Cribl Cloud API

openapi: 3.1.0
info:
  title: Cribl Cloud API
  description: >-
    The Cribl Cloud API is a RESTful API that provides a centrally managed
    control plane for programmatically configuring and managing Cribl resources
    across Stream, Edge, Search, and Lake deployments. It allows developers to
    retrieve and manage data, automate repetitive manual processes, and
    integrate with third-party applications. The API uses OAuth 2.0
    authentication via client credentials and follows a resource-based
    structure where each endpoint corresponds to a specific Cribl resource or
    collection of resources. The size limit for requests is 5 MB.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
externalDocs:
  description: Cribl API Reference
  url: https://docs.cribl.io/api-reference/
servers:
  - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
    description: Cribl Cloud
    variables:
      workspaceName:
        default: default
        description: The name of the Cribl Cloud workspace
      organizationId:
        default: org-id
        description: The Cribl Cloud organization identifier
  - url: https://{hostname}:{port}/api/v1
    description: On-Premises Deployment
    variables:
      hostname:
        default: localhost
        description: The hostname of the Cribl instance
      port:
        default: '9000'
        description: The port of the Cribl instance
tags:
  - name: Authentication
    description: >-
      Obtain and manage authentication tokens for API access.
  - name: Collectors
    description: >-
      Manage scheduled and on-demand data collection jobs from REST APIs,
      databases, scripts, and other sources.
  - name: Database Connections
    description: >-
      Configure and manage database connections used by collectors and
      lookup functions.
  - name: Destinations
    description: >-
      Manage data output destinations where processed events are sent,
      including Splunk, S3, Elasticsearch, and webhook endpoints.
  - name: Functions
    description: >-
      Retrieve available processing functions that can be used within
      pipelines for data transformation.
  - name: Groups
    description: >-
      Manage Worker Groups and Edge Fleets, which organize and deploy
      configurations to sets of worker nodes or edge agents.
  - name: Health
    description: >-
      Check the health status of the Cribl instance.
  - name: Jobs
    description: >-
      Monitor and manage running and completed collection and processing jobs.
  - name: Lake Datasets
    description: >-
      Manage Cribl Lake datasets for storing and organizing observability
      data in open formats.
  - name: Lookups
    description: >-
      Manage lookup files and tables used for data enrichment in pipelines.
  - name: Nodes
    description: >-
      Monitor and manage individual worker nodes and edge nodes within
      groups and fleets.
  - name: Notifications
    description: >-
      Configure notification rules and targets for alerting on data flow
      anomalies and system events.
  - name: Packs
    description: >-
      Install, manage, and distribute reusable configuration packs containing
      pipelines, routes, and other resources.
  - name: Pipelines
    description: >-
      Manage processing pipelines that contain ordered sequences of functions
      for transforming, filtering, and enriching events.
  - name: Routes
    description: >-
      Manage routes that filter and direct incoming data across pipelines and
      destinations using filter expressions.
  - name: Sources
    description: >-
      Manage data input sources that collect events from various systems
      including Syslog, HTTP, Kafka, Splunk, and other protocols.
  - name: System
    description: >-
      Access system-level settings including Git configuration, licensing,
      and global preferences.
  - name: Versioning
    description: >-
      Manage configuration versions, commits, and deployment history.
security:
  - bearerAuth: []
paths:
  /auth/login:
    post:
      operationId: login
      summary: Authenticate and obtain a bearer token
      description: >-
        Authenticates with username and password credentials for on-premises
        deployments and returns a bearer token for subsequent API requests.
      tags:
        - Authentication
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - username
                - password
              properties:
                username:
                  type: string
                  description: The username for authentication
                password:
                  type: string
                  description: The password for authentication
                  format: password
      responses:
        '200':
          description: Successfully authenticated
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                    description: The bearer token for API access
        '401':
          description: Invalid credentials
  /health:
    get:
      operationId: getHealth
      summary: Check server health
      description: >-
        Returns the health status of the Cribl instance including version
        information and operational state.
      tags:
        - Health
      security: []
      responses:
        '200':
          description: Server is healthy
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthStatus'
  /system/sources:
    get:
      operationId: listSources
      summary: List all sources
      description: >-
        Retrieves a list of all configured data input sources in the current
        context, including their type, status, and configuration details.
      tags:
        - Sources
      responses:
        '200':
          description: Successfully retrieved sources
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Source'
                  count:
                    type: integer
                    description: Total number of sources
        '401':
          description: Unauthorized
    post:
      operationId: createSource
      summary: Create a new source
      description: >-
        Creates a new data input source with the specified type and
        configuration. The source type determines which configuration
        properties are required.
      tags:
        - Sources
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Source'
      responses:
        '200':
          description: Source created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
  /system/sources/{id}:
    get:
      operationId: getSource
      summary: Get a source by ID
      description: >-
        Retrieves the configuration and status of a specific data input
        source identified by its unique ID.
      tags:
        - Sources
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved source
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '401':
          description: Unauthorized
        '404':
          description: Source not found
    patch:
      operationId: updateSource
      summary: Update a source
      description: >-
        Updates the configuration of an existing data input source. Only
        provided fields are modified.
      tags:
        - Sources
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Source'
      responses:
        '200':
          description: Source updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Source'
        '400':
          description: Invalid source configuration
        '401':
          description: Unauthorized
        '404':
          description: Source not found
    delete:
      operationId: deleteSource
      summary: Delete a source
      description: >-
        Deletes a data input source by its unique ID. The source must not
        be actively receiving data.
      tags:
        - Sources
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Source deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Source not found
  /system/outputs:
    get:
      operationId: listDestinations
      summary: List all destinations
      description: >-
        Retrieves a list of all configured data output destinations
        including their type, status, and configuration.
      tags:
        - Destinations
      responses:
        '200':
          description: Successfully retrieved destinations
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Destination'
                  count:
                    type: integer
                    description: Total number of destinations
        '401':
          description: Unauthorized
    post:
      operationId: createDestination
      summary: Create a new destination
      description: >-
        Creates a new data output destination with the specified type and
        configuration. The destination type determines which configuration
        properties are required.
      tags:
        - Destinations
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Destination'
      responses:
        '200':
          description: Destination created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Destination'
        '400':
          description: Invalid destination configuration
        '401':
          description: Unauthorized
  /system/outputs/{id}:
    get:
      operationId: getDestination
      summary: Get a destination by ID
      description: >-
        Retrieves the configuration and status of a specific data output
        destination identified by its unique ID.
      tags:
        - Destinations
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved destination
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Destination'
        '401':
          description: Unauthorized
        '404':
          description: Destination not found
    patch:
      operationId: updateDestination
      summary: Update a destination
      description: >-
        Updates the configuration of an existing data output destination.
        Only provided fields are modified.
      tags:
        - Destinations
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Destination'
      responses:
        '200':
          description: Destination updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Destination'
        '400':
          description: Invalid destination configuration
        '401':
          description: Unauthorized
        '404':
          description: Destination not found
    delete:
      operationId: deleteDestination
      summary: Delete a destination
      description: >-
        Deletes a data output destination by its unique ID.
      tags:
        - Destinations
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Destination deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Destination not found
  /system/outputs/{id}/statuses:
    get:
      operationId: getDestinationStatus
      summary: Get destination status
      description: >-
        Retrieves the current operational status of a specific destination
        including throughput metrics and error counts.
      tags:
        - Destinations
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved destination status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DestinationStatus'
        '401':
          description: Unauthorized
        '404':
          description: Destination not found
  /pipelines:
    get:
      operationId: listPipelines
      summary: List all pipelines
      description: >-
        Retrieves a list of all configured processing pipelines including
        their functions, configuration, and status.
      tags:
        - Pipelines
      responses:
        '200':
          description: Successfully retrieved pipelines
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Pipeline'
                  count:
                    type: integer
                    description: Total number of pipelines
        '401':
          description: Unauthorized
    post:
      operationId: createPipeline
      summary: Create a new pipeline
      description: >-
        Creates a new processing pipeline with the specified functions and
        configuration. Pipelines define ordered sequences of functions for
        data transformation.
      tags:
        - Pipelines
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Pipeline'
      responses:
        '200':
          description: Pipeline created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pipeline'
        '400':
          description: Invalid pipeline configuration
        '401':
          description: Unauthorized
  /pipelines/{id}:
    get:
      operationId: getPipeline
      summary: Get a pipeline by ID
      description: >-
        Retrieves the configuration of a specific processing pipeline
        including its functions and metadata.
      tags:
        - Pipelines
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved pipeline
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pipeline'
        '401':
          description: Unauthorized
        '404':
          description: Pipeline not found
    patch:
      operationId: updatePipeline
      summary: Update a pipeline
      description: >-
        Updates the configuration of an existing processing pipeline
        including its functions and settings.
      tags:
        - Pipelines
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Pipeline'
      responses:
        '200':
          description: Pipeline updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Pipeline'
        '400':
          description: Invalid pipeline configuration
        '401':
          description: Unauthorized
        '404':
          description: Pipeline not found
    delete:
      operationId: deletePipeline
      summary: Delete a pipeline
      description: >-
        Deletes a processing pipeline by its unique ID. The pipeline must
        not be referenced by any active routes.
      tags:
        - Pipelines
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Pipeline deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Pipeline not found
  /routes:
    get:
      operationId: listRoutes
      summary: List all routes
      description: >-
        Retrieves a list of all configured routes that filter and direct
        incoming data to the appropriate pipelines and destinations.
      tags:
        - Routes
      responses:
        '200':
          description: Successfully retrieved routes
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Route'
                  count:
                    type: integer
                    description: Total number of routes
        '401':
          description: Unauthorized
    post:
      operationId: createRoute
      summary: Create a new route
      description: >-
        Creates a new route with filter expressions to direct matching
        events to specified pipelines and destinations.
      tags:
        - Routes
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Route'
      responses:
        '200':
          description: Route created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Route'
        '400':
          description: Invalid route configuration
        '401':
          description: Unauthorized
  /routes/{id}:
    get:
      operationId: getRoute
      summary: Get a route by ID
      description: >-
        Retrieves the configuration of a specific route including its
        filter expression, pipeline, and destination assignments.
      tags:
        - Routes
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved route
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Route'
        '401':
          description: Unauthorized
        '404':
          description: Route not found
    patch:
      operationId: updateRoute
      summary: Update a route
      description: >-
        Updates the configuration of an existing route including its
        filter expression and pipeline assignments.
      tags:
        - Routes
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Route'
      responses:
        '200':
          description: Route updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Route'
        '400':
          description: Invalid route configuration
        '401':
          description: Unauthorized
        '404':
          description: Route not found
    delete:
      operationId: deleteRoute
      summary: Delete a route
      description: >-
        Deletes a route by its unique ID.
      tags:
        - Routes
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Route deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Route not found
  /system/functions:
    get:
      operationId: listFunctions
      summary: List available functions
      description: >-
        Retrieves a list of all available processing functions that can be
        used within pipelines for data transformation, filtering,
        enrichment, and routing.
      tags:
        - Functions
      responses:
        '200':
          description: Successfully retrieved functions
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Function'
                  count:
                    type: integer
                    description: Total number of functions
        '401':
          description: Unauthorized
  /system/functions/{id}:
    get:
      operationId: getFunction
      summary: Get a function by ID
      description: >-
        Retrieves the details of a specific processing function including
        its configuration schema and description.
      tags:
        - Functions
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved function
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Function'
        '401':
          description: Unauthorized
        '404':
          description: Function not found
  /master/groups:
    get:
      operationId: listGroups
      summary: List all worker groups and fleets
      description: >-
        Retrieves a list of all worker groups and edge fleets configured
        in the Cribl instance, including their deployment status and
        node counts.
      tags:
        - Groups
      responses:
        '200':
          description: Successfully retrieved groups
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Group'
                  count:
                    type: integer
                    description: Total number of groups
        '401':
          description: Unauthorized
    post:
      operationId: createGroup
      summary: Create a new worker group or fleet
      description: >-
        Creates a new worker group or edge fleet with the specified
        configuration. Groups organize worker nodes and allow shared
        configuration deployment.
      tags:
        - Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Group'
      responses:
        '200':
          description: Group created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '400':
          description: Invalid group configuration
        '401':
          description: Unauthorized
  /master/groups/{id}:
    get:
      operationId: getGroup
      summary: Get a group by ID
      description: >-
        Retrieves the configuration and status of a specific worker group
        or edge fleet including its nodes and deployment state.
      tags:
        - Groups
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '401':
          description: Unauthorized
        '404':
          description: Group not found
    patch:
      operationId: updateGroup
      summary: Update a group
      description: >-
        Updates the configuration of an existing worker group or edge
        fleet.
      tags:
        - Groups
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Group'
      responses:
        '200':
          description: Group updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '400':
          description: Invalid group configuration
        '401':
          description: Unauthorized
        '404':
          description: Group not found
    delete:
      operationId: deleteGroup
      summary: Delete a group
      description: >-
        Deletes a worker group or edge fleet by its unique ID.
      tags:
        - Groups
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Group deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Group not found
  /master/groups/{id}/deploy:
    post:
      operationId: deployGroup
      summary: Deploy configuration to a group
      description: >-
        Deploys the current configuration to all worker nodes or edge
        agents in the specified group or fleet.
      tags:
        - Groups
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Deployment initiated successfully
        '401':
          description: Unauthorized
        '404':
          description: Group not found
  /master/workers:
    get:
      operationId: listNodes
      summary: List all worker and edge nodes
      description: >-
        Retrieves a list of all connected worker nodes and edge nodes
        including their status, version, and resource utilization.
      tags:
        - Nodes
      responses:
        '200':
          description: Successfully retrieved nodes
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Node'
                  count:
                    type: integer
                    description: Total number of nodes
        '401':
          description: Unauthorized
  /master/workers/{id}:
    get:
      operationId: getNode
      summary: Get a node by ID
      description: >-
        Retrieves the status and details of a specific worker or edge
        node identified by its node ID.
      tags:
        - Nodes
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved node
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Node'
        '401':
          description: Unauthorized
        '404':
          description: Node not found
  /master/workers/{id}/restart:
    post:
      operationId: restartNode
      summary: Restart a node
      description: >-
        Initiates a restart of the specified worker or edge node.
      tags:
        - Nodes
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Restart initiated successfully
        '401':
          description: Unauthorized
        '404':
          description: Node not found
  /master/workers/count:
    get:
      operationId: getNodeCount
      summary: Get node count
      description: >-
        Returns the total count of connected worker and edge nodes.
      tags:
        - Nodes
      responses:
        '200':
          description: Successfully retrieved node count
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: integer
                    description: Total number of connected nodes
        '401':
          description: Unauthorized
  /system/collectors:
    get:
      operationId: listCollectors
      summary: List all collectors
      description: >-
        Retrieves a list of all configured data collectors including
        REST API collectors, database collectors, and script collectors.
      tags:
        - Collectors
      responses:
        '200':
          description: Successfully retrieved collectors
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Collector'
                  count:
                    type: integer
                    description: Total number of collectors
        '401':
          description: Unauthorized
    post:
      operationId: createCollector
      summary: Create a new collector
      description: >-
        Creates a new data collector with the specified type, schedule,
        and configuration for automated data collection.
      tags:
        - Collectors
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Collector'
      responses:
        '200':
          description: Collector created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Collector'
        '400':
          description: Invalid collector configuration
        '401':
          description: Unauthorized
  /system/collectors/{id}:
    get:
      operationId: getCollector
      summary: Get a collector by ID
      description: >-
        Retrieves the configuration and status of a specific data
        collector identified by its unique ID.
      tags:
        - Collectors
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved collector
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Collector'
        '401':
          description: Unauthorized
        '404':
          description: Collector not found
    patch:
      operationId: updateCollector
      summary: Update a collector
      description: >-
        Updates the configuration of an existing data collector.
      tags:
        - Collectors
      parameters:
        - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Collector'
      responses:
        '200':
          description: Collector updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Collector'
        '400':
          description: Invalid collector configuration
        '401':
          description: Unauthorized
        '404':
          description: Collector not found
    delete:
      operationId: deleteCollector
      summary: Delete a collector
      description: >-
        Deletes a data collector by its unique ID.
      tags:
        - Collectors
      parameters:
        - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Collector deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Collector not found
  /jobs:
    get:
      operationId: listJobs
      summary: List all jobs
      description: >-
        Retrieves a list of all running and comp

# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cribl/refs/heads/main/openapi/cribl-cloud-api-openapi.yml