Pub/Sub Sources

Overview

Use these API operations to interact with Pub/Sub Sources in Panther.

Required permissions

For GET operations, your API token must have the View Log Sources permission.
For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

Operations

put pub/sub source

put

put updates a pubsub source

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to update

Body

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Required

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationIdstringOptional

The id of the pubsub source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Optional

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

put/log-sources/pubsub/{id}

PUT /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 277

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

create pub/sub source

post

Authorizations

X-API-KeystringRequired

Body

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumRequired

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationLabelstringRequired

The integration label (name)

logStreamTypestring · enumRequired

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Required

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringRequired

The GCP Pub/Sub subscription ID

Responses

201

Created response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationIdstringOptional

The id of the pubsub source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Optional

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

post/log-sources/pubsub

POST /log-sources/pubsub HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 277

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

get pub/sub source

get

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to fetch

Responses

200

OK response.

application/json

credentialsstringOptional

The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.

credentialsTypestring · enumOptional

The type of credentials being used: service_account or wif (Workload Identity Federation).

Possible values:

integrationIdstringOptional

The id of the pubsub source

integrationLabelstringOptional

The integration label (name)

logStreamTypestring · enumOptional

The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML

Possible values:

logTypesstring[]Optional

The log types for parsing ingested data

projectIdstringOptional

The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.

regionalEndpointstringOptional

Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.

subscriptionIdstringOptional

The GCP Pub/Sub subscription ID

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

get/log-sources/pubsub/{id}

GET /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "credentials": "text",
  "credentialsType": "service_account",
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "xmlRootElement": "text"
  },
  "logTypes": [
    "text"
  ],
  "projectId": "text",
  "regionalEndpoint": "text",
  "subscriptionId": "text"
}

delete pub/sub source

delete

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the pubsub source to delete

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

delete/log-sources/pubsub/{id}

DELETE /log-sources/pubsub/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content

PreviousHTTP Sources NextS3 Sources

Last updated 2 months ago

Was this helpful?