# GCS Sources (Beta)

## Overview

{% hint style="info" %}
The GCS Sources API endpoints are in open beta starting with Panther version 1.121, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

Use these API operations to interact with [Google Cloud Storage (GCS) Sources](/data-onboarding/data-transports/google/cloud-storage.md) in Panther.

## Required permissions

* For `GET` operations, your API token must have the `View Log Sources` permission.
* For `POST`, `PUT`, and `DELETE` operations, your API token must have the `Manage Log Sources` permission.

## Operations

## GET /log-sources/gcs/{id}

> get gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"get":{"tags":["gcs source"],"summary":"get gcs source","operationId":"gcs source#get","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to fetch","required":true,"schema":{"type":"string","description":"ID of the GCS source to fetch"}}],"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.NotFoundError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## PUT /log-sources/gcs/{id}

> put gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.ModifyGcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}},"required":["integrationLabel","subscriptionId","gcsBucket","prefixLogTypes","logStreamType","credentialsType"]},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"put":{"tags":["gcs source"],"summary":"put gcs source","operationId":"gcs source#put","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to update","required":true,"schema":{"type":"string","description":"ID of the GCS source to update"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ModifyGcsSource"}}}},"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.NotFoundError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## POST /log-sources/gcs

> create gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.ModifyGcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}},"required":["integrationLabel","subscriptionId","gcsBucket","prefixLogTypes","logStreamType","credentialsType"]},"GcsSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"GcsSourceAPI.PrefixLogTypesMapping":{"type":"object","properties":{"excludedPrefixes":{"type":"array","items":{"type":"string"},"description":"Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments."},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types (schemas) to apply for this prefix"},"prefix":{"type":"string","description":"GCS prefix to match. Leave empty to match all files in the bucket."}}},"GcsSourceAPI.GcsSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"gcsBucket":{"type":"string","description":"The GCS bucket name"},"integrationId":{"type":"string","description":"The id of the GCS source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/GcsSourceAPI.LogStreamTypeOptions"},"prefixLogTypes":{"type":"array","items":{"$ref":"#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping"},"description":"Prefix-based log type mappings for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials. Required for WIF."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID used to receive GCS bucket notifications"}}},"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs":{"post":{"tags":["gcs source"],"summary":"create gcs source","operationId":"gcs source#create","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ModifyGcsSource"}}}},"responses":{"201":{"description":"Created response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.GcsSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```

## DELETE /log-sources/gcs/{id}

> delete gcs source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"gcs source","description":"The GCS source API handles all operations for Google Cloud Storage log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"GcsSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"GcsSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/gcs/{id}":{"delete":{"tags":["gcs source"],"summary":"delete gcs source","operationId":"gcs source#delete","parameters":[{"name":"id","in":"path","description":"ID of the GCS source to delete","required":true,"schema":{"type":"string","description":"ID of the GCS source to delete"}}],"responses":{"204":{"description":"No Content response."},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.BadRequestError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GcsSourceAPI.ServiceError"}}}}}}}}}
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/panther-developer-workflows/api/rest/log-sources/gcs-sources.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.