GCS Sources (Beta)

Overview

The GCS Sources API endpoints are in open beta starting with Panther version 1.121, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with Google Cloud Storage (GCS) Sources in Panther.

Required permissions

• For GET operations, your API token must have the View Log Sources permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

Operations

get gcs source

get

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the GCS source to fetch

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

gcsBucketstringOptional

The GCS bucket name

integrationIdstringOptional

The id of the GCS source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

projectIdstringOptional

The GCP project ID. Optional for service_account credentials. Required for WIF.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID used to receive GCS bucket notifications

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

get

/log-sources/gcs/{id}

HTTPcURLJavaScriptPython

GET /log-sources/gcs/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "credentials": "text",
  "credentialsType": "service_account",
  "gcsBucket": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "prefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ],
  "projectId": "text",
  "subscriptionId": "text"
}

put gcs source

put

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the GCS source to update

Body

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

gcsBucketstringRequired

The GCS bucket name

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

projectIdstringOptional

The GCP project ID. Optional for service_account credentials. Required for WIF.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID used to receive GCS bucket notifications

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

gcsBucketstringOptional

The GCS bucket name

integrationIdstringOptional

The id of the GCS source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

projectIdstringOptional

The GCP project ID. Optional for service_account credentials. Required for WIF.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID used to receive GCS bucket notifications

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

put

/log-sources/gcs/{id}

HTTPcURLJavaScriptPython

PUT /log-sources/gcs/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 335

{
  "credentials": "text",
  "credentialsType": "service_account",
  "gcsBucket": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "prefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ],
  "projectId": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "gcsBucket": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "prefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ],
  "projectId": "text",
  "subscriptionId": "text"
}

create gcs source

post

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Body

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

gcsBucketstringRequired

The GCS bucket name

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

projectIdstringOptional

The GCP project ID. Optional for service_account credentials. Required for WIF.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID used to receive GCS bucket notifications

Responses

201

Created response.

application/json

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

post

/log-sources/gcs

HTTPcURLJavaScriptPython

POST /log-sources/gcs HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 335

{
  "credentials": "text",
  "credentialsType": "service_account",
  "gcsBucket": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "prefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ],
  "projectId": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "gcsBucket": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "prefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ],
  "projectId": "text",
  "subscriptionId": "text"
}

delete gcs source

delete

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the GCS source to delete

Responses

204

No Content response.

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

delete

/log-sources/gcs/{id}

HTTPcURLJavaScriptPython

DELETE /log-sources/gcs/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content