# GCS 소스 (Beta)

## 개요

{% hint style="info" %}
GCS Sources API 엔드포인트는 Panther 버전 1.121부터 오픈 베타로 제공되며, 모든 고객이 사용할 수 있습니다. 발견한 버그 보고나 기능 요청은 Panther 지원팀과 공유해 주세요.
{% endhint %}

이 API 작업을 사용하여 상호 작용하세요 [Google Cloud Storage(GCS) 소스](/ko/data-onboarding/data-transports/google/cloud-storage.md) Panther에서.

## 필수 권한

* \~에 대해 `GET` 작업의 경우, API 토큰에는 다음이 있어야 합니다 `로그 소스 보기` .
* \~에 대해 `POST`, `PUT`, 그리고 `DELETE` 작업의 경우, API 토큰에는 다음이 있어야 합니다 `로그 소스 관리` .

## 작업

## GET /log-sources/gcs/{id}

> get gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"get":{"tags":["gcs source"],"summary":"get gcs source","operationId":"gcs source#get","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to fetch","required":true,"schema":{"type":"string","description":"ID of the GCS source to fetch"}}],"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.NotFoundError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## PUT /log-sources/gcs/{id}

> put gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.ModifyGcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}},"required":["integrationLabel","subscriptionId","gcsBucket","prefixLogTypes","logStreamType","credentialsType"]},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"put":{"tags":["gcs source"],"summary":"put gcs source","operationId":"gcs source#put","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to update","required":true,"schema":{"type":"string","description":"ID of the GCS source to update"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ModifyGcsSource"}}}},"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.NotFoundError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## POST /log-sources/gcs

> create gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.ModifyGcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}},"required":["integrationLabel","subscriptionId","gcsBucket","prefixLogTypes","logStreamType","credentialsType"]},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs":{"post":{"tags":["gcs source"],"summary":"create gcs source","operationId":"gcs source#create","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ModifyGcsSource"}}}},"responses":{"201":{"description":"Created response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## DELETE /log-sources/gcs/{id}

> delete gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"delete":{"tags":["gcs source"],"summary":"delete gcs source","operationId":"gcs source#delete","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to delete","required":true,"schema":{"type":"string","description":"ID of the GCS source to delete"}}],"responses":{"204":{"description":"No Content response."},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/ko/panther/api/rest/log-sources/gcs-sources.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.