Splunk Observability Cloud Session tokens
The Session tokens API from Splunk Observability Cloud — 2 operation(s) at https://api.{REALM}.observability.splunkcloud.com/v2.
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Session tokens
version: 3.1.0
description: 'API for creating and deleting session tokens.
Note: This API doesn''t handle access tokens (org tokens). To manage access tokens, use the org tokens API.
Requirements
You must have an organization access token with the API permission or a session token to use the API.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Session Token API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/session:
post:
summary: Create Session Token
description: 'Creates a session token (referred to as an User API Access Token in
the UI) that provides authentication for other API
calls.
Session tokens require an email and password. You can''t create a session token if your organization uses SSO authentication
unless your organization has also activated email/password authentication.
To create a token that doesn''t require email/password authentication, use the Org Tokens API.
Note: You can''t use a session token for authenticating a /datapoint, /backfill, or /event API call. These APIs require
an organization access token (org token), referred to as an access token in the UI, with ingest permission.'
parameters:
- name: Content-Type
in: header
description: Format of the request body. Always "application/json".
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- email
- password
properties:
email:
title: User email address
type: string
format: email
example: edickinson@example.com
description: 'The email address you used to join the organization for which you
want a session token.
Note: This has to be the email address that Splunk Splunk Observability Cloud
used to invite you to the organization. If you''re using an
external protocol such as SAML or LDAP to connect to Splunk Observability Cloud,
you can''t use that protocol''s credentials.'
organizationId:
title: Organization Id
type: string
example: abcdefgh1234
description: Optional. The id for your organization. It it's not specified, the token is created for the
default org of the user.
password:
title: User password
type: string
format: password
example: DontUseThisPassword
description: 'The password you provided to Splunk Observability Cloud when you accepted an
invitation to join an organization. If you''re using an
external protocol such as SAML or LDAP to connect to
Splunk Observability Cloud, you can''t use that protocol''s credentials.'
examples:
createToken:
summary: Create session token request body
description: 'Example
'
x-description: 'Contains the email and password of a user who has
authorization to create session tokens.
'
value:
email: edickinson@example.com
organizationId: abcdefgh1234
password: DontUseThisPassword
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
title: Response body for a successful token creation
type: object
properties:
accessToken:
title: The session token returned by the API
type: string
description: 'A session token (User API Access Token) generated by the API. This
token remains valid for 30 days.'
createdBy:
title: User ID of the token creator
type: string
description: The internal user ID of the user who created the token.
createdMs:
title: When created
type: integer
format: int64
readOnly: true
example: 1549963264000
description: 'The date and time that the token was created, in *nix time in milliseconds
This property is set by the system, and you can''t change it.'
disabled:
title: Disabled token indicator
type: boolean
description: 'Indicates if the token is disabled or not. When you first create a
token, the value of disabled is false.'
email:
title: Email address of the token creator
type: string
description: The email address submitted in the request to create the token
expiryMs:
title: Token expiration timestamp
type: integer
format: int64
readOnly: true
example: 1561886464000
description: The date and time that the token will expire, in *nix time in milliseconds
id:
title: Token ID
type: string
description: The identifier of this access token
organizationId:
title: Organization ID
type: string
description: The identifier of the organization that the user belongs to
sessionType:
title: Session type
type: string
description: Always set to ORG_USER
updatedBy:
title: User who updated the token
type: string
description: For a successful "create token" request, this value is null.
updatedMs:
title: Token updated timestamp
type: integer
format: int64
readOnly: true
example: 1556702464000
description: 'The date and time that the token was updated, in *nix time in milliseconds
For a successful "create token" request, this value is the same as that
for createdMs.
This value is set by the system, and you can''t change it.'
userId:
title: User ID of the user that created the token
type: string
description: The identifier of the user who created the token
username:
title: User name of the user that created the token
type: string
description: Always null
examples:
confirmation-success:
summary: Example of a successful session token create request
value:
accessToken: <USER-API-ACCESS-TOKEN>
createdBy: CkClZUKAIAQ
createdMs: 1549963264000
disabled: false
email: user@organization.com
expiryMs: 1561886464000
id: CkSfGddAAAg
organizationId: abcdefgh1234
sessionType: ORG_USER
updatedBy: null
updatedMs: 1556702464000
userId: CkClZUKAIAQ
userName: null
'401':
description: HTTP 401 response
content:
application/json:
schema:
title: Response body for a failed token creation request
type: object
properties:
type:
title: The type of response
type: string
description: 'The type of response that this response body represents. Always set
to "error".'
status:
title: HTTP status code
type: integer
description: 'The numeric HTTP status code for this response. The API always
returns 401 for a failed create token request.'
message:
title: Error message
type: string
description: 'The error message associated with the HTTP status code. The API
always returns The email/password combination was entered incorrectly. Please try again."'
examples:
default:
value:
summary: Example of a failed session token create request
value:
type: error
status: 401
message: 'The email/password combination was entered incorrectly.
Please try again.
'
tags:
- Session tokens
delete:
summary: Delete Session Token
description: 'Invalidates an existing session token (referred to as an User API
Access Tokenin the UI). If the invalidation succeeds, you receive
the HTTP status code ''204''. This means that the API successfully
processed the request, but it won''t return headers or a response
body.
Note: You can''t use this API to delete an org token
(referred to as an access token in the UI.)'
parameters:
- name: Content-Type
in: header
description: Format of the request payload. The only allowed value is "application/json".
required: true
schema:
type: string
- name: X-SF-TOKEN
in: header
description: The session token (User API Access Token) you want to delete
required: true
schema:
type: string
responses:
'204':
description: HTTP 204 response
'404':
description: HTTP 404 response
content:
application/json:
schema:
type: object
properties:
code:
type: integer
description: HTTP response code. Always set to "404"
message:
description: Error cause. Always set to "Session not found"
examples:
default:
value:
code: 404
message: Session not found
security:
- SessionToken: []
tags:
- Session tokens