: 10.7\n },\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
:\n [\n \"us-east-2a\",\n \"us-west-1a\",\n \"emea-west-2a\"\n ]\n }\n\
]\n"
title: AlertMutingFilter
description: 'Single muting filter for a rule, in the form of a JSON
object. Specifies the dimension or custom property to filter on, the
value or values to match, and a boolean value that controls the match semantics.
The filter mutes an alert based on the following:
NOT = false: Value of property EQ propertyValue
NOT = true: Value of property NE propertyValue
If propertyValue is an array, then the filter mutes an alert based on
the following:
NOT = false: Value of property matches any element of propertyValue
NOT = true: Value of property matches none of the elements of propertyValue'
description: 'List of muting filters for this rule, in the form of a JSON
array. Each array element specifies a single filter.
A muting filter JSON specifies the following:
property: The dimension or custom property to compare to
propertyValue
propertyValue: A number, string, or array
NOT: A flag that controls the comparison.
A filter mutes an alert based on the following:
NOT = false: value of property EQ propertyValue
NOT = true: value of property NE propertyValue
If propertyValue is an array, then the filter mutes an alert based on
the following:
NOT = false: value of property matches any element of
propertyValue
NOT = true: value of property matches none of the elements of
propertyValue'
id:
title: Muting rule ID
type: string
readOnly: true
description: 'ID of a muting rule.
This property is read-only; it''s always set by the system.'
lastUpdated:
title: Muting rule last updated time
type: integer
format: int64
example: 1557689430000
readOnly: true
description: 'The last time the muting rule was last updated, in *nix time in milliseconds.
This property is read-only; it''s always set by the system.'
lastUpdatedBy:
title: ID of user who last updated the muting rule
type: string
readOnly: true
description: 'The ID of the last user who updated the
muting rule. If Splunk Observability Cloud made the last update, the value is
"AAAAAAAAAA". This property is read-only; it''s always set by the system.'
recurrence:
type: object
properties:
unit:
example: d
type: string
enum:
- d
- w
description: Unit of the period. Can be days (d) or weeks (w).
value:
example: 2
type: integer
minimum: 1
description: Amount of time, expressed as an integer applicable to the unit.
title: recurrence
description: 'Recurrence period of the muting rule. Recurrence can be daily, weekly,
or custom, based on the number of days or weeks you provide. Note that
the recurrence period must be larger than the muting duration.'
linkedTeams:
title: IDs of teams linked to the detector that created the incident.
type: array
items:
type: string
readOnly: true
example:
- AbcdEf1ABCD
- FO1Vq3ABXYZ
description: IDs of teams linked to the detector that created the incident. If the incident is created by
a detector that is not linked to a team, the value is null. This is a JSON array of strings, where each
string is a team ID. This property is read-only; it's always set by the system. For information about
how to link detectors to teams, see Detectors linked to teams.
sendAlertsOnceMutingPeriodHasEnded:
type: boolean
default: true
example: true
readOnly: false
title: SendAlertsOnceMutingPeriodHasEnded
description: 'Controls notifications after the muting period ends.
To learn more, see Mute alert notifications
in the user documentation.'
startTime:
type: integer
format: int64
minimum: 0
readOnly: false
writeOnly: false
title: StartTime
description: 'Starting time of a muting rule, in *nix time in milliseconds. If not specified,
defaults to the current time. read/write.'
stopTime:
type: integer
format: int64
minimum: 0
default: 0
readOnly: false
writeOnly: false
title: StopTime
description: 'Stop time of a muting rule, in *nix time in milliseconds. If set to 0, detectors
that match this rule are muted indefinitely. The default value is 0.
read/write'
title: AlertMutingRule
description: 'Properties of a muting rule, in the form of a JSON object.
Note: You can''t create or update properties marked read-only. You
receive read-only properties in response bodies for the following:
GET /alertmuting
POST /alertmuting
GET /alertmuting/{id}
PUT /alertmuting/{id}
The response body for this request contains a string representation of
any non-string values you specify for propertyValue.'
examples:
example:
value:
created: 1556825430000
creator: AAXYAAAAAZ3
description: string
filters:
- "[\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\": \"\
us-east-1a\"\n },\n {\n \"NOT\": true,\n \"property\": \"cpu.utilization\",\n \"propertyValue\"\
: 10.7\n },\n {\n \"NOT\": false,\n \"property\": \"aws_availability_zone\",\n \"propertyValue\"\
:\n [\n \"us-east-2a\",\n \"us-west-1a\",\n \"emea-west-2a\"\n ]\n }\n\
]\n"
id: string
lastUpdated: 1557689430000
lastUpdatedBy: string
linkedTeams:
- AbcdEf1ABCD
- FO1Vq3ABXYZ
recurrence:
unit: d
value: 2
sendAlertsOnceMutingPeriodHasEnded: true
# --- truncated at 32 KB (127 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-incidents-openapi.yml