Splunk Observability Cloud Integrations
API for creating, retrieving, updating, and deleting integrations, which define the connection between an external system and Splunk Observability Cloud.
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Integrations
version: 5.0.1
description: 'API for creating, retrieving, updating, and deleting integrations, which define the connection between an
external system and Splunk Observability Cloud.
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You have to have the Splunk Observability Cloud admin role to use the POST /integration, GET /integration, GET /integration/{id},
PUT /integration/{id}, DELETE /integration/{id}, and GET /integration/validate/{id} operations.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Integrations API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/integration:
get:
summary: Retrieve Integrations Query
description: 'Retrieves one or more integration objects based on a query specified in
query parameters encoded on the URL.
Notes:
To ensure security, the API omits some authentication and authorization properties from response objects.
Note: Splunk Observability Cloud returns a maximum of 10,000 objects, even if your organization contains more than
10,000. To learn more, see the Considerations for retrieve operations section in the Developer Guide for Splunk Observability
Cloud.
Jira integration:
The response body for a Jira integration contains a union of the following
response properties:
Properties common to all integration responses
Properties common to all Jira integration responses
Authentication credential properties for Jira Cloud integrations
Authentication credential properties for Jira Server integrations
Some Jira integration properties are set to null in the response:
Optional properties that you didn''t specify in your creation request
Password or API token, to ensure security
Properties not used for a specific type of Jira integration.
For example, if you integrate with Jira Cloud, the response body contains
"username"\: null because username isn''t a valid property for a
Jira Cloud integration.'
parameters:
- name: name
in: query
description: 'Integration object name to search for. You can use wildcard
characters to specify the name:
*: Matches a run of any characters in any part of the name
?: Matches any single character in any part of the name'
schema:
type: string
- name: type
in: query
description: 'Type of integration to search for. This property is an enumerated
string, and only the enumerated values are allowed.
To search for a Microsoft Teams integration, use Office365.'
schema:
type: string
enum:
- ADFS
- AWSCloudWatch
- AmazonEventBridge
- Azure
- AzureAD
- BigPanda
- GCP
- GoogleSaml
- Jira
- Office365
- Okta
- OneLogin
- Opsgenie
- PagerDuty
- PingOne
- ServiceNow
- Slack
- VictorOps
- Webhook
- XMatters
- name: offset
in: query
description: '0-relative position in the result set where the API should start
returning integration objects.'
schema:
type: integer
format: int32
default: 0
minimum: 0
- name: limit
in: query
description: Number of integration objects to return from the result set
schema:
type: integer
format: int32
default: 50
minimum: 1
- name: userParam
in: query
description: 'Return user name values in the response based on the full name value from the user''s profile.
To return the name of the user who created the integration, specify userParam=creator. The system responds by populating
the createdByName field with the name of the user who created the integration, instead of the default value of null.
To return the name of the user who last updated the integration, specify userParam=lastUpdatedBy. The system responds
by populating the lastUpdatedByName field with the name of the user who last updated the integration, instead of
the default value of null.
You can specify one or both parameter values. For example, to include both parameters, specify userParam=creator&userParam=lastUpdatedBy.
This property is an enumerated string, and only the enumerated values are allowed.'
schema:
type: string
enum:
- creator
- lastUpdatedBy
- name: X-SF-TOKEN
in: header
description: Authentication token
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
count:
type: integer
format: int64
description: 'Number of integrations that matched the search criteria. This
value is not the number of integrations returned in the
response body. To learn more, see the description of results.'
results:
type: array
items:
oneOf:
- title: Microsoft ADFS Integration
properties:
created:
title: Integration Creation Time
type: integer
format: int64
example: 1556361030000
readOnly: true
description: 'Date and time the integration was created, in the form of a *nix
timestamp in milliseconds.
Set by Splunk Observability Cloud; read-only'
createdByName:
title: Integration Creator Name
type: string
readOnly: true
example: Dana Cruz
description: Name of the user that created the integration. Set to null by default. Use GET /integration
or GET /integration/{id} with the userParam query parameter to return a user name instead of
null. Set by Splunk Observability Cloud based on the full name value from the user's profile;
read-only.
creator:
title: Integration Creator ID
type: string
readOnly: true
example: X_xxxx9XXXX
description: 'ID of the user that created the integration.
If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA".
Set by Splunk Observability Cloud; read-only'
enabled:
title: Integration Enabled Flag
type: boolean
example: true
description: 'Indicates the state of the integration. If true, the
integration is enabled. If false, the integration is disabled, and you
must enable it by setting "enabled" to true in a PUT request that
updates the object.
When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be false, which lets you create the
integration and use its properties to set values in AWS.'
id:
title: Integration ID
type: string
readOnly: true
example: XXxxxXXXXXX
description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to
refer to
an integration using the GET, PUT, or
DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.'
lastUpdated:
title: Integration Last Updated Timestamp
type: integer
format: int64
example: 1556620230000
readOnly: true
description: 'Integration last updated timestamp, in *nix time
Set by Splunk Observability Cloud; read-only'
lastUpdatedBy:
title: Integration Last Updater ID
type: string
readOnly: true
example: Y_yyyy0YYYY
description: 'ID of the user who last updated the integration. If
Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA".
Set by Splunk Observability Cloud; read-only'
lastUpdatedByName:
title: Integration Last Updater Name
type: string
readOnly: true
example: Ariel Amal
description: Name of the user that last updated the integration. Set to null by default. Use GET
/integration or GET /integration/{id} with the userParam query parameter to return a user name
instead of null. Set by Splunk Observability Cloud based on the full name value from the user's
profile; read-only.
name:
title: Integration Label
type: string
example: MyIntegration
description: 'Human-readable label for the integration. Use this property to
identify a specific integration when you''re using multiple integrations
for the same service.'
type:
type: string
enum:
- ADFS
example: ADFS
description: 'Type of service that this integration represents, in the form
of an enumerated string, always "ADFS".'
metadata:
title: SAML Integration Metadata Filename
type: string
example: FederationMetadata.xml
description: 'File name of the SAML metadata XML file for the integration:
FederationMetadata.xml'
publicKey:
title: SAML Integration PEM File
type: string
format: publickey
description: 'Contents of the certificate.pem file for the public key associated
with the SAML integration'
issuerUrl:
title: SAML Integration Entity URL
type: string
format: uri
example: https://www.buttercup.com/o/saml2?idpid=999
description: URL of the entity that issued the certificate for a SAML integration
required:
- type
type: object
description: 'Specifies the SAML integration between Active Directory Federation
Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.'
- title: AWS CloudWatch Integration
properties:
created:
title: Integration Creation Time
type: integer
format: int64
example: 1556361030000
readOnly: true
description: 'Date and time the integration was created, in the form of a *nix
timestamp in milliseconds.
Set by Splunk Observability Cloud; read-only'
createdByName:
title: Integration Creator Name
type: string
readOnly: true
example: Dana Cruz
description: Name of the user that created the integration. Set to null by default. Use GET /integration
or GET /integration/{id} with the userParam query parameter to return a user name instead of
null. Set by Splunk Observability Cloud based on the full name value from the user's profile;
read-only.
creator:
title: Integration Creator ID
type: string
readOnly: true
example: X_xxxx9XXXX
description: 'ID of the user that created the integration.
If Splunk Observability Cloud created the object, the value is "AAAAAAAAAA".
Set by Splunk Observability Cloud; read-only'
enabled:
title: Integration Enabled Flag
type: boolean
example: true
description: 'Indicates the state of the integration. If true, the
integration is enabled. If false, the integration is disabled, and you
must enable it by setting "enabled" to true in a PUT request that
updates the object.
When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be false, which lets you create the
integration and use its properties to set values in AWS.'
id:
title: Integration ID
type: string
readOnly: true
example: XXxxxXXXXXX
description: 'Splunk Observability Cloud-assigned ID of the integration. Use this property to
refer to
an integration using the GET, PUT, or
DELETE /integration/{id} endpoints or the GET /integration/validate{id}/ endpoint.'
lastUpdated:
title: Integration Last Updated Timestamp
type: integer
format: int64
example: 1556620230000
readOnly: true
description: 'Integration last updated timestamp, in *nix time
Set by Splunk Observability Cloud; read-only'
lastUpdatedBy:
title: Integration Last Updater ID
type: string
readOnly: true
example: Y_yyyy0YYYY
description: 'ID of the user who last updated the integration. If
Splunk Observability Cloud last updated the integration, the value is "AAAAAAAAAA".
Set by Splunk Observability Cloud; read-only'
lastUpdatedByName:
title: Integration Last Updater Name
type: string
readOnly: true
example: Ariel Amal
description: Name of the user that last updated the integration. Set to null by default. Use GET
/integration or GET /integration/{id} with the userParam query parameter to return a user name
instead of null. Set by Splunk Observability Cloud based on the full name value from the user's
profile; read-only.
name:
title: Integration Label
type: string
example: MyIntegration
description: 'Human-readable label for the integration. Use this property to
identify a specific integration when you''re using multiple integrations
for the same service.'
namedToken:
title: Name of an access token (also known as org token)
type: string
example: aCloudToken
readOnly: false
description: 'Name of an existing access token (org token) in your Splunk Observability Cloud
organization.
To learn more, see the Create and manage organization access tokens using Splunk Observability
Cloud
topic in the Splunk Observability Cloud user documentation.
Use namedToken to help you track usage metrics. If you have more than one integration for the
same cloud
service, use a different access token for each integration. You can then track the resource
usage for each integration
instance.
To learn more about tracking resource usage with access tokens, see the
Manage resource usage with access tokens using Splunk Observability Cloud topic in
the Splunk Observability Cloud user documentation.
Note: If you don''t specify namedToken when you create or update a cloud service integration,
Splunk Observability Cloud uses the default token for your organization. This token is assigned
when your organization
is created.'
type:
type: string
enum:
- AWSCloudWatch
example: AWSCloudWatch
description: 'Type of service that this integration represents, in the form
of an enumerated string, always "AWSCloudWatch".'
authMethod:
title: AWS CloudWatch Integration Authentication Method
type: string
readOnly: false
enum:
- ExternalId
- SecurityToken
example: ExternalId
description: 'Indicates the mechanism used to authenticate with AWS. The allowed
values are:
"ExternalId": Expects you to supply an external ID and ARN for AWS
"SecurityToken": Expects you to supply a key and token
Note: For the GovCloud and China AWS regions, you can only use
"AuthMethod": "SecurityToken"'
collectOnlyRecommendedStats:
title: AWS CloudWatch Integration Collect Only Recommended Stats Flag
type: boolean
default: false
description: 'If set to true, Splunk Observability Cloud collects only a subset of statistics
for metrics specified in the list of AWS recommended stats. If a metric is not on the recommended
stats list, the integration collects the 5 default statistics: SampleCount (count in Splunk
Observability Cloud), Average (mean), Sum (sum), Minimum (lower), and Maximum (upper).'
customCloudWatchNamespaces:
title: AWS CloudWatch Custom Namespace List
type: string
description: 'Comma-separated string list that contains custom AWS CloudWatch namespaces to monitor.
These can be either custom namespaces you''ve created in AWS, or any namespace defined by AWS
that Splunk Observability Cloud doesn''t support by default. To see the list of AWS services
that Splunk Observability Cloud supports by default, see Supported AWS services in the Splunk
Observability Cloud user documentation.
Custom namespaces provide additional metrics.
customCloudWatchNamespaces and customNamespaceSyncRules are similar but not equivalent:
customCloudWatchNamespaces is list of namespaces, and customNamespaceSyncRules is an array of
objects that
specify a namespace and data collection rules for that namespace.
customCloudWatchNamespaces can specify namespaces, but it can''t specify data collection rules
for the namespace.
If you specify customNamespaceSyncRules, the system ignores the value of customCloudWatchNamespaces.
To learn more about this field, see the Integrate AWS Monitoring with Splunk Observability Cloud
topic in the Developer Guide for Splunk Observability Cloud.'
customNamespaceSyncRules:
title: AWS CloudWatch Custom Namespace Sync Rule List
type: array
items:
title: AWS CloudWatch Custom Namespace Sync Rule
type: object
properties:
defaultAction:
title: AWS CloudWatch Integration Default Action
type: string
enum:
- Exclude
- Include
example: Exclude
description: 'Controls Splunk Observability Cloud default behavior when ingesting data from
an AWS
namespace. Splunk Observability Cloud ignores this property unless you specify the
filter property in the namespace sync rule. When you specify a
filter, use this property to control how Splunk Observability Cloud treats data that
doesn''t match the filter, using the following values:
"Exclude": Don''t sync data from the namespace unless a filter
includes it
"Include": Sync the data from the name namespace unless a filter
excludes it'
filter:
type: object
properties:
action:
type: string
enum:
- Exclude
- Include
example: Include
title: AWSSyncRuleFilterAction
description: 'Controls how Splunk Observability Cloud processes data from a custom AWS
namespace. The
available actions are:
"Exclude": Don''t sync data from the namespace unless a filter
includes it
"Include": Sync the data from the name namespace unless a filter
excludes it
Note: Use action in conjunction with defaultAction to
control data collection from the custom namespace. Set action as the
opposite of defaultAction. Although Splunk Observability Cloud accepts the same value
for action and defaultAction, the resulting filter will ingest
all incoming data.'
source:
title: AWSSyncRuleFilterSource
description: 'Expression that selects the data that Splunk Observability Cloud should
sync for the
custom namespace associated with this sync rule.
The expression uses the syntax defined for the SignalFlow filter()
function; it can be any valid SignalFlow filter expression.
Notes:
Splunk Observability Cloud can only display a subset of filter() options in the
native, interactive AWS integration UI. The options that Splunk Observability Cloud
can''t display are still visible in the SignalFlow expression for the
filter, but you can''t edit them. To modify these options, use the
the API to modify the expression.
To refer to AWS metrics in a filter() expression, preface the
metric name with the string sf_metric. The metric value doesn''t
need a preface. See Integrate AWS monitoring with Splunk Observability Cloud
for more information.
To refer to AWS tags in a filter() expression, preface the tag name
with the string aws_tag_. The tag value doesn''t need a preface.
Splunk Observability Cloud doesn''t accept all AWS tags as filter criteria. You can
only
filter on a tag when it comes from an AWS namespace (service) for
which Splunk Observability Cloud syncs tags. If you try to filter on a tag that isn''t
synced, the entire filter expression returns false, and you
don''t receive any data.
To see a list of the AWS namespaces (services) for which Infrastructure Monitoring
syncs tags, refer to the
Synced tags and properties
topic in the Splunk Observability Cloud user documentation.'
title: AWSSyncRuleFilter
description: 'Filter that Splunk Observability Cloud applies to data coming in from an AWS
namespace.
This gives you more fine-grained control over the incoming data. If you
don''t specify a filter, Splunk Observability Cloud brings in all the data from the
namespace.'
namespace:
title: AWS CloudWatch Custom Namespace
type: string
description: 'Name of an AWS CloudWatch namespace you created to contain custom metrics
that you defined in AWS.
Splunk Observability Cloud imports the custom metrics so you can monitor them.
To learn more, see the AWS documentation for publishing metrics.'
description: 'Specifies AWS namespaces you created, and the filters that Splunk Observability
Cloud applies to
data coming from from those namespaces.'
description: 'List of custom AWS namespaces and filters, in the form of a JSON
array of JSON objects. Each object specifies data collection rules for
a single AWS namespace.
Custom namespaces are namespaces you created. They contain custom metrics that you defined in
AWS.
Splunk Observability Cloud imports the custom metrics so you can monitor them. To learn more,
see the
Amazon AWS documentation for publishing metrics.
customNamespaceSyncRules and customCloudWatch
# --- truncated at 32 KB (1527 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-integrations-openapi.yml