Splunk Observability Cloud Organizations
API for creating, updating, retrieving, and deleting organizations.
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Organizations
version: 3.5.0
description: 'API for creating, updating, retrieving, and deleting organizations.
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You have to have the Splunk Observability Cloud admin role to use the PATCH /organization/custom-categories, POST /organization/member/,
POST /organization/members, POST /organization/orgMembers, PUT /organization/member/{id}, and DELETE /organization/member/{id}
operations.
You have to have the Splunk Observability Cloud admin or power role to use the GET /organization/custom-categories operation.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Organizations API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/organization:
get:
summary: Retrieve Organization
description: 'Gets the organization object for your organization. You can only get
the object if you''re a member of the organization; Splunk Observability Cloud looks at the
access token you use in your request to determine your membership.'
parameters:
- name: Content-Type
in: header
description: 'Format of the request payload. The only allowed value is
''application/json'''
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Either a session token (user API access token) or an organization token (access token) that has the API
authentication scope.
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Organization properties
type: object
properties:
creator:
title: ID of the organization creator
type: string
readOnly: true
description: 'ID of the user that created the organization
object.
The system sets this value, and you can''t change it.'
lastUpdatedBy:
title: ID of the user who last updated the organization object.
type: string
readOnly: true
description: 'ID of the user that last updated the organization
object.
The system sets this value, and you can''t change it.'
created:
title: Organization creation time
type: integer
format: int64
readOnly: true
example: 1531690230000
description: 'The organization creation date and time, in *nix time in milliseconds.
The system sets this value, and you can''t change it.'
lastUpdated:
title: Organization last updated time
type: integer
format: int64
readOnly: true
example: 1554240630000
description: 'The date and time that the organization was last updated, in *nix
time in milliseconds.
The system sets this value, and you can''t change it.'
id:
title: The organization ID
type: string
readOnly: true
description: 'ID for this organization
The system sets this value, and you can''t change it.'
organizationName:
title: Organization name
type: string
description: Descriptive name of the organization
accountType:
title: Account type for the organization
type: string
description: The type of account for the customer that owns the organization
accountStatus:
title: Account status for the organization
type: string
description: Specifies the status of the account that owns the organization
accountKey:
title: Account key for the organization
type: string
readOnly: true
description: 'The authentication key for the account that owns the organization.
The system sets this value, and you can''t change it.'
accountRenews:
title: Account renewal status for the organization
type: string
description: The renewal status for the account that owns the organization
accountValidUntil:
title: Account validity date and time for the organization.
type: integer
format: int64
example: 1626384630000
description: 'Specifies a date and time after which the account that owns the
organization becomes invalid, in *nix time in milliseconds.'
dpmLimit:
title: Limit of the number of data points per minute
type: integer
format: int32
readOnly: true
description: 'Specifies the number of data points per minute that the
organization can receive.
The system sets this value, and you can''t change it.'
tokensExpiringInSevenDays:
title: Organization access tokens that expire in seven days or less
type: array
items:
type: string
example:
- token1
- token2
readOnly: true
description: 'Organization access tokens that expire in seven days or less
The system sets this value, and you can''t change it.'
tokensExpiringInThirtyDays:
title: Organization access tokens that expire in 30 days or less
type: array
items:
type: string
example:
- token1
- token2
- token3
readOnly: true
description: 'Organization access tokens that expire in 30 days or less
The system sets this value, and you can''t change it.'
url:
title: The URL of the Splunk Observability Cloud organization
type: array
items:
type: string
example:
- https://app.<REALM>.observability.splunkcloud.com
- https://<CUSTOM_DOMAIN>.<REALM>.observability.splunkcloud.com
readOnly: true
description: 'The URL of the Splunk Observability Cloud organization
The system sets this value, and you can''t change it.'
description: Properties of your organization
examples:
example:
value:
accountKey: string
accountRenews: string
accountStatus: string
accountType: string
accountValidUntil: 1626384630000
created: 1531690230000
creator: string
dpmLimit: 0
id: string
lastUpdated: 1554240630000
lastUpdatedBy: string
organizationName: string
tokensExpiringInSevenDays:
- token1
- token2
tokensExpiringInThirtyDays:
- token1
- token2
- token3
url:
- https://app.<REALM>.observability.splunkcloud.com
- https://<CUSTOM_DOMAIN>.<REALM>.observability.splunkcloud.com
security:
- SessionToken: []
tags:
- Organizations
/organization/custom-categories:
get:
summary: Retrieve Custom Categories
description: 'Get all custom categories for your organization.
Custom categories appear in the UI. They''re a feature of an
organization that help you identify metrics associated with a dimension
or custom property.
To learn more about custom categories, see Manage custom categories
in the user documentation.
Note: Splunk Observability Cloud returns a maximum of 10,000 custom categories, even if your organization contains
more than 10,000. To learn more, see the
Considerations for retrieve operations section in the developer guide.
To make this request, you need the admin RBAC role.'
parameters:
- name: Content-Type
in: header
description: Format of the request payload. The only allowed value is 'application/json'
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: 'Either a session token (user API access token) or an organization token (access token) that has the
API authentication scope.
The token needs to be associated with a user that has the RBAC admin role. To ensure this requirement, create the
token yourself.'
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Custom categories for an organization
type: array
items:
title: Custom category for your organization
type: object
required:
- name
properties:
name:
type: string
example: aws-availability-zone
description: Dimension or custom property name
alias:
type: string
example: AWS availability zone
description: 'Alias (label) for this category, used in the UI. GET doesn''t
return this property if it doesn''t have an existing value.'
description:
type: string
example: AWS zones where this metric is available
description: 'Text description of the category. Not visible in the UI. GET
doesn''t return this property if it doesn''t have an existing value.'
example:
name: aws-availability-zone
alias: AWS availability zone
description: AWS zones where this metric is available
description: Specification of a custom category, in the form of a JSON object
maxItems: 10
minItems: 0
examples:
example:
value:
- alias: AWS availability zone
description: AWS zones where this metric is available
name: aws-availability-zone
security:
- SessionToken: []
tags:
- Organizations
patch:
summary: Manage Custom Category
description: 'Creates, updates, or deletes one or more custom categories for your
organization. Custom categories appear in the UI. They''re a feature of an
organization that help you identify metrics associated with a dimension
or custom property.
To learn more about custom categories, see Manage custom categories
in the user documentation.
This operation has overwrite semantics. The array of custom
category objects in the request body replaces your existing custom
categories. Existing custom categories that aren''t in the request are
deleted. For this reason, follow these steps to modify your custom
categories:
Use the GET /organization/custom-categories operation to
retrieve any existing categories. Store the response body in an
array.
To create a custom category, add a custom category object to
the stored array. The object must have a name that''s not used by
another custom category.
To update a custom category, update its object in the stored
array.
To delete a custom category, delete its object in the stored
array.
Add the stored array to the request body of the PATCH operation.
Note: You can specify a custom category name (dimensions or custom property key)
only once in a PATCH request. For example, you can''t create a custom category
and then update it in the same request.
To make this request, you need the admin RBAC role.'
parameters:
- name: Content-Type
in: header
description: 'Format of the request payload. The only allowed value is
''application/json'''
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: 'Either a session token (user API access token) or an organization token (access token) that has the
API authentication scope.
The token needs to be associated with a user that has the RBAC admin role. To ensure this requirement, create the
token yourself.'
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: Custom categories for an organization
type: array
items:
title: Custom category for your organization
type: object
required:
- name
properties:
name:
type: string
example: aws-availability-zone
description: Dimension or custom property name
alias:
type: string
example: AWS availability zone
description: 'Alias (label) for this category, used in the UI. GET doesn''t
return this property if it doesn''t have an existing value.'
description:
type: string
example: AWS zones where this metric is available
description: 'Text description of the category. Not visible in the UI. GET
doesn''t return this property if it doesn''t have an existing value.'
example:
name: aws-availability-zone
alias: AWS availability zone
description: AWS zones where this metric is available
description: Specification of a custom category, in the form of a JSON object
maxItems: 10
minItems: 0
examples:
example:
value:
- alias: AWS availability zone
description: AWS zones where this metric is available
name: aws-availability-zone
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Custom categories for an organization
type: array
items:
title: Custom category for your organization
type: object
required:
- name
properties:
name:
type: string
example: aws-availability-zone
description: Dimension or custom property name
alias:
type: string
example: AWS availability zone
description: 'Alias (label) for this category, used in the UI. GET doesn''t
return this property if it doesn''t have an existing value.'
description:
type: string
example: AWS zones where this metric is available
description: 'Text description of the category. Not visible in the UI. GET
doesn''t return this property if it doesn''t have an existing value.'
example:
name: aws-availability-zone
alias: AWS availability zone
description: AWS zones where this metric is available
description: Specification of a custom category, in the form of a JSON object
maxItems: 10
minItems: 0
examples:
example:
value:
- alias: AWS availability zone
description: AWS zones where this metric is available
name: aws-availability-zone
'400':
description: HTTP 400 response
content:
application/json:
schema:
oneOf:
- title: Unauthorized request to update org settings
type: object
properties:
code:
type: integer
format: HTTPResponseCode
example: 400
description: HTTP response code. Always 400.
message:
type: string
example: Unauthorized request to update org settings
description: 'The user associated with the authentication token you provided isn''t
authorized to update settings for the organization. The message value is
"Unauthorized request to update org settings"'
description: 'Error occurred while trying to create, update, or delete a custom
category. In the request header, you specified an authentication token
that isn''t authorized for the operation.'
- title: Only up to 10 custom categories allowed
type: object
properties:
code:
type: integer
format: HTTPResponseCode
example: 400
description: HTTP response code. Always 400.
message:
type: string
example: Only up to 10 custom categories allowed
description: 'Creating the custom category would exceed the limit of 10 custom categories per
organization. The message value is "Only up to 10 custom categories allowed"'
description: 'Error occurred while trying to create a custom category. Creating the
custom category would exceed the limit of 10 custom categories per
organization.'
- title: Invalid custom category property
type: object
properties:
code:
type: integer
format: HTTPResponseCode
example: 400
description: HTTP response code. Always 400.
message:
type: string
example: Invalid custom category property
description: 'The property name or dimension name you specified is misspelled or otherwise
badly formatted. The message value is "Invalid custom category property".'
description: 'Error occurred while trying to create a custom category. The
property name or dimension name you specified is invalid.'
- title: Invalid custom category item
type: object
properties:
code:
type: integer
format: HTTPResponseCode
example: 400
description: HTTP response code. Always 400.
message:
type: string
example: Invalid custom category item
description: 'You didn''t specify the name property for the custom category. The message
value is "Invalid custom category item".'
description: 'Error occurred while trying to create, update, or delete a custom
category. You didn''t specify the name property for the custom category.'
- title: Repeated custom category item {category name}
type: object
properties:
code:
type: integer
format: HTTPResponseCode
example: 400
description: HTTP response code. Always 400.
message:
type: string
example: Repeated custom category item {category name}
description: 'You specified the same name in more that one custom category object
in this request. The name you used is included in the error message.
The message value is "Repeated custom category item {name}"'
description: 'Error occurred while trying to create custom categories. You
specified the same name in more than one custom category object in this
request. The name you used is included in the error message.'
examples:
Unauthorized request to update org settings:
value:
code: 400
message: Unauthorized request to update org settings
Only up to 10 custom categories allowed:
value:
code: 400
message: Only up to 10 custom categories allowed
Invalid custom category property:
value:
code: 400
message: Invalid custom category property
Invalid custom category item:
value:
code: 400
message: Invalid custom category item
Repeated custom category item {category name}:
value:
code: 400
message: Repeated custom category item {category name}
security:
- SessionToken: []
tags:
- Organizations
/organization/member:
get:
summary: Retrieve Organization Members
description: 'Retrieves one or more members of the organization, based on the
search criteria specified in the query parameters.
Note: Splunk Observability Cloud returns a maximum of 10,000 members, even if your organization contains more than
10,000. To learn more, see the
Considerations for retrieve operations section in the developer guide.
To make this request, you need the admin RBAC role.'
parameters:
- name: offset
in: query
description: 'The object in the result set at which the API should start returning
results to you. Each object is an organization ID.
member.'
schema:
type: integer
format: int32
- name: limit
in: query
description: The number of results to return from the result set.
schema:
type: integer
format: int32
- name: query
in: query
description: 'Search criteria that selects the members you want the API to
return. You can search for values of any of the properties of an
organization object.
Search criteria have the following rules:
To search for a property, specify its name. The result is all of
the members that have that property.
To search for specific values of a dimension or property, specify
the name and value as <name>:<value>. If <value> contains
non-alphanumeric characters, encode the non-alphanumeric characters and surround the value with
double quotes. For example, the region custom property value US East must be passed in the parameter as region:"US%20East".
To search for names or values using wildcards, use * as the
wildcard character.
You can do range searches using the syntax
<name>:[<lower> to <upper>] (The value of
<lower> must be less than or equal to <upper>). This works for
numeric and alphabetic values.
To search for the existence of a property, use
_exists_ and _missing_.
A single property name and value (or wildcards) make up a
predicate that implicitly returns a boolean.
Join predicates with the NOT, AND, and OR boolean operators.
Use parentheses ''('' and '')'' to change the evaluation order.'
schema:
type: string
- name: order_by
in: query
description: 'The member object property on which the API should sort the results.
You don''t have to include this property in your query, but the value
must be a valid organization property.
Prepend a - character to the property name to sort in descending order. If you want to apply order_by to non-custom
property fields like timestamp, prepend the field with sf_. For example: order_by=-sf_timestamp.'
schema:
type: string
- name: Content-Type
in: header
description: 'Format of the request payload. The only allowed value is
''application/json'''
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: 'Either a session token (user API access token) or an organization token (access token) that has the
API authentication scope.
The token needs to be associated with a user that has the RBAC admin role. To ensure this requirement, create the
token yourself.'
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Results of a GET for `/organization/member`
type: object
properties:
results:
type: array
items:
title: Properties of a single organization member
type: object
properties:
creator:
type: string
readOnly: true
description: ID of the user that created this member
lastUpdatedBy:
type: string
readOnly: true
description: ID of the user that last updated this member
created:
type: integer
format: int64
readOnly: true
example: 1533676829319
description: 'The member creation date and time, in *nix time in milliseconds.
The system sets this value, and you can''t change it.'
lastUpdated:
type: integer
format: int64
readOnly: true
example: 1557696630000
description: 'The date and time that the member was last updated, in *nix time in milliseconds.
The system sets this value, and you can''t change it.'
id:
type: string
readOnly: true
description: ID of the member
userId:
type: string
readOnly: true
description: User ID
organizationId:
type: string
readOnly: true
description: 'Organization ID for the organization that the
member belongs to'
email:
type: string
description: 'Email address for the user associated with this member
record'
fullName:
type: string
description: Full name of the user associated with this member record
phone:
type: string
description: Phone number of the user associated with this member record
title:
type: string
description: Job title of the user associated with this member record
roles:
type: object
properties:
roles:
type: array
items:
title: Properties of a role
type: object
properties:
capabilities:
type: array
items:
type: string
example: EXAMPLE_CAPABILITY1
description: List of capabilities
created:
type: string
example: 232329
readOnly: true
description: 'The time the role was created, in *nix time in milliseconds.
The system sets this value, and you can''t change it.'
creator:
type: string
example: XXZZZZyyZZ
# --- truncated at 32 KB (88 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-organizations-openapi.yml