Splunk Observability Cloud SLOs
API for creating, retrieiving, and managing service level objectives (SLOs).
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — SLOs
version: 1.0.0
description: 'API for creating, retrieiving, and managing service level objectives (SLOs).
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You have to have the Splunk Observability Cloud admin or power role to use the POST /slo, POST /slo/search, POST /slo/validate,
PUT /slo/{id}, and DELETE /slo/{id} operations.
You have to have the Splunk Observability Cloud admin, power, or read_only role to use the GET /slo/{id} operation.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: SLO API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/slo:
post:
summary: Create New SLO
description: Properties used to create a new SLO object
parameters:
- name: Content-Type
in: header
description: Request body format. Always "application/json".
required: true
schema:
type: string
- name: X-SF-TOKEN
in: header
description: Authentication token
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
title: Create SLO Request Body
type: object
required:
- name
- type
- inputs
- targets
properties:
description:
title: Description of the SLO
type: string
example: My SLO test
description: Description of the SLO
name:
title: Name of the SLO
type: string
example: Test SLO
description: Name of the SLO. Each SLO name must be unique within an organization
type:
title: Type of SLO
type: string
enum:
- RequestBased
description: 'Type of the SLO. You can configure your SLO as the following type:
Request-based SLO: Measurement tracks the successful request count and total request count'
inputs:
title: SLO inputs
oneOf:
- title: Request Based Input SLO Type
type: object
required:
- programText
- totalEventsLabel
- goodEventsLabel
properties:
programText:
type: string
example: 'A = data(''spans.count'', filter(''sf_error'', ''false''))
B = data(''spans.count'')
'
description: SignalFlow program and arguments text strings that define the streams used as successful
event count and total event count
totalEventsLabel:
type: string
example: B
description: Label used in programText that refers to the data block which contains the stream of
total events
goodEventsLabel:
type: string
example: A
description: Label used in programText that refers to the data block which contains the stream of
successful events
description: Properties to congifure an SLO object configured request-based inputs
example:
programText: 'A = data(''spans.count'', filter(''sf_error'', ''false''))
B = data(''spans.count'')
'
goodEventsLabel: A
totalEventsLabel: B
description: Inputs to configure your SLO
targets:
title: SLO target array
type: array
minItems: 1
maxItems: 1
items:
title: SLO Target
type: object
required:
- compliancePeriod
- cycleType
- cycleStart
- slo
- type
- sloAlertRules
properties:
compliancePeriod:
type: string
example: 30d
description: Compliance period of this SLO. This value must be within the range of 1d (1 day) to 30d
(30 days), inclusive.
cycleType:
type: string
enum:
- week
- month
example: week
description: 'Cycle type for this SLO target, either week or month.
Note: Required only when SLO target type is CalendarWindow.'
cycleStart:
type: string
example: monday
description: 'Starting point for the cycle of this SLO target.
For weekly cycles, a valid cycleStart value must be a day of the week: mon, monday, tue, tuesday,
and so on.
For monthly cycles, a value cycleStart value must be within the range of 1d to 28d, inclusive.
Note: Required only when SLO target type is CalendarWindow.'
slo:
type: number
format: double
minimum: 0
exclusiveMinimum: true
exclusiveMaximum: true
maximum: 100
example: 99.99
description: Target value in the form of a percentage
type:
type: string
enum:
- RollingWindow
- CalendarWindow
example: RollingWindow
description: 'SLO target can be the following type:
RollingWindow
CalendarWindow'
sloAlertRules:
type: array
items:
title: SLO Alert Rule Object
type: object
required:
- type
- rules
properties:
type:
type: string
enum:
- BREACH
- ERROR_BUDGET_LEFT
- BURN_RATE
example: BREACH
description: 'SLO alert rule can be one of the following types:
BREACH: Alerts when the service level indicator (SLI) doesn’t meet the target over the specified
compliance window.
ERROR_BUDGET_LEFT: Alerts when the remaining error budget is less than the specified percentage
of the estimated error budget for the compliance window.
BURN_RATE: Alerts when the rate of consumption of your SLO error budget exceeds a healthy
threshold for the specified compliance window.
Note: Within an SLO object, you can only specify one SLO alert rule per type. For example,
you can''t specify two objects of type BREACH in the same sloAlertRules list.'
alertsTriggered:
type: boolean
readOnly: true
default: false
description: When the system sets this to true, there is at least one active alert for this
SLO alert rule
rules:
type: array
items:
title: SLO Alert Rule Object
type: object
required:
- severity
properties:
description:
type: string
example: Alert when the target has been breached for 5 minutes
description: Description for the rule
detectLabel:
type: string
example: label
disabled:
type: boolean
default: false
example: false
description: 'Controls the state of an alert rule. If false, the rule is turned on
and SignalFlow issues alerts for it. If true, the rule is turned
off and SignaFlow doesn''t issue alerts for it, even if one of the
rules is triggered.'
notifications:
type: array
readOnly: false
writeOnly: false
items:
oneOf:
- title: Amazon EventBridge Alert Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: AmazonEventBridge
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For an Amazon EventBridge notification, this is always
"AmazonEventBridge".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Amazon EventBridge integration identifier, which Splunk Observability
Cloud assigns
when you add the integration. Use the UI or the Integrations API
to find the value of credentialId.'
description: 'Specifies the properties needed to send a notification from an SLO alert
to an existing Splunk Observability Cloud-to-Amazon EventBridge integration'
- title: BigPanda Alert Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: BigPanda
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For a BigPanda notification, this is always
"BigPanda".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'BigPanda integration identifier, which Splunk Observability Cloud
assigns when you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.'
description: 'Specifies the properties of a notification service integration between
BigPanda and Splunk Observability Cloud, in the form of a JSON object'
- title: Email Alert Notification
type: object
required:
- email
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Email
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For an email notification, this is always "Email".'
email:
type: string
readOnly: false
writeOnly: false
example: info@example.com
description: 'The destination address for the notification email. Splunk Observability
Cloud doesn''t
validate this address, so you must ensure it''s correct before you
use it. Splunk Observability Cloud may not store invalid values, and it may
try to
send notification email that doesn''t have an address. In either
case, the notification won''t be delivered.'
description: 'Specifies the properties of a notification service integration between
email and Splunk Observability Cloud, in the form of a JSON object'
- title: Jira Cloud or Jira Server Alert Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Jira
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For a Jira Cloud or Jira Server notification, this is
always "Jira".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Jira integration identifier, which Splunk Observability Cloud assigns
when you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.'
description: 'Specifies the properties of a notification service integration between
Jira Cloud or Jira Server and Splunk Observability Cloud, in the form of a JSON
object.
Jira alert notifications take the form of a new Jira ticket whose
properties are specified in the Jira integration object.
For more information, see the Integrate Jira with Splunk Observability Cloud topic
in the Developers Guide.'
- title: Microsoft Teams Alert Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Office365
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. To ensure backwards compatibility, this is always
"Office365".'
credentialId:
readOnly: false
writeOnly: false
type: string
description: 'Microsoft Teams integration identifier, which Splunk Observability
Cloud assigns when you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.'
description: 'Specifies the properties of a notification service integration between
Microsoft Teams and Splunk Observability Cloud, in the form of a JSON object'
- title: Opsgenie Alert Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Opsgenie
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For an Opsgenie notification, this is always
"Opsgenie".'
credentialId:
type: string
description: 'Opsgenie integration identifier, which Splunk Observability Cloud
assigns when you add
the integration'
credentialName:
type: string
readOnly: false
writeOnly: false
example: My Opsgenie Integration
description: 'Descriptive name of the Opsgenie credential, which you assign when
you add the integration'
responderName:
type: string
readOnly: false
writeOnly: false
description: 'Name of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderName, you don''t have to specify
responderId. If you specify neither, Opsgenie uses the defaults
for your Opsgenie account.'
responderId:
type: string
readOnly: false
writeOnly: false
description: 'ID of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderId, you don''t have to specify
responderName. If you specify neither, Opsgenie uses the
defaults for your Opsgenie account.'
responderType:
type: string
readOnly: false
writeOnly: false
example: Team
description: Opsgenie responder type. The only valid value is "Team".
description: Properties of a an SLO alert notification sent via Opsgenie.
- title: PagerDuty Alert Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: PagerDuty
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For a PagerDuty notification, this is always
"PagerDuty".'
credentialId:
readOnly: false
writeOnly: false
type: string
description: 'PagerDuty integration identifier, which Splunk Observability Cloud
assigns when you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.'
description: 'Specifies the properties of a notification service integration between
PagerDuty and Splunk Observability Cloud, in the form of a JSON object'
- title: ServiceNow Alert Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: ServiceNow
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For a ServiceNow notification, this is always
"ServiceNow".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'ServiceNow integration identifier, which Splunk Observability Cloud
assigns when you
add the integration. Use the UI or the Integrations API to find
the value of credentialId.'
description: 'Specifies the properties of a notification service integration between
ServiceNow and Splunk Observability Cloud, in the form of a JSON object'
- title: Slack Alert Notification
type: object
required:
- type
- channel
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Slack
description: 'Tells Splunk Observability Cloud which external system it should
use to send the
notification. For a Slack notification, this is always "Slack".'
channel:
type: string
readOnly: false
writeOnly: false
example: channel-notifications
description: 'The name of the Slack channel in which to display the notification.
Omit the leading "#" symbol. For example, specify
"#critical-notifications" as "critical-notifications".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Slack integration identifier, which Splunk Observability Cloud assigns
when you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.'
description: 'Specifies the properties of a notification service integration between
Slack and Splunk Observability Cloud, in the form of a JSON object'
- title: Team Email Notification
type: object
required:
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: TeamEmail
description: 'Notification service to use for the notification. For a TeamEmail
notification, this is always "TeamEmail".'
team:
type: string
readOnly: false
writeOnly: false
description: 'The ID of a team. All the members of this team
receive an email containing the notification message. Splunk Observability Cloud
uses
the email address used to invite the member to the organization.'
description
# --- truncated at 32 KB (467 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-slo-openapi.yml