API for streaming data to SignalFlow and managing SignalFlow background
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/splunk-observability-signalflow-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.0.3
info:
title: Splunk Observability Cloud — SignalFlow
version: 3.2.0
description: 'API for streaming data to SignalFlow and managing SignalFlow background
computations.
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You must have the Splunk Observability Cloud admin or power role to use the POST /execute, POST /preflight, POST /{id}/stop,
POST /{id}/stop, and POST /start operations.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://stream.{REALM}.observability.splunkcloud.com/v2/signalflow
description: SignalFlow API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/{id}/feedback:
get:
summary: Retrieve Computation Feedback
description: Retrieves status and feedback messages for a SignalFlow computation
parameters:
- name: id
in: path
description: 'The computation ID returned in the `"handle" property in an SSE
message.'
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Authentication token.
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
security:
- SessionToken: []
tags:
- SignalFlow
/{id}/stop:
post:
summary: Stop SignalFlow Computation
description: 'Stops a SignalFlow computation identified by its ID (computation
handle). The computation must belong to the same organization as the
user whose access token you used to start the computation.'
parameters:
- name: id
in: path
description: 'The computation ID returned in the `"handle" property in an SSE
message. SignalFlow stops the computation based on this ID.'
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Authentication token.
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
'401':
description: HTTP 401 response
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: '''"You must use your user session"'''
code:
type: integer
description: '"401"'
examples:
example:
value:
code: 0
message: string
'404':
description: HTTP 404 response
content:
application/json:
schema:
type: object
properties:
message:
description: '"message" : "HTTP 404 Not Found"'
security:
- SessionToken: []
tags:
- SignalFlow
/connect:
get:
summary: Create WebSocket Connection
description: "Creates a WebSocket connection with which you can send SignalFlow programs to the system.\nThis request\
\ returns HTTP response code 101 if it's successful.\nAfter you have a successful connection, you need to authenticate\
\ using a WebSocket message. Send the following JSON within 5 seconds after connecting:\n{\n \"type\": \"authenticate\"\
,\n \"token\": \"AUTH_TOKEN\"\n}\n\nIf the system drops the connection for any reason, connect and authenticate\n\
again. After you start a SignalFlow program, a connection drop doesn't stop the program.\nIf you connect and authenticate\
\ again and the authentication fails, the system\ncloses the connection and terminates all programs you sent.\n\n\
Note: Only use this request if you're using WebSocket to communicate with SignalFlow.\nIf you're using REST and SSE,\
\ you don't need a WebSocket connection."
responses:
'101':
description: HTTP 101 response
tags:
- SignalFlow
/execute:
post:
summary: Execute SignalFlow computation
description: 'Executes the SignalFlow program in the request body and synchronously returns the data to awaiting client.
Control the computation by specifying query parameters in
the request.
Note: Due to the use of scientific notation in the API, the output of SignalFlow API calls doesn''t exactly match
the output from SignalFlow programs in charts in the UI.'
parameters:
- name: start
in: query
description: The date and time that the computation should start, in *nix time in milliseconds
schema:
type: integer
format: int64
- name: stop
in: query
description: The date and time that the computation should stop, in *nix time in milliseconds
schema:
type: integer
format: int64
- name: resolution
in: query
description: 'The minimum data resolution you want to use in the computation, in
milliseconds. To learn more about data resolution, see the
Splunk Infrastructure Monitoring Analytics topic
in the user documentation.'
schema:
type: integer
format: int32
minimum: 0
- name: maxDelay
in: query
description: 'The maximum time that you want the computation to wait after it
detects that input data has stopped arriving, in milliseconds. To
get the automatic maximum, specify 0. The maximum delay you can
specify yourself is 900000, or 15 minutes.'
schema:
type: integer
format: int32
minimum: 0
maximum: 900000
- name: immediate
in: query
description: 'Flag that controls the stop timestamp. If true, the flag overrides
the stop timestamp, and the computation doesn''t wait for future
incoming data'
schema:
type: boolean
- name: timezone
in: query
description: 'Specifies which time zone SignalFlow should use as the basis of
time-related calculations in calendar window
transformation methods.
For a list of supported time zones, see the section
Time Zones Supported by Splunk Observability Cloud.'
schema:
type: string
default: UTC
- name: Content-Type
in: header
description: Format of the request body. Either "text/plain" or "application/json".
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Authentication token
required: true
schema:
type: string
- name: Last-Event-ID
in: header
description: 'ID of the last Server-Sent Event you received. This value lets you
resume a computation that''s paused.'
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: Program Text Info
type: object
required:
- programText
properties:
programText:
title: SignalFlow program text string
type: string
example: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
description: Text string containing a SignalFlow program that has one or more detect().publish() output
streams.
programArgs:
title: SignalFlow program arguments
type: object
properties:
ui.dashboard_window:
title: Chart width
type: string
example: 10m
description: A time range value for the dashboard window transformation (ui.dashboard_window).
example:
ui.dashboard_window: 10m
description: Argument values for the SignalFlow program. Use this property only when you use Args construct
in programText.
description: SignalFlow program and arguments text strings
examples:
example:
value:
programArgs:
ui.dashboard_window: 10m
programText: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
responses:
'200':
description: HTTP 200 response
'401':
description: HTTP 401 response
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Always contains "You must use your user session"
code:
type: integer
description: Always contains 401
examples:
example:
value:
code: 0
message: string
security:
- SessionToken: []
tags:
- SignalFlow
/preflight:
post:
summary: Preview Detector Alert Count
description: 'Generates a preview of the number of alerts a detector will generate
during a specified time period. In the UI, this feature is
called Alert Preview.
In the request body, specify the detector you want to preview as plain
text or a JSON object containing a SignalFlow program with one or more
detect().publish() output streams.
Note: This is an asynchronous request that returns data to your client in the
form of Server-Sent Event (SSE) messages. To learn more about these
messages, see the SignalFlow Stream Messages Reference topic
in the Developer Guide.'
parameters:
- name: start
in: query
description: Preview start timestamp, in *nix time in milliseconds
required: true
schema:
type: integer
format: int64
- name: stop
in: query
description: Preview stop timestamp, in *nix time in milliseconds
required: true
schema:
type: integer
format: int64
- name: maxDelay
in: query
description: 'Maximum time that the computation should wait after input data
stops arriving, in milliseconds.'
schema:
type: integer
format: int32
minimum: 0
- name: Content-Type
in: header
description: Format of the request body. Either "text/plain" or "application/json".
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Authentication token
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: Program Text Info
type: object
required:
- programText
properties:
programText:
title: SignalFlow program text string
type: string
example: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
description: Text string containing a SignalFlow program that has one or more detect().publish() output
streams.
programArgs:
title: SignalFlow program arguments
type: object
properties:
ui.dashboard_window:
title: Chart width
type: string
example: 10m
description: A time range value for the dashboard window transformation (ui.dashboard_window).
example:
ui.dashboard_window: 10m
description: Argument values for the SignalFlow program. Use this property only when you use Args construct
in programText.
description: SignalFlow program and arguments text strings
examples:
example:
value:
programArgs:
ui.dashboard_window: 10m
programText: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
responses:
'200':
description: HTTP 200 response
'400':
description: HTTP 400 response
'401':
description: HTTP 401 response
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Text string, always "You must use your user session".
code:
type: integer
description: HTTP response code, always 401
examples:
default:
value:
code: 401
message: You must use your user session
'403':
description: HTTP 403 response
'429':
description: HTTP 429 response
security:
- SessionToken: []
tags:
- SignalFlow
/start:
post:
summary: Start SignalFlow computation
description: 'Starts the SignalFlow program in the request body in the background and returns only running job ID. Control
the computation by specifying query parameters in
the request.
Note: Due to the use of scientific notation in the API, the output of SignalFlow API calls doesn''t exactly match
the output from SignalFlow programs in charts in the UI.'
parameters:
- name: start
in: query
description: The date and time that the computation should start, in *nix time in milliseconds
schema:
type: integer
format: int64
- name: stop
in: query
description: The date and time that the computation should stop, in *nix time in milliseconds
schema:
type: integer
format: int64
- name: resolution
in: query
description: 'The minimum data resolution you want to use in the computation, in
milliseconds. To learn more about data resolution, see the
Splunk Infrastructure Monitoring Analytics topic
in the user documentation.'
schema:
type: integer
format: int32
minimum: 0
- name: maxDelay
in: query
description: 'The maximum time that you want the computation to wait after it
detects that input data has stopped arriving, in milliseconds. To
get the automatic maximum, specify 0. The maximum delay you can
specify yourself is 900000, or 15 minutes.'
schema:
type: integer
format: int32
minimum: 0
maximum: 900000
- name: timezone
in: query
description: 'Specifies which time zone SignalFlow should use as the basis of
time-related calculations in calendar window
transformation methods.
For a list of supported time zones, see the section
Time Zones Supported by Splunk Observability Cloud.'
schema:
type: string
default: UTC
- name: Content-Type
in: header
description: Format of the request body. Either "text/plain" or "application/json".
required: true
schema:
type: string
- name: X-SF-Token
in: header
description: Authentication token
required: true
schema:
type: string
- name: Last-Event-ID
in: header
description: 'ID of the last Server-Sent Event you received. This value lets you
resume a computation that''s paused.'
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: Program Text Info
type: object
required:
- programText
properties:
programText:
title: SignalFlow program text string
type: string
example: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
description: Text string containing a SignalFlow program that has one or more detect().publish() output
streams.
programArgs:
title: SignalFlow program arguments
type: object
properties:
ui.dashboard_window:
title: Chart width
type: string
example: 10m
description: A time range value for the dashboard window transformation (ui.dashboard_window).
example:
ui.dashboard_window: 10m
description: Argument values for the SignalFlow program. Use this property only when you use Args construct
in programText.
description: SignalFlow program and arguments text strings
examples:
example:
value:
programArgs:
ui.dashboard_window: 10m
programText: A = data('trans.latency').mean(over=Args['ui.dashboard_window']).mean().publish(); detect(when(A>threshold(5))).publish('detector_name');
responses:
'200':
description: HTTP 200 response
'401':
description: HTTP 401 response
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Always contains "You must use your user session"
code:
type: integer
description: Always contains 401
examples:
example:
value:
code: 0
message: string
security:
- SessionToken: []
tags:
- SignalFlow