Skip to content

List SIEM destinations

GET
/siem/destinations
curl --request GET \
  --url http://localhost:8000/siem/destinations \
  --header 'API-Key: <API-Key>' \
  --header 'API-Version: 2026-06-01.beta'

Returns SIEM destinations configured for the workspace.

Required scope: siem:read

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
API-Version
required
string
Allowed values: 2026-06-01.beta

Responses

Section titled “Responses”

200

Section titled “200”

The request has succeeded.

Media typeapplication/json
Array<object>

Saved SIEM forwarding destination for a workspace.

object
id
required
string format: uuid
name
required
string
>= 1 characters <= 255 characters
enabled
required
boolean
type
required

External SIEM destination type.

string
Allowed values: syslog s3 http
source
required
object
type
required

Workspace data stream forwarded to the destination.

string
Allowed values: keycloak_events application_logs security_logs skycloak_audit
cluster_ids

Cluster IDs to include. Omit to include all clusters in the workspace.

Array<string>
>= 1 items
realms

Realm names to include. Omit to include all realms in the selected clusters.

Array<string>
keycloak_event_types

Keycloak event type codes to include. Required when type is keycloak_events; rejected for other source types.

Array<string>
>= 1 items
batch
required
object
max_events
integer
>= 1 <= 1000
max_interval_seconds
integer
>= 10 <= 600
syslog
object
host
required
string
port
required
integer
>= 1 <= 65535
protocol
required
string
Allowed values: udp tcp tls
format
required
string
Allowed values: cef leef rfc5424 json
s3
object
bucket
required
string
region
required
string
prefix
string
auth_type
required
string
Allowed values: access_key iam_role assume_role irsa
role_arn
string
external_id
string
has_access_key_secret
required
boolean
http
object
url
required
string
auth_type
required
string
Allowed values: none bearer basic shared_key
header_names
required
Array<string>
has_auth_credentials
required
boolean
workspace_id

Azure Log Analytics workspace ID. Present when auth_type is shared_key.

string
health_status
required
string
Allowed values: healthy degraded failed
failure_count
required
integer
last_error
string
last_sent_at
string format: date-time
total_events_sent
required
integer format: int64
total_logs_sent
required
integer format: int64
total_bytes_sent
required
integer format: int64
created_at
required
string format: date-time
updated_at
required
string format: date-time

Example 

[
  {
    "type": "syslog",
    "source": {
      "type": "keycloak_events",
      "realms": [
        "customer-portal"
      ]
    },
    "batch": {
      "max_events": 1000,
      "max_interval_seconds": 60
    },
    "syslog": {
      "protocol": "udp",
      "format": "cef"
    },
    "s3": {
      "auth_type": "access_key"
    },
    "http": {
      "auth_type": "none"
    },
    "health_status": "healthy"
  }
]

401

Section titled “401”

Access is unauthorized.

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

403

Section titled “403”

Access is forbidden.

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

404

Section titled “404”

The server cannot find the requested resource.

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

429

Section titled “429”

Client error

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

Headers

Section titled “Headers”
Retry-After
integer
RateLimit-Limit
integer
RateLimit-Remaining
integer
RateLimit-Reset
integer
X-RateLimit-Limit-Second
integer
X-RateLimit-Remaining-Second
integer
X-RateLimit-Limit-Minute
integer
X-RateLimit-Remaining-Minute
integer
X-RateLimit-Limit-Hour
integer
X-RateLimit-Remaining-Hour
integer
X-RateLimit-Limit-Day
integer
X-RateLimit-Remaining-Day
integer

500

Section titled “500”

Server error

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}

501

Section titled “501”

Server error

Media typeapplication/problem+json

RFC 9457 Problem Details object.

object
type
required
string format: uri
title
required
string
status
required
integer
detail
required
string
instance
string format: uri

Example generated

{
  "type": "https://example.com",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "https://example.com"
}
© 2026 Skycloak. All Rights Reserved. Design by Yasser SolimanKeycloak™ is a trademark of the Linux Foundation. Skycloak is not affiliated with the Keycloak project.