Create a SIEM destination

POST

/siem/destinations

const url = 'http://localhost:8000/siem/destinations';
const options = {
  method: 'POST',
  headers: {
    'API-Version': '2026-06-01.beta',
    'API-Key': '<API-Key>',
    'Content-Type': 'application/json'
  },
  body: '{"name":"example","enabled":true,"type":"syslog","source":{"type":"keycloak_events","cluster_ids":["2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"],"realms":["customer-portal"],"keycloak_event_types":["example"]},"batch":{"max_events":1000,"max_interval_seconds":60},"syslog":{"host":"example","port":1,"protocol":"udp","format":"cef"},"s3":{"bucket":"example","region":"example","prefix":"example","auth_type":"access_key","access_key_id":"example","secret_access_key":"example","role_arn":"example","external_id":"example"},"http":{"url":"https://example.com","headers":{"additionalProperty":"example"},"auth_type":"none","bearer_token":"example","username":"example","password":"example","workspace_id":"example","shared_key":"example"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:8000/siem/destinations \
  --header 'API-Key: <API-Key>' \
  --header 'API-Version: 2026-06-01.beta' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "enabled": true, "type": "syslog", "source": { "type": "keycloak_events", "cluster_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "realms": [ "customer-portal" ], "keycloak_event_types": [ "example" ] }, "batch": { "max_events": 1000, "max_interval_seconds": 60 }, "syslog": { "host": "example", "port": 1, "protocol": "udp", "format": "cef" }, "s3": { "bucket": "example", "region": "example", "prefix": "example", "auth_type": "access_key", "access_key_id": "example", "secret_access_key": "example", "role_arn": "example", "external_id": "example" }, "http": { "url": "https://example.com", "headers": { "additionalProperty": "example" }, "auth_type": "none", "bearer_token": "example", "username": "example", "password": "example", "workspace_id": "example", "shared_key": "example" } }'

Creates a SIEM destination for the workspace. Credentials are write-only and are never returned.

Required scope: siem:write

Authorizations

ApiKeyAuth

Parameters

Header Parameters

API-Version

required

string

Allowed values: 2026-06-01.beta

Request Body^required

application/json

object

name

required

string

>= 1 characters <= 255 characters

enabled

boolean

default: true

type

required

External SIEM destination type.

string

Allowed values: syslog s3 http

source

required

object

type

required

Workspace data stream forwarded to the destination.

string

Allowed values: keycloak_events application_logs security_logs skycloak_audit

cluster_ids

Cluster IDs to include. Omit to include all clusters in the workspace.

Array<string>

>= 1 items

realms

Realm names to include. Omit to include all realms in the selected clusters.

Array<string>

keycloak_event_types

Keycloak event type codes to include. Required when type is keycloak_events; rejected for other source types.

Array<string>

>= 1 items

batch

object

max_events

integer

>= 1 <= 1000

max_interval_seconds

integer

>= 10 <= 600

syslog

object

host

required

string

port

required

integer

>= 1 <= 65535

protocol

required

string

Allowed values: udp tcp tls

format

required

string

Allowed values: cef leef rfc5424 json

object

bucket

required

string

>= 3 characters <= 63 characters

region

required

string

>= 1 characters <= 50 characters

prefix

string

<= 500 characters

auth_type

required

string

Allowed values: access_key iam_role assume_role irsa

access_key_id

Required when auth_type is access_key. Write-only.

string format: password

secret_access_key

Required when auth_type is access_key. Write-only.

string format: password

role_arn

Required when auth_type is assume_role.

string

<= 500 characters

external_id

string

<= 255 characters

http

object

url

required

Webhook endpoint that receives the exported events. Must be a complete https:// URL with a host; plain http:// endpoints and characters that are illegal in a URI (<, >, ", spaces) are rejected on create and update.

string format: uri

<= 1000 characters

headers

Optional HTTP headers to include in the request. Every value must be a string, a non-string value (boolean, number, object or array) is rejected. Values are write-only and are never returned.

object

key

additional properties

string

auth_type

required

string

Allowed values: none bearer basic shared_key

bearer_token

Required when auth_type is bearer. Write-only. The token is sent verbatim as an Authorization: Bearer header value, so it is limited to RFC 6750 token68 characters (letters, digits and -._~+/=) and 4096 characters. A token outside that set is rejected with a 422 validation error.

string format: password

<= 4096 characters /^[A-Za-z0-9\-._~+/=]+$/

username

Required when auth_type is basic. Write-only.

string

password

Required when auth_type is basic. Write-only.

string format: password

workspace_id

Azure Log Analytics workspace ID. Required when auth_type is shared_key.

string

<= 255 characters

shared_key

Base64-encoded Azure Log Analytics primary or secondary key. Required when auth_type is shared_key. Write-only.

string format: password

Responses

201

The request has succeeded and a new resource has been created as a result.

application/json

Saved SIEM forwarding destination for a workspace.

object

required

string format: uuid

name

required

string

>= 1 characters <= 255 characters

enabled

required

boolean

type

required

External SIEM destination type.

string

Allowed values: syslog s3 http

source

required

object

type

required

Workspace data stream forwarded to the destination.

string

Allowed values: keycloak_events application_logs security_logs skycloak_audit

cluster_ids

Cluster IDs to include. Omit to include all clusters in the workspace.

Array<string>

>= 1 items

realms

Realm names to include. Omit to include all realms in the selected clusters.

Array<string>

keycloak_event_types

Keycloak event type codes to include. Required when type is keycloak_events; rejected for other source types.

Array<string>

>= 1 items

batch

required

object

max_events

integer

>= 1 <= 1000

max_interval_seconds

integer

>= 10 <= 600

syslog

object

host

required

string

port

required

integer

>= 1 <= 65535

protocol

required

string

Allowed values: udp tcp tls

format

required

string

Allowed values: cef leef rfc5424 json

object

bucket

required

string

region

required

string

prefix

string

auth_type

required

string

Allowed values: access_key iam_role assume_role irsa

role_arn

string

external_id

string

has_access_key_secret

required

boolean

http

object

url

required

string

auth_type

required

string

Allowed values: none bearer basic shared_key

header_names

required

Array<string>

has_auth_credentials

required

boolean

workspace_id

Azure Log Analytics workspace ID. Present when auth_type is shared_key.

string

health_status

required

string

Allowed values: healthy degraded failed

failure_count

required

integer

last_error

string

last_sent_at

string format: date-time

total_events_sent

required

integer format: int64

total_logs_sent

required

integer format: int64

total_bytes_sent

required

integer format: int64

created_at

required

string format: date-time

updated_at

required

string format: date-time

Example

{
  "type": "syslog",
  "source": {
    "type": "keycloak_events",
    "realms": [
      "customer-portal"
    ]
  },
  "batch": {
    "max_events": 1000,
    "max_interval_seconds": 60
  },
  "syslog": {
    "protocol": "udp",
    "format": "cef"
  },
  "s3": {
    "auth_type": "access_key"
  },
  "http": {
    "auth_type": "none"
  },
  "health_status": "healthy"
}

400

The server could not understand the request due to invalid syntax.

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

401

Access is unauthorized.

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

402

Client error

application/problem+json

Returned when a workspace plan quota would be exceeded. required_plan indicates the minimum plan needed to complete the request.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

current_plan

required

string

required_plan

required

string

code

Machine-readable identifier of the quota that was hit, so a client can tell quotas apart without parsing detail. Known values include cluster_limit (the workspace’s total cluster allowance), cluster_size_quota (the allowance for the requested cluster size) and cluster_size (the requested size is not offered on the plan at all). New values may be added.

string

current_usage

How many of the resource the workspace currently has.

integer

current_limit

Maximum allowed by the current plan. 0 means the plan does not include the resource at all.

integer

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com",
  "current_plan": "example",
  "required_plan": "example",
  "code": "example",
  "current_usage": 1,
  "current_limit": 1
}

403

Access is forbidden.

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

404

The server cannot find the requested resource.

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

422

Client error

application/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

errors

required

Array<object>

>= 1 items

object

field

required

string

detail

required

string

code

string

value

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com",
  "errors": [
    {
      "field": "example",
      "detail": "example",
      "code": "example",
      "value": "example"
    }
  ]
}

429

Client error

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

Headers

Retry-After

integer

RateLimit-Limit

integer

RateLimit-Remaining

integer

RateLimit-Reset

integer

X-RateLimit-Limit-Second

integer

X-RateLimit-Remaining-Second

integer

X-RateLimit-Limit-Minute

integer

X-RateLimit-Remaining-Minute

integer

X-RateLimit-Limit-Hour

integer

X-RateLimit-Remaining-Hour

integer

X-RateLimit-Limit-Day

integer

X-RateLimit-Remaining-Day

integer

500

Server error

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

501

Server error

application/problem+json

RFC 9457 Problem Details object.

object

type

required

string format: uri

title

required

string

status

required

integer

detail

required

string

instance

string format: uri

Example ^generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

Create a SIEM destination

Authorizations

Parameters

Header Parameters

Request Bodyrequired

Responses

201

Example

400

Example generated

401

Example generated

402

Example generated

403

Example generated

404

Example generated

422

Example generated

429

Example generated

Headers

500

Example generated

501

Example generated

Request Body^required

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated