Splunk Observability Cloud Teams
API for creating, updating, deleting, adding members, and removing members from teams.
OpenAPI Specification
openapi: 3.0.3
info:
title: Splunk Observability Cloud — Teams
version: 4.0.3
description: 'API for creating, updating, deleting, adding members, and removing members from teams.
Requirements
You must have an organization access token with the API permission or a session token to use the API.
You need the Splunk Observability Cloud admin role to use the POST /team, PUT /team/{tid}, and DELETE /team/{tid} operations.
You need the Splunk Observability Cloud admin or power role to use the PUT /team/{tid}/members, DELETE /team/{tid}/members,
PUT /team/{tid}/members/{uid}, and DELETE /team/{tid}/members/{uid} operations.
You need the Splunk Observability Cloud admin, power, or read_only role to use the GET /team and GET /team/{tid} opaerations.'
x-provenance:
method: reconstructed
authored_by: Splunk (content) / API Evangelist (assembly)
reconstructed_by: API Evangelist
reconstructed_on: '2026-08-19'
first_party: false
provider_published: false
note: Splunk's own OpenAPI objects, extracted from the React Server Component payload embedded in each of the 48 API reference
pages at dev.splunk.com. The operations and schemas are Splunk's; the assembly into standalone documents is API Evangelist's.
Splunk serves no fetchable spec file — dev.splunk.com answers 200 with an identical 6,638-byte shell for every asset
path, including invented control paths — so this is NOT first-party publication and is not graded as such.
x-evidence:
- type: source
url: https://dev.splunk.com/observability/reference/
- type: source
url: https://dev.splunk.com/observability/docs/apibasics/api_list/
servers:
- url: https://api.{REALM}.observability.splunkcloud.com/v2
description: Teams API endpoint URL
variables:
REALM:
default: us0
description: Splunk Observability Cloud realm the organization is provisioned in (for example us0, us1, eu0, jp0, au0).
security:
- SessionToken: []
components:
securitySchemes:
SessionToken:
type: apiKey
in: header
name: X-SF-Token
description: Splunk Observability Cloud session token or org access token.
paths:
/team:
get:
summary: Retrieve Teams by Name
description: 'Retrieves one or more team objects, based on a name specified in the
query parameters.
Note: Splunk Observability Cloud returns a maximum of 10,000 teams for the specified name pattern, even if your organization
contains more than 10,000. To learn more, see the
Considerations for retrieve operations section in the developer guide.'
parameters:
- name: limit
in: query
description: 'Maximum number of team objects to return. The default is 20, and
the API uses this value if you specify an invalid value.'
schema:
type: integer
minimum: 1
default: 20
- name: offset
in: query
description: '0-based index in the result set where the API should start
returning team objects.'
schema:
type: number
format: int32
default: 0
minimum: 0
- name: name
in: query
description: 'A search pattern for the value of the name property of a team
object. You can use any ASCII character in the string, and
the API matches the pattern to any part of the name property. For
example, name=Sig matches the following team names:
"SignalFlow"
"SignedMetrics"
"Insignia"
The following conditions cause the API to match any value of
the name property:
String of length 0
Omitting the name parameter from the query'
schema:
type: string
- name: order_by
in: query
description: 'Team object property that the API should sort results on.
Prepend a - character to the property name to sort in descending order. If you want to apply order_by to non-custom
property fields like timestamp, prepend the field with sf_. For example: order_by=-sf_timestamp.'
schema:
type: string
default: lastUpdated
- name: X-SF-TOKEN
in: header
description: Authentication token
required: true
schema:
type: string
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
count:
type: integer
format: int32
description: 'Number of team objects that matched the provided search
criteria.
Note: This value is a count of the total
number of objects in the result set. The number of objects
that the system returns is affected by the limit and
offset query parameters. In summary:
count: Size of result set
number of returned objects:
(limit - offset) >= count: count
(limit - offset) < count: limit - offset'
results:
type: array
items:
type: object
properties:
created:
title: Team creation timestamp
type: integer
format: int64
example: 1557534630000
readOnly: true
description: 'The time the team was created, in *nix time in milliseconds.
This field is read-only, and the system always sets the value.'
creator:
title: Team creator user ID
type: string
readOnly: true
example: XxXxxXXXXXX
description: This field is read-only, and the system always sets the value.
description:
type: string
nullable: true
title: TeamDescription
description: 'Text that provides extended information about the team.
Note: Only team members and administrators can update this property.'
id:
type: string
readOnly: true
title: TeamId
description: ID for the team. This field is read-only, and the system always sets the value.
lastUpdated:
title: Team last updated time
type: integer
format: int64
example: 1557707430000
readOnly: true
description: 'The last time the team was updated, in *nix time in milliseconds.
This field is read-only, and the system always sets the value.'
lastUpdatedBy:
title: Team last updated ID
type: string
readOnly: true
example: YyYyyYYYYYY
description: 'The organization ID of the last person who updated the chart. If the
last update was done by the system, the value is the string literal
"AAAAAAAAAA". This field is read-only, and the system always sets the value.'
members:
type: array
nullable: true
items:
type: string
example:
- XxXXxXXXXXX
- YyYYyYYYYYY
- ZzZZzZZZZZZ
title: TeamMembersArray
description: 'List of user IDs that belong to this team.
Note: Only team members and administrators can add or delete user IDs from this property.'
name:
type: string
title: TeamName
description: 'Name or label for the team.
Note: Only administrators can update this property.'
notificationLists:
type: object
properties:
default:
type: array
items:
oneOf:
- title: Amazon EventBridge Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: AmazonEventBridge
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Amazon EventBridge as the notification system, set "type":
"AmazonEventBridge".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Amazon EventBridge integration identifier, which Splunk Observability
Cloud assigns
when you add the integration. Use the UI or the Integrations API
to find the value of credentialId.'
description: 'Specifies the properties needed to send a notification using
an existing Amazon EventBridge-to-Splunk Observability Cloud integration'
- title: BigPanda Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: BigPanda
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select BigPanda as the notification system, set "type": "BigPanda".'
credentialId:
type: string
description: 'The ID of the integration profile for BigPanda. Use the
Integrations API to get the credential ID for your BigPanda
integration.'
description: Notification properties for an alert sent via BigPanda
- title: Email Notification
type: object
required:
- type
- email
properties:
type:
type: string
example: Email
description: 'Tells Splunk Observability Cloud to send the notification as an email.
Set "type": "Email".'
email:
type: string
example: info@example.com
description: 'Destination address for the notification email. Splunk Observability Cloud
doesn''t
validate this address, so you must ensure it''s correct before you
use it. Splunk Observability Cloud may not store invalid values, and it may try to
send notification email that doesn''t have an address. In either
case, the notification won''t be delivered.'
description: Notification properties for an alert sent via email
- title: Jira Cloud or Jira Server Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Jira
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Jira Cloud or Jira Server as the notification system, set
"type": "Jira".'
credentialId:
type: string
readOnly: false
writeOnly: false
description: 'Jira integration identifier, which Splunk Observability Cloud assigns
when you add
the integration. Use the UI or the Integrations API to find the
value of credentialId.'
description: 'Properties of a notification sent via a Jira Cloud or
Jira Server integration, in the form of a JSON object.
These notifications take the form of a new Jira ticket whose
properties are specified in the Jira integration object.
To learn more, see the documentation for the Jira integration in the
Integrations REST API reference.'
- title: Microsoft Teams Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: Office365
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Microsoft Teams as the notification system, set "type": "Office365".
Splunk Observability Cloud uses this value for backwards compatibility.'
credentialId:
type: string
description: 'The ID of the integration profile for Microsoft Teams. Use the
Integrations API to get the credential ID for your Microsoft Teams
integration.'
description: Notification properties for an alert sent using the Microsoft Teams integration
- title: Opsgenie Notification
type: object
required:
- credentialId
- type
properties:
type:
type: string
readOnly: false
writeOnly: false
example: Opsgenie
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Opsgenie as the notification system, set "type": "Opsgenie".'
credentialId:
type: string
description: 'Opsgenie integration identifier, which Splunk Observability Cloud assigns
when you add
the integration'
credentialName:
type: string
readOnly: false
writeOnly: false
example: My Opsgenie Integration
description: 'Descriptive name of the Opsgenie credential, which you assign when
you add the integration'
responderName:
type: string
readOnly: false
writeOnly: false
description: 'Name of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderName, you don''t have to specify
responderId. If you specify neither, Opsgenie uses the defaults
for your Opsgenie account.'
responderId:
type: string
readOnly: false
writeOnly: false
description: 'ID of a responder you created in Opsgenie. Notifications you
send using the Opsgenie integration go to this responder.
If you specify responderId, you don''t have to specify
responderName. If you specify neither, Opsgenie uses the
defaults for your Opsgenie account.'
responderType:
type: string
readOnly: false
writeOnly: false
example: Team
description: Opsgenie responder type. The only valid value is "Team".
description: Notification properties for an alert sent via Opsgenie.
- title: PagerDuty Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: PagerDuty
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select PagerDuty as the notification system, set "type": "PagerDuty".'
credentialId:
type: string
description: ID of the PagerDuty integration
description: Notification properties for an alert sent via PagerDuty
- title: ServiceNow Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: ServiceNow
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select ServiceNow as the notification system, set "type": "ServiceNow".'
credentialId:
type: string
description: ID of the ServiceNow integration
description: Notification properties for an alert sent via ServiceNow
- title: Slack Notification
type: object
required:
- type
- channel
- credentialId
properties:
type:
type: string
example: Slack
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Slack as the notification system, set "type": "Slack".'
channel:
type: string
example: channel-notifications
description: 'The name of the Slack channel in which to display the notification.
Omit the leading "#" symbol. For example, specify
"#critical-notifications" as "critical-notifications".'
credentialId:
type: string
example: Slack
description: ID of the Slack integration
description: Notification properties for an alert sent via Slack
- title: Team Email Notification
type: object
required:
- type
properties:
type:
type: string
example: TeamEmail
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To send an email notification to each member of an Splunk Observability
Cloud team,
set "type": "TeamEmail".'
team:
type: string
example: XXxXXXXXXX0
description: 'The ID of the team whose members should receive the
notification. Splunk Observability Cloud sends the alert message to each member of
the team, using the email address used to invite the member to the
organization'
description: 'Team email notification service properties. When you use "TeamEmail",
Splunk Observability Cloud sends the alert message to each member of the team. The
member email address is the same as the one used to invite the member to
the organization.'
- title: Team Notification
type: object
required:
- type
- team
properties:
type:
type: string
example: Team
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To use the notification policy of a team to send notification messages,
set "type": "Team".'
team:
type: string
example: DevOps
description: 'A team ID. When you use "Team", Splunk Observability Cloud uses
the team''s notification policy to send alert messages. You can
specify different notification services for different alert
severities, and you can also specify multiple services for a
severity level.'
description: 'Team notification service properties. When you use "Team", Splunk Observability
Cloud
uses the notification policy of the specified team to send alert messages. You can
specify different notification services for different alert severities, and
you can also specify multiple services for a severity level.'
- title: Splunk On-Call Notification
type: object
required:
- type
- credentialId
- routingKey
properties:
type:
type: string
example: VictorOps
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select Splunk On-Call as the notification system, set "type": "VictorOps";
Splunk Observability Cloud uses VictorOps as the "type" value to ensure backwards
compatibility.'
credentialId:
type: string
description: Splunk Observability Cloud ID of the Splunk On-Call integration
routingKey:
type: string
description: 'Indicates the routing key used to determine how to process the
notification message. This key specifies where the notification is
posted and how related alerts are escalated. For more information, refer to the
VictorOps knowlegebase.'
description: Notification properties for an alert sent via Splunk On-Call
- title: Webhook URL Notification
type: object
required:
- type
properties:
type:
type: string
example: Webhook
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To use a Webhook as the notification system, set "type": "Webhook".'
credentialId:
type: string
description: Webhook integration ID
secret:
type: string
description: 'A secret value that identifies the Webhook integration to use when
sending notifications. This value also indicates that the
notification has permission to use the integration. If
credentialId is set, this property is ignored.'
url:
type: string
example: https://www.example.com/webhook
description: 'The URL of a Webhook integration. You must provide the mechanism for
processing notifications sent to the URL and routing them to the
proper chat or incident management system. If credentialId is set,
this property is ignored.'
description: Notification properties for an alert sent via a Webhook
- title: xMatters Notification
type: object
required:
- type
- credentialId
properties:
type:
type: string
example: XMatters
description: 'Tells Splunk Observability Cloud which system it should use to send the
notification. To select xMatters as the notification system, set "type": "XMatters"
using a
capital "X" as the first letter.'
credentialId:
type: string
description: xMatters integration ID
description: Notification properties for an alert sent via xMatters
title: NotificationDestination
description: Individual notification service
description: 'List of notification services to use for undefined alerts
category. You can specify a single notification service or a list.'
critical:
type: array
items:
oneOf:
- title: Amazon EventBridge Notification
type: object
required:
- type
- credentialId
# --- truncated at 32 KB (799 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/splunk-observability/refs/heads/main/openapi/splunk-observability-teams-openapi.yml