Integrations latest
Use this endpoint to create, retrieve, update, and delete integrations, which define the connection between an external system and Splunk Observability Cloud.
Integrations store authentication and configuration information that Splunk Observability Cloud uses to connect to the
external system.
Each external provider has its own requirements for integration information. Read the
documentation for the request body of the POST or PUT /integration
to learn the requirements for the integration you want.
Requirements
- You must have an organization access token with the API permission or a session token to use the API.
- You have to have the Splunk Observability Cloud admin role to use the
POST /integration
,GET /integration
,GET /integration/{id}
,PUT /integration/{id}
,DELETE /integration/{id}
, andGET /integration/validate/{id}
operations.
Authentication
Requests you send to the Integrations endpoint require an authentication token. The type of token you need to use is dependent on the operation you're performing:
- To create, update, delete, or validate integrations, you need to use a session token associated with an administrator. This token type is sometimes referred to as an admin token.
- To retrieve integrations, you can use an org token with an
authScopes
value that includesAPI
, or a session token. The session token doesn't have to be an admin token.
Org tokens are also known as access tokens. Session tokens are also known as User API access tokens. To learn more about authentication tokens, see the Authentication Tokens topic in the Developer Guide for Splunk Observability Cloud.
Supported service types
Splunk Observability Cloud offers integrations for the following:
- Cloud service providers such as AWS CloudWatch
- SSO Authentication systems that use SAML, such as ADFS
- Detector alert notification systems such as PagerDuty
Monitoring integrations
Splunk Observability Cloud provides integration support for the following cloud service providers:
- Amazon Web Services (AWS)
- Google Cloud Platform (GCP)
- Microsoft Azure
SSO Authentication using SAML
Splunk Observability Cloud provides integration support for the following SSO systems that use SAML:
- Microsoft Active Directory Federation Services (ADFS)
- Okta
- OneLogin
- PingOne
Alert notification systems
Splunk Observability Cloud provides integration support for the following detector alert notification systems:
- Amazon EventBridge
- BigPanda
- Jira
- Microsoft Teams
- Opsgenie
- PagerDuty
- ServiceNow
- Slack
- Splunk On-Call
- Webhook
- xMatters
Note: To ensure backward compatibility, the type
property for a
Microsoft Teams integration is Office365
.
Viewing request body documentation
The request body format for the following operations depends on the type of integration you use:
- POST
/integration
- PUT
/integration/{id}
The response body format for the following operations also depends on the type of integration you use:
- GET
/integration
- GET
/integration/{id}
API Base URL
Integrations API endpoint URL
Retrieves one or more integration objects based on a query specified in query parameters encoded on the URL.
Notes:
- To ensure security, the API omits some authentication and authorization properties from response objects.
- Note: Splunk Observability Cloud returns a maximum of 10,000 objects, even if your organization contains more than 10,000. To learn more, see the Considerations for retrieve operations section in the Developer Guide for Splunk Observability Cloud.
Jira integration:
The response body for a Jira integration contains a union of the following response properties:
- Properties common to all integration responses
- Properties common to all Jira integration responses
- Authentication credential properties for Jira Cloud integrations
- Authentication credential properties for Jira Server integrations
Some Jira integration properties are set to null
in the response:
- Optional properties that you didn't specify in your creation request
- Password or API token, to ensure security
- Properties not used for a specific type of Jira integration.
For example, if you integrate with Jira Cloud, the response body contains
"username"\: null
because username
isn't a valid property for a
Jira Cloud integration.
Headers
Name | Description |
---|---|
X-SF-TOKEN Required | string Authentication token |
Query Parameters
Name | Description |
---|---|
limit | integer <int32> >= 1 Default: 50 Number of integration objects to return from the result set |
name | string Integration object name to search for. You can use wildcard characters to specify the name:
|
offset | integer <int32> >= 0 Default: 0 0-relative position in the result set where the API should start returning integration objects. |
type | string Type of integration to search for. This property is an enumerated string, and only the enumerated values are allowed. To search for a Microsoft Teams integration, use |
userParam | string Return user name values in the response based on the full name value from the user's profile. To return the name of the user who created the integration, specify To return the name of the user who last updated the integration, specify You can specify one or both parameter values. For example, to include both parameters, specify |
Code Examples
curl -X GET "https://api.{REALM}.signalfx.com/v2/integration" \
-H "Content-Type: application/json" \
-H "X-SF-TOKEN: <value>"
Response Body
Success
Note: If the request is well-formed but Splunk Observability Cloud can't find any
matching integration objects, the API still returns 200. In this
case, the count
property is set to 0
, and the results
array is
empty.
Name | Description |
---|---|
count | integer <int64> Number of integrations that matched the search criteria. This
value is not the number of integrations returned in the
response body. To learn more, see the description of |
results | array[object] List of integrations, in the form of a JSON array of JSON
objects. Each object contains properties that are common to
all integrations as well as properties that are specific to
the integration type ( The size of
|
Response Examples
{ count: 0, results: [ { type: "ADFS", created: 1556361030000, createdByName: "Dana Cruz", creator: "X_xxxx9XXXX", enabled: true, id: "XXxxxXXXXXX", issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", lastUpdated: 1556620230000, lastUpdatedBy: "Y_yyyy0YYYY", lastUpdatedByName: "Ariel Amal", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string" } ]}
Creates an integration object that Splunk Observability Cloud uses to connect with a monitoring, SSO, or alerting service. The steps to establish a connection to a service differ for each type of service and might differ for individual services.
Each service has specific information requirements for integrating with Splunk Observability Cloud.
Notes:
- To ensure security, the API omits authentication and authorization properties from response objects.
- In the response object, the
enabled
property is always set totrue
.
Jira integration: For a Jira integration request, the response body contains a union of the following response properties:
- Properties common to all integration responses
- Properties common to all Jira integration responses
- Authentication credential properties for Jira Cloud integrations
- Authentication credential properties for Jira Server integrations
Some Jira integration properties are set to null
in the response:
- Optional properties that you didn't specify in your creation request
- Password or API token, to ensure security
- Properties not used for a specific type of Jira integration.
For example, if you integrate with Jira Cloud, the response body contains
"username": null
because username
isn't a valid property for a
Jira Cloud integration.
Headers
Name | Description |
---|---|
Content-Type Required | string Format of the request body. Always |
X-SF-TOKEN Required | string Authentication token. Must be a session token (User API access token) associated with an administrator. |
Query Parameters
Name | Description |
---|---|
skipValidation | boolean Flag that controls how Splunk Observability Cloud validates an alert integration
object. If |
Code Examples
curl -X POST "https://api.{REALM}.signalfx.com/v2/integration" \
-H "Content-Type: application/json" \
-H "X-SF-TOKEN: <value>" \
-d '{
"type": "ADFS",
"enabled": true,
"issuerUrl": "https://www.buttercup.com/o/saml2?idpid=999",
"metadata": "FederationMetadata.xml",
"name": "MyIntegration",
"publicKey": "string"
}'
Request Body
Properties of the integration.
Note: Because this is a request to create a new
integration, you must specify the type
and "name" properties:
type
determines the type of integration that Splunk Observability Cloud creates.name
provides a unique name for the integration.
Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.
Name | Description |
---|---|
type Required | string Example: ADFS Type of service that this integration represents, in the form
of an enumerated string, always |
enabled | boolean Example: true Indicates the state of the integration. If When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be |
issuerUrl | string <uri> Example: https://www.buttercup.com/o/saml2?idpid=999 URL of the entity that issued the certificate for a SAML integration |
metadata | string Example: FederationMetadata.xml File name of the SAML metadata XML file for the integration:
|
name | string Example: MyIntegration Human-readable label for the integration. Use this property to identify a specific integration when you're using multiple integrations for the same service. |
publicKey | string <publickey> Contents of the |
Request Examples
{ type: "ADFS", enabled: true, issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string"}
Response Body
Success
Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.
Name | Description |
---|---|
type Required | string Example: ADFS Type of service that this integration represents, in the form
of an enumerated string, always |
created | integer <int64> Example: 1556361030000 Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only |
createdByName | string Example: Dana Cruz Name of the user that created the integration. Set to |
creator | string Example: X_xxxx9XXXX ID of the user that created the integration.
If Splunk Observability Cloud created the object, the value is |
enabled | boolean Example: true Indicates the state of the integration. If When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be |
id | string Example: XXxxxXXXXXX Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to
an integration using the GET, PUT, or
DELETE |
issuerUrl | string <uri> Example: https://www.buttercup.com/o/saml2?idpid=999 URL of the entity that issued the certificate for a SAML integration |
lastUpdated | integer <int64> Example: 1556620230000 Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only |
lastUpdatedBy | string Example: Y_yyyy0YYYY ID of the user who last updated the integration. If
Splunk Observability Cloud last updated the integration, the value is |
lastUpdatedByName | string Example: Ariel Amal Name of the user that last updated the integration. Set to |
metadata | string Example: FederationMetadata.xml File name of the SAML metadata XML file for the integration:
|
name | string Example: MyIntegration Human-readable label for the integration. Use this property to identify a specific integration when you're using multiple integrations for the same service. |
publicKey | string <publickey> Contents of the |
Response Examples
{ type: "ADFS", created: 1556361030000, createdByName: "Dana Cruz", creator: "X_xxxx9XXXX", enabled: true, id: "XXxxxXXXXXX", issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", lastUpdated: 1556620230000, lastUpdatedBy: "Y_yyyy0YYYY", lastUpdatedByName: "Ariel Amal", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string"}
Validates the credentials of an existing integration.
Integrations such as AWS or GCP might have permission changes. Use this API to verify that the integration is still valid.
Note: This API doesn't require a request body, and doesn't return a response body.
Headers
Name | Description |
---|---|
X-SF-TOKEN Required | string Authentication token. Must be a session token (User API access token) associated with an administrator. |
Path Parameters
Name | Description |
---|---|
id Required | string ID of the existing integration object that you want to validate |
Code Examples
curl -X GET "https://api.{REALM}.signalfx.com/v2/integration/validate/{id}" \
-H "Content-Type: application/json" \
-H "X-SF-TOKEN: <value>"
Response Body
Successful validation of the integration object
Retrieves the integration object specified by the id
path parameter.
Note: To ensure security, the API omits some authentication and
authorization properties from response objects.
Jira integration:
For a Jira integration request, the response body contains a union of the following response properties:
- Properties common to all integration responses
- Properties common to all Jira integration responses
- Authentication credential properties for Jira Cloud integrations
- Authentication credential properties for Jira Server integrations
Some Jira integration properties are set to null
in the response:
- Optional properties that you didn't specify in your creation request
- Password or API token, to ensure security
- Properties not used for a specific type of Jira integration.
For example, if you integrate with Jira Cloud, the response body contains
"username": null
because username
isn't a valid property for a
Jira Cloud integration.
Headers
Name | Description |
---|---|
X-SF-Token Required | string Authentication token |
Path Parameters
Name | Description |
---|---|
id Required | string ID of the existing integration object that you want to retrieve |
Query Parameters
Name | Description |
---|---|
userParam | string Return user name values in the response based on the full name value from the user's profile. To return the name of the user who created the integration, specify To return the name of the user who last updated the integration, specify You can specify one or both parameter values. For example, to include both parameters, specify |
Code Examples
curl -X GET "https://api.{REALM}.signalfx.com/v2/integration/{id}" \
-H "Content-Type: application/json" \
-H "X-SF-Token: <value>"
Response Body
Success
Note: If the request is well-formed but Splunk Observability Cloud can't find the object, the API still returns 200. In this case, the response body is empty.
Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.
Name | Description |
---|---|
type Required | string Example: ADFS Type of service that this integration represents, in the form
of an enumerated string, always |
created | integer <int64> Example: 1556361030000 Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only |
createdByName | string Example: Dana Cruz Name of the user that created the integration. Set to |
creator | string Example: X_xxxx9XXXX ID of the user that created the integration.
If Splunk Observability Cloud created the object, the value is |
enabled | boolean Example: true Indicates the state of the integration. If When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be |
id | string Example: XXxxxXXXXXX Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to
an integration using the GET, PUT, or
DELETE |
issuerUrl | string <uri> Example: https://www.buttercup.com/o/saml2?idpid=999 URL of the entity that issued the certificate for a SAML integration |
lastUpdated | integer <int64> Example: 1556620230000 Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only |
lastUpdatedBy | string Example: Y_yyyy0YYYY ID of the user who last updated the integration. If
Splunk Observability Cloud last updated the integration, the value is |
lastUpdatedByName | string Example: Ariel Amal Name of the user that last updated the integration. Set to |
metadata | string Example: FederationMetadata.xml File name of the SAML metadata XML file for the integration:
|
name | string Example: MyIntegration Human-readable label for the integration. Use this property to identify a specific integration when you're using multiple integrations for the same service. |
publicKey | string <publickey> Contents of the |
Response Examples
{ type: "ADFS", created: 1556361030000, createdByName: "Dana Cruz", creator: "X_xxxx9XXXX", enabled: true, id: "XXxxxXXXXXX", issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", lastUpdated: 1556620230000, lastUpdatedBy: "Y_yyyy0YYYY", lastUpdatedByName: "Ariel Amal", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string"}
Updates the integration object specified by the id
path parameter.
Note: To ensure security, the API omits some authentication and authorization properties from response objects.
Jira integration:
For a Jira integration request, the response body contains a union of the following response properties:
- Properties common to all integration responses
- Properties common to all Jira integration responses
- Authentication credential properties for Jira Cloud integrations
- Authentication credential properties for Jira Server integrations
Some Jira integration properties are set to null
in the response:
- Optional properties that you didn't specify in your creation request
- Password or API token, to ensure security
- Properties not used for a specific type of Jira integration.
For example, if you integrate with Jira Cloud, the response body contains
"username": null
because username
isn't a valid property for a
Jira Cloud integration.
Headers
Name | Description |
---|---|
Content-Type Required | string Format of the request body. Always |
X-SF-TOKEN Required | string Authentication token. Must be a session token (User API access token) associated with a user who has administrative privileges. |
Path Parameters
Name | Description |
---|---|
id Required | string ID of the existing integration object that you want to update |
Query Parameters
Name | Description |
---|---|
skipValidation | boolean Flag that controls how Splunk Observability Cloud validates an alert integration
object. If |
Code Examples
curl -X PUT "https://api.{REALM}.signalfx.com/v2/integration/{id}" \
-H "Content-Type: application/json" \
-H "X-SF-TOKEN: <value>" \
-d '{
"type": "ADFS",
"enabled": true,
"issuerUrl": "https://www.buttercup.com/o/saml2?idpid=999",
"metadata": "FederationMetadata.xml",
"name": "MyIntegration",
"publicKey": "string"
}'
Request Body
Properties that Splunk Observability Cloud uses to update the integration object. Each service that Splunk Observability Cloud integrates with has its own properties.
Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.
Name | Description |
---|---|
type Required | string Example: ADFS Type of service that this integration represents, in the form
of an enumerated string, always |
enabled | boolean Example: true Indicates the state of the integration. If When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be |
issuerUrl | string <uri> Example: https://www.buttercup.com/o/saml2?idpid=999 URL of the entity that issued the certificate for a SAML integration |
metadata | string Example: FederationMetadata.xml File name of the SAML metadata XML file for the integration:
|
name | string Example: MyIntegration Human-readable label for the integration. Use this property to identify a specific integration when you're using multiple integrations for the same service. |
publicKey | string <publickey> Contents of the |
Request Examples
{ type: "ADFS", enabled: true, issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string"}
Response Body
Successful update of the integration object
Specifies the SAML integration between Active Directory Federation Services (ADFS) and Splunk Observability Cloud, in the form of a JSON object.
Name | Description |
---|---|
type Required | string Example: ADFS Type of service that this integration represents, in the form
of an enumerated string, always |
created | integer <int64> Example: 1556361030000 Date and time the integration was created, in the form of a *nix timestamp in milliseconds. Set by Splunk Observability Cloud; read-only |
createdByName | string Example: Dana Cruz Name of the user that created the integration. Set to |
creator | string Example: X_xxxx9XXXX ID of the user that created the integration.
If Splunk Observability Cloud created the object, the value is |
enabled | boolean Example: true Indicates the state of the integration. If When you create an integration, set this property according to the
instructions in the user documentation. Some integrations, such as
AWS, expect the initial value to be |
id | string Example: XXxxxXXXXXX Splunk Observability Cloud-assigned ID of the integration. Use this property to refer to
an integration using the GET, PUT, or
DELETE |
issuerUrl | string <uri> Example: https://www.buttercup.com/o/saml2?idpid=999 URL of the entity that issued the certificate for a SAML integration |
lastUpdated | integer <int64> Example: 1556620230000 Integration last updated timestamp, in *nix time Set by Splunk Observability Cloud; read-only |
lastUpdatedBy | string Example: Y_yyyy0YYYY ID of the user who last updated the integration. If
Splunk Observability Cloud last updated the integration, the value is |
lastUpdatedByName | string Example: Ariel Amal Name of the user that last updated the integration. Set to |
metadata | string Example: FederationMetadata.xml File name of the SAML metadata XML file for the integration:
|
name | string Example: MyIntegration Human-readable label for the integration. Use this property to identify a specific integration when you're using multiple integrations for the same service. |
publicKey | string <publickey> Contents of the |
Response Examples
{ type: "ADFS", created: 1556361030000, createdByName: "Dana Cruz", creator: "X_xxxx9XXXX", enabled: true, id: "XXxxxXXXXXX", issuerUrl: "https://www.buttercup.com/o/saml2?idpid=999", lastUpdated: 1556620230000, lastUpdatedBy: "Y_yyyy0YYYY", lastUpdatedByName: "Ariel Amal", metadata: "FederationMetadata.xml", name: "MyIntegration", publicKey: "string"}
Headers
Name | Description |
---|---|
X-SF-TOKEN Required | string Authentication token. Must be a session token (User API access token) associated with an administrator. |
Path Parameters
Name | Description |
---|---|
id Required | string ID of the existing integration object that you want to delete |
Code Examples
curl -X DELETE "https://api.{REALM}.signalfx.com/v2/integration/{id}" \
-H "Content-Type: application/json" \
-H "X-SF-TOKEN: <value>"
Response Body
Success
Response Examples
{ code: 400, message: "Invalid ID <ID_VALUE>"}