Pub/Sub Sources (Beta)

Overview

The Pub/Sub Sources API endpoints are in open beta starting with Panther version 1.121, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with Pub/Sub Sources in Panther.

Required permissions

• For GET operations, your API token must have the View Log Sources permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

Operations

put pub/sub source

put

put updates a pubsub source

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to update

Body

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Required

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationIdstringOptional

The id of the pubsub source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Optional

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

put

/log-sources/pubsub/{id}

HTTPcURLJavaScriptPython

PUT /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 277

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

create pub/sub source

post

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Body

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Required

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID

Responses

201

Created response.

application/json

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

post

/log-sources/pubsub

HTTPcURLJavaScriptPython

POST /log-sources/pubsub HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 277

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

get pub/sub source

get

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to fetch

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationIdstringOptional

The id of the pubsub source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Optional

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

get

/log-sources/pubsub/{id}

HTTPcURLJavaScriptPython

GET /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

delete pub/sub source

delete

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to delete

Responses

204

No Content response.

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

delete

/log-sources/pubsub/{id}

HTTPcURLJavaScriptPython

DELETE /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content