Splunk Observability Cloud Org tokens
API for creating, updating, retrieving, deleting, and rotating org tokens.
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Org tokens
version: 4.5.0
description: 'API for creating, updating, retrieving, deleting, and rotating org tokens.
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You have to have the Splunk Observability Cloud admin role to use the POST /token, PUT /token/{name}, DELETE /token/{name},
and POST /token/{name}/rotate operations.
You have to have the Splunk Observability Cloud admin or power role to use the GET /token and GET /token/{name} operations.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Org Token API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/token:
get:
summary: Retrieve Tokens Using Query
description: 'Search for one or more org tokens by specifying all or part of the token
name. If you''ve set token limits for the token, they''re returned in the
response body.
Note: Splunk Observability Cloud returns a maximum of 10,000 objects, even if your organization contains more than
10,000. To learn more, see the
Considerations for retrieve operations section in the developer guide.'
parameters:
- name: offset
in: query
description: 'The object in the result set at which the API should start returning
results to you. Each object contains the properties of an org access
token.'
schema:
type: integer
format: int32
- name: limit
in: query
description: 'The number of results to return from the result set. The default is 20, and
Splunk Observability Cloud uses this value if you specify an invalid value.'
schema:
type: integer
format: int32
default: 20
- name: name
in: query
description: All or part of the org token name
schema:
type: string
- name: X-SF-TOKEN
in: header
description: 'Authentication token. If you use an org token, it must have an authorization scope that includes API,
and the API only returns information for the org token you use.'
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Response body for Retrieve Tokens operation
type: object
properties:
count:
type: integer
format: int32
description: 'Number of token objects that matched your query, also known as the
result set. This isn''t always the number of token objects in
results. If you specify
offset or limit or both, the number of objects you receive
may be different from the value of count.'
results:
type: array
items:
title: Properties of an org access token
type: object
properties:
created:
title: Token creation timestamp
type: integer
format: int64
example: 1556746230000
readOnly: true
description: 'The token creation date and time, in *nix time in milliseconds.
The system sets this value, and you can''t modify it.'
creator:
type: string
readOnly: true
description: 'ID of the user that created this token.
The system sets this value, and you can''t modify it.'
description:
title: Token description
type: string
description: 'Extended description of the token. You assign this value when you
create or update the token.'
disabled:
title: Token disabled flag
type: boolean
description: 'Flag that controls enabling the token. If set to true, the token
is disabled, and you can''t use it for authentication.'
exceedingLimits:
title: Token exceeding limits flag
type: boolean
example: false
description: Indicates whether the token is exceeding its usage limits. If set to true, the token
is exceeding one or more of its usage limits.
expiry:
title: Token expiration timestamp
type: integer
format: int64
example: 1558474230000
readOnly: true
description: 'Date and time that the token expires in *nix time in milliseconds.
The system sets this value to one year after the creation date, and you can''t modify it.
Note: For access tokens that the system created with a five-year lifetime, the original expiration
date remains the same.'
id:
title: Token ID
type: string
readOnly: true
description: 'Token ID
The system sets this value, and you can''t modify it.'
lastUpdated:
type: integer
format: int64
example: 1557696630000
readOnly: true
description: 'The date and time that the token was last updated, in
*nix time in milliseconds.
The system sets this value, and you can''t modify it.'
lastUpdatedBy:
type: string
readOnly: true
description: 'ID of the user that last updated this token
The system sets this value, and you can''t modify it.'
latestRotation:
title: Timestamp of latest rotation
type: integer
format: int64
example: 1556832630000
readOnly: true
description: 'Date and time when Splunk Observability Cloud last rotated the secret for this token,
in *nix time in milliseconds.
The system sets this value, and you can''t modify it.'
limits:
title: Limits associated with the org token
type: object
properties:
categoryQuota:
title: Usage Limits for usage-based and host-based pricing
type: object
properties:
'1':
title: Max number of hosts
type: number
format: int32
description: Max number of hosts that can use this token (ignored for usage-based pricing)
'2':
title: Max number of Docker containers
type: number
format: int32
description: Max number of Docker containers that can use this token (ignored for usage-based
pricing)
'3':
title: Max number of custom metrics that can be sent with this token
type: number
format: int32
description: Max number of custom metrics that can be sent with this token
'4':
title: Max number of hi-res metrics that can be sent with this token
type: number
format: int32
description: Max number of hi-res metrics that can be sent with this token
description: 'Usage limits for one or more aspects of usage-based or host-based pricing. Each
limit is a key-value pair with a key that''s a numeric string, and
a 32-bit integer value that sets the limit:
The key is one of the following values:
"1": Max number of hosts that can use this token (ignored for usage-based pricing)
"2": Max number of Docker containers that can use this token (ignored for usage-based pricing)
"3": Max number of custom metrics that can be sent with this token
"4": Max number of hi-res metrics that can be sent with this token
To learn more, see the Control Your Resource Usage using Token Limits topic
in the Developer guide.'
categoryNotificationThreshold:
title: Thresholds at which Splunk Observability Cloud sends a notification
type: object
properties:
'1':
title: Notification threshold for the host limit (ignored for usage-based pricing)
type: number
format: int32
description: Notification threshold for the host limit (ignored for usage-based pricing)
'2':
title: Notification threshold for the Docker container limit (ignored for usage-based pricing)
type: number
format: int32
description: Notification threshold for the Docker container limit (ignored for usage-based
pricing)
'3':
title: Notification threshold for the custom metrics limit
type: number
format: int32
description: Notification threshold for the custom metrics limit
'4':
title: Notification threshold for the hi-res metrics limit
type: number
format: int32
description: Notification threshold for the hi-res metrics limit
description: 'Threshold values at which Splunk Observability Cloud sends a notification that
you''re
about to exceed the corresponding limit. If you don''t specify a
notification, Splunk Observability Cloud sends the generic notification. Each
threshold is a key-value pair with a key that''s a numeric string, and a 32-bit integer value
that sets the threshold:
"1": Notification threshold for the host limit (ignored for usage-based pricing)
"2": Notification threshold for the Docker container limit (ignored for usage-based pricing)
"3": Notification threshold for the custom metrics limit
"4": Notification threshold for the hi-res metrics limit
To learn more, see the Control Your Resource Usage using Token Limits topic
in the Developer guide.'
dpmQuota:
title: The data points per minute limit for this token
type: integer
format: int32
description: 'The data points per minute (dpm) limit for this token. If you exceed
this limit, Splunk Observability Cloud sends out an alert.'
dpmNotificationThreshold:
title: Threshold at which Splunk Observability Cloud sends a notification
type: integer
format: int32
description: 'DPM level at which Splunk Observability Cloud sends the notification for this
token.
If you don''t specify a notification, Splunk Observability Cloud sends the generic
notification.'
eventSearchesPerMinute:
title: Limit of the rate of event searches
type: integer
description: 'Rate at which API requests that use the token can search for events
using the GET /v2/event API'
jobsPerMinuteLimit:
title: Limit of rate of analytics jobs starts
type: integer
description: 'Rate at which you send WebSocket execute messages to start analytics jobs, when
you authenticate the WebSocket connection using the token.
Also the rate at which you use the token to make the REST API request POST /v2/signalflow/execute.'
mtsmLimit:
title: MTS creation rate per minute limit
type: integer
format: int64
example: 500
description: 'The maximum number of MTS per minute that clients using this token can create.
After API requests exceed this rate, Splunk Observability Cloud stops creating more MTS for
clients that are using this token. Splunk Observability Cloud also drops data points
for the MTS that the clients are trying to create.'
description: 'Specifies org token limits and thresholds.
The system uses the following limits, regardless of your pricing model:
eventSearchesPerMinute
jobsPerMinuteLimit
mtsmLimit
The system uses the following limits based on your pricing model:
If you use DPM pricing, the system uses the dpmQuota and dpmNotificationThreshold values.
If you use host-based pricing or usage-based pricing, the system uses the categoryQuota and
categoryNotificationThreshold values.
For usage-based pricing, the system ignores the hosts and Docker containers limits and thresholds.'
notifications:
type: array
items:
oneOf:
- title: Amazon EventBridge Threshold Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: AmazonEventBridge
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For an Amazon EventBridge notification, this is always
"AmazonEventBridge".'
credentialId:
type: string
description: 'Amazon Event Bridge integration identifier, which Splunk Observability Cloud
assigns
when you add the integration. Use the UI or the Integrations API
to find the value of credentialId.
The system sets this value, and you can''t modify it.'
description: 'Specifies the properties needed to send a notification for a limit threshold
to an existing Amazon EventBridge-to-Splunk Observability Cloud integration'
- title: BigPanda Threshold Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: BigPanda
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For a BigPanda notification, this is always
"BigPanda".'
credentialId:
type: string
description: 'BigPanda integration identifier that Splunk Observability Cloud assigns when
you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.
The system sets this value, and you can''t modify it.'
description: 'Specifies the properties needed to send a notification for a limit threshold
to an existing BigPanda integration'
- title: Jira Cloud or Jira Server Threshold Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Jira
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For a Jira Cloud or Jira Server notification, this is
always "Jira".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Jira integration identifier, which Splunk Observability Cloud assigns when
you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.
The system sets this value, and you can''t modify it.'
description: 'Properties of a limit threshold notification sent via a Jira Cloud or
Jira Server integration, in the form of a JSON object.
These notifications take the form of a new Jira ticket whose
properties are specified in the Jira integration object.
To learn more, see the
Integrate Jira with Splunk Observability Cloud
topic in the Developer guide.'
- title: Email Threshold Notification
type: object
required:
- email
- type
properties:
type:
type: string
example: Email
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For an email notification, this is always "Email".'
email:
type: string
description: 'Destination address for the notification. This address isn''t
validated, so you must ensure it''s correct before you add it to a
request. Splunk Observability Cloud may not save invalid values and may try to send
the notification with an empty address. In either case, the
notification won''t go out.'
description: Properties of a limit threshold notification sent via email
- title: Microsoft Teams Threshold Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: Office365
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. To ensure backwards compatibility, the value is always
"Office365".'
credentialId:
type: string
description: 'Microsoft Teams integration identifier, which Splunk Observability Cloud assigns
when you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.
The system sets this value, and you can''t modify it.'
description: 'Properties for a limit threshold notification sent using a Microsoft Teams
integration'
- title: Opsgenie Threshold Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
example: Opsgenie
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For an Opsgenie notification, this is always
"Opsgenie".'
credentialId:
type: string
description: 'Opsgenie integration identifier that Splunk Observability Cloud assigns when
you add
the integration
The system sets this value, and you can''t modify it.'
credentialName:
type: string
example: My Opsgenie Integration
description: 'Descriptive name of the Opsgenie credential, which you assign when
you add the integration'
responderName:
type: string
description: 'Name of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderName, you don''t have to specify
responderId. If you specify neither, Opsgenie uses the defaults
for your Opsgenie account.'
responderId:
type: string
readOnly: false
writeOnly: false
description: 'ID of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderId, you don''t have to specify
responderName. If you specify neither, Opsgenie uses the
defaults for your Opsgenie account.'
responderType:
type: string
example: Team
description: Opsgenie responder type. The only valid value is "Team".
description: Properties for a limit threshold notification sent via Opsgenie
- title: PagerDuty Threshold Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: PagerDuty
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For a PagerDuty notification, this is always
"PagerDuty".'
credentialId:
type: string
description: 'PagerDuty integration identifier that Splunk Observability Cloud assigns when
you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.
The system sets this value, and you can''t modify it.'
description: Properties of a limit threshold notification sent via PagerDuty
- title: ServiceNow Threshold Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
example: ServiceNow
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For a ServiceNow notification, this is always
"ServiceNow".'
credentialId:
type: string
description: 'ServiceNow integration identifier, which Splunk Observability Cloud assigns
when you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.
The system sets this value, and you can''t modify it.'
description: Properties of a limit threshold notification sent via ServiceNow
- title: Slack Threshold Notification
type: object
required:
- channel
- credentialId
- type
properties:
type:
type: string
example: Slack
description: 'Tells Splunk Observability Cloud which external system it should use to send
the
notification. For a Slack notification, this is always "Slack".'
channel:
type: string
example: channel-notifications
description: 'Name of the Slack channel in which to display the notification. Omit
the leading "#" symbol. For example, specify
"#critical-notifications" as "critical-notifications".'
credentialId:
type: string
description: 'Slack integration identifier, which Splunk Observability Cloud assigns when
you add
the integration. Use the UI or t
# --- truncated at 32 KB (335 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-org-tokens-openapi.yml