# Pub/Sub Sources (Beta)

## Overview

{% hint style="info" %}
The Pub/Sub Sources API endpoints are in open beta starting with Panther version 1.121, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

Use these API operations to interact with [Pub/Sub Sources](https://docs.panther.com/data-onboarding/data-transports/google/pubsub) in Panther. 

## Required permissions

* For `GET` operations, your API token must have the `View Log Sources` permission.
* For `POST`, `PUT`, and `DELETE` operations, your API token must have the `Manage Log Sources` permission.

## Operations

## put Pub/Sub source

> put updates a pubsub source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"Pub/Sub source","description":"The Pub/Sub source API handles all operations for GCP Pub/Sub log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"PubSubSourceAPI.ModifyPubSubSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions"},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF."},"regionalEndpoint":{"type":"string","description":"Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID"}},"required":["integrationLabel","subscriptionId","logTypes","logStreamType","credentialsType"]},"PubSubSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"PubSubSourceAPI.PubSubSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"integrationId":{"type":"string","description":"The id of the pubsub source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions"},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF."},"regionalEndpoint":{"type":"string","description":"Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID"}}},"PubSubSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/pubsub/{id}":{"put":{"tags":["Pub/Sub source"],"summary":"put Pub/Sub source","description":"put updates a pubsub source","operationId":"Pub/Sub source#put","parameters":[{"name":"id","in":"path","description":"ID of the pubsub source to update","required":true,"schema":{"type":"string","description":"ID of the pubsub source to update"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ModifyPubSubSource"}}}},"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.PubSubSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.NotFoundError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ServiceError"}}}}}}}}}
```

## POST /log-sources/pubsub

> create Pub/Sub source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"Pub/Sub source","description":"The Pub/Sub source API handles all operations for GCP Pub/Sub log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"PubSubSourceAPI.ModifyPubSubSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions"},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF."},"regionalEndpoint":{"type":"string","description":"Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID"}},"required":["integrationLabel","subscriptionId","logTypes","logStreamType","credentialsType"]},"PubSubSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"PubSubSourceAPI.PubSubSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"integrationId":{"type":"string","description":"The id of the pubsub source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions"},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF."},"regionalEndpoint":{"type":"string","description":"Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID"}}},"PubSubSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ExistsError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/pubsub":{"post":{"tags":["Pub/Sub source"],"summary":"create Pub/Sub source","operationId":"Pub/Sub source#create","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ModifyPubSubSource"}}}},"responses":{"201":{"description":"Created response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.PubSubSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.BadRequestError"}}}},"409":{"description":"exists: Conflict response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ExistsError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ServiceError"}}}}}}}}}
```

## GET /log-sources/pubsub/{id}

> get Pub/Sub source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"Pub/Sub source","description":"The Pub/Sub source API handles all operations for GCP Pub/Sub log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"PubSubSourceAPI.PubSubSource":{"type":"object","properties":{"credentials":{"type":"string","description":"The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update."},"credentialsType":{"type":"string","description":"The type of credentials being used: service_account or wif (Workload Identity Federation).","enum":["service_account","wif"]},"integrationId":{"type":"string","description":"The id of the pubsub source"},"integrationLabel":{"type":"string","description":"The integration label (name)"},"logStreamType":{"type":"string","description":"The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML","enum":["Auto","JSON","JsonArray","Lines","XML"]},"logStreamTypeOptions":{"$ref":"#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions"},"logTypes":{"type":"array","items":{"type":"string"},"description":"The log types for parsing ingested data"},"projectId":{"type":"string","description":"The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF."},"regionalEndpoint":{"type":"string","description":"Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used."},"subscriptionId":{"type":"string","description":"The GCP Pub/Sub subscription ID"}}},"PubSubSourceAPI.LogStreamTypeOptions":{"type":"object","properties":{"jsonArrayEnvelopeField":{"type":"string","description":"Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself"},"xmlRootElement":{"type":"string","description":"The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element"}}},"PubSubSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.NotFoundError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/pubsub/{id}":{"get":{"tags":["Pub/Sub source"],"summary":"get Pub/Sub source","operationId":"Pub/Sub source#get","parameters":[{"name":"id","in":"path","description":"ID of the pubsub source to fetch","required":true,"schema":{"type":"string","description":"ID of the pubsub source to fetch"}}],"responses":{"200":{"description":"OK response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.PubSubSource"}}}},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.BadRequestError"}}}},"404":{"description":"not_found: Not Found response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.NotFoundError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ServiceError"}}}}}}}}}
```

## DELETE /log-sources/pubsub/{id}

> delete Pub/Sub source

```json
{"openapi":"3.0.3","info":{"title":"Panther REST API","version":"1.0"},"tags":[{"name":"Pub/Sub source","description":"The Pub/Sub source API handles all operations for GCP Pub/Sub log sources"}],"servers":[{"url":"https://{api_host}","variables":{"api_host":{"default":"your-api-host"}}}],"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","name":"X-API-Key","in":"header"}},"schemas":{"PubSubSourceAPI.BadRequestError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]},"PubSubSourceAPI.ServiceError":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}},"paths":{"/log-sources/pubsub/{id}":{"delete":{"tags":["Pub/Sub source"],"summary":"delete Pub/Sub source","operationId":"Pub/Sub source#delete","parameters":[{"name":"id","in":"path","description":"ID of the pubsub source to delete","required":true,"schema":{"type":"string","description":"ID of the pubsub source to delete"}}],"responses":{"204":{"description":"No Content response."},"400":{"description":"bad_request: Bad Request response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.BadRequestError"}}}},"500":{"description":"service: Internal Server Error response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PubSubSourceAPI.ServiceError"}}}}}}}}}
```