Skip to main content
Splunk Cloud Platform

Admin Config Service Manual

Splunk Cloud Platform™
9.1.2308

Admin Config Service (ACS) API endpoint reference

Use the ACS API endpoint reference to learn about the endpoints and operations that provide programmatic self-service administration for Splunk Cloud Platform.

You must have the sc_admin (Splunk Cloud Platform Administrator) role to use the ACS API.

For more information on ACS API requirements, see ACS requirements and compatibility matrix.

For information on ACS API setup and usage, see Basic setup and usage concepts for the ACS API.

ACS endpoint categories

ACS API endpoints are grouped into the following categories based on feature use case:

Feature Endpoints
Configure IP allow lists access/{feature}/ipallowlists

Configure outbound ports access/outbound-ports

access/outbound-ports/{port}

Enable private connectivity private-connectivity/eligibility

private-connectivity/endpoints

Export apps

apps/victoria/download/{app_id}

Manage app permissions permissions/apps

permissions/apps/{app-name}

Manage authentication tokens tokens

tokens/{tokenID}

Manage DDSS self storage locations cloud-resources/self-storage-locations/buckets

cloud-resources/self-storage-locations/buckets/{bucketPath}
cloud-resources/self-storage-locations/configs/prefix
cloud-resources/self-storage-locations/buckets/{bucketName}/policy
cloud-resources/self-storage-locations/configs/service-accounts

Manage HTTP Event Collector (HEC) tokens inputs/http-event-collectors

inputs/http-event-collectors/{hec-token-name}

Manage indexes indexes

indexes/{name}

Manage limits.conf configurations limits

limits/{stanza}
limits/{stanza}/{setting}
limits/{stanza}/{reset}

Manage maintenance windows maintenance-windows/preferences
maintenance-windows/schedules
maintenance-windows/schedules/{scheduleID}
maintenance-windows/schedules/{scheduleID}/audits
Manage private apps and Splunkbase apps (Victoria Experience) apps/victoria

apps/victoria/{app_name}

Manage private apps and Splunkbase apps (Classic Experience) apps
apps/{app_name}
Manage Python version

python-runtime

Manage restarts restart-now
restart/status
Provision Enterprise Managed Encryption Keys (EMEK) emek/waiver
emek/key-policy
emek/key
Retry failed operations deployment/status
deployment/retry
deployment/status/{deploymentID}
Unified Identity for Splunk Observability Cloud observability/sso-pairing
observability/sso-pairing/{pairing-id}

Authentication and authorization

The ACS API requires a JSON Web Token (JWT) for authentication. You can create this token in the Splunk Cloud Platform UI or using the ACS API. For more information see Create an authentication token.

In addition, a user's role must contain the capabilities required to access the ACS API endpoint. The sc_admin role has all required capabilities by default. For more information on using Splunk Cloud Platform role-based access controls with ACS, see Manage ACS API access with capabilities.


Configure IP allowlists

The ACS API provides the following endpoints to configure IP allowlists. For more information on how to configure IP allowlists using the ACS API, see Configure IP allowlists for Splunk Cloud Platform.

access/{feature}/ipallowlists

https://admin.splunk.com/{stack}/adminconfig/v2/access/{feature}/ipallowlists

List, update, and delete IP allow lists.


GET

Expand

List subnets on the existing IP allow list for a feature.

POST

Expand

Add subnets to the IP allow list for a feature.

DELETE

Expand

Delete subnets from the IP allow list for a feature


Configure outbound ports

access/outbound-ports

https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports

List and create outbound ports.


GET

Expand

List existing outbound ports.

POST

Expand

Create an outbound port.


access/outbound-ports/{port}

https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/{port}

Describe and delete outbound ports.


GET

Expand

Describe an outbound port.

DELETE

Expand

Delete an outbound port.



Export apps

apps/victoria/export/download/{app_id}

https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/export/download/{app_id}

Export an individual app.


GET

Expand

Export data from app/default, app/local, and user/app directories.


Manage app permissions

permissions/apps

https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps

List app permissions.

GET

Expand

List read and write permissions assigned to roles for all apps.


permissions/apps/{app-name}

https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps/{app-name}

View and configure read and write permissions for individual apps.

GET

Expand

View read and write permissions assigned to roles for an individual app.


PATCH

Expand

Assign read and write permissions to roles for an individual app.


Manage DDSS storage locations

cloud-resources/self-storage-locations/buckets

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets

List self storage locations.


GET

Expand

List existing self storage locations.


POST

Expand

Configure self storage locations in AWS or GCP.




cloud-resources/self-storage-locations/buckets/{bucketPath}

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets/{bucketPath}

Describe self storage locations.


GET

Expand

Describe a self storage location.




cloud-resources/self-storage-locations/configs/prefix

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/configs/prefix

Get prefix to configure a bucket.


GET

Expand

Get prefix to configure a bucket.




cloud-resources/self-storage-locations/buckets/{bucketName}/policy

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets/{bucketName}/policy

Get IAM policy for AWS S3 bucket.


GET

Expand

Get IAM policy for AWS S3 bucket.




cloud-resources/self-storage-locations/configs/service-accounts

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/configs/service-accounts

Get service accounts for GCP GCS bucket.


GET

Expand

Get service accounts for GCP GCS bucket.


Manage authentication tokens

tokens

https://admin.splunk.com/{stack}/adminconfig/v2/tokens

View and create JWT authentication tokens.


GET

Expand

View existing JWT tokens.

POST

Expand

Create a new token.


tokens/{id}

https://admin.splunk.com/{stack}/adminconfig/v2/access/tokens/{id}

View and delete individual tokens.


GET

Expand

View a token.

DELETE

Expand

Delete a token.


Manage HTTP Event Collector (HEC) tokens

The ACS API provides the following endpoints to manage HEC tokens. For more information on how to manage HEC tokens using the ACS API, see Manage HTTP Event Collector (HEC) tokens in Splunk Cloud Platform.

ACS endpoints for HEC token management apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

inputs/http-event-collectors

https://admin.splunk.com/{stack}/adminconfig/v2/inputs/http-event-collectors

List and create HEC tokens.


GET

Expand

List existing HEC tokens.

POST

Expand

Create a new HEC token.


inputs/http-event-collectors/{hec-token-name}

https://admin.splunk.com/{stack}/adminconfig/v2/inputs/http-event-collectors/{hec-token-name}

View, update, and delete HEC tokens.


GET

Expand

View an inidvidual HEC token.

PUT

Expand

Update an existing HEC token.

DELETE

Expand

Delete an HEC token.


Manage indexes

The ACS API provides the following endpoints to manage indexes. For more information on how to manage indexes using the ACS API, see Manage indexes in Splunk Cloud Platform.

ACS supports index management on Splunk Cloud Platform deployments on both Victoria Experience and Classic Experience.

indexes

https://admin.splunk.com/{stack}/adminconfig/v2/indexes

List and create indexes.


GET

Expand

List existing indexes.

POST

Expand

Create a new index.


indexes/{name}

https://admin.splunk.com/{stack}/adminconfig/v2/indexes/{name}

View, update, and delete indexes.


GET

Expand

View an individual index.

PATCH

Expand

Update an existing index.

DELETE

Expand

Delete an index.


Manage limits.conf configurations

The ACS API provides the following endpoints to manage limits.conf configurations. ACS API operations apply to a subset of editable limits.conf settings only. For more information on how to manage limits.conf configurations using the ACS API, see Manage limits.conf configurations in Splunk Cloud Platform.

ACS endpoints for managing limits.conf apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

limits

https://admin.splunk.com/{stack}/adminconfig/v2/limits

List all limits.conf settings.


GET

Expand

List all limits.conf settings.


limits/{stanza}

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}

List and edit limits.conf settings under a stanza.


GET

Expand

List limits.conf settings under a stanza.

POST

Expand

Edit limits.conf settings.


limits/{stanza}/{setting}

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}/{setting}

List a specific limits.conf setting under a stanza.


GET

Expand

List a specific limits.conf setting under a stanza.


limits/defaults

https://admin.splunk.com/{stack}/adminconfig/v2/limits/defaults

List all supported stanzas and default values for all settings within each stanza.


GET

Expand

List all supported limits.conf stanzas and default settings.


limits/{stanza}/defaults

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}/defaults

List default values for settings in a specific stanza.


GET

Expand

List default values for settings in a specific limits.conf stanza


limits/{stanza}/reset

https://admin.splunk.com/{stack}/adminconfig/v2/access/limits/{stanza}/reset

Reset a specific setting or all settings under a stanza.


POST

Expand

Reset a specific setting or all settings under a stanza


Manage maintenance windows

maintenance-windows/preferences

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/preferences

Manage maintenance window change freeze requests. For more information on how to manage change freezes using the ACS API, see Manage maintenance window preferences.


GET

Expand

List maintenance window change freezes.

PUT

Expand

Update, create, delete maintenance window change freezes.


maintenance-windows/schedules

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules

List maintenance windows.


GET

Expand

List multiple scheduled maintenance windows.


maintenance-windows/schedules/{scheduleId}

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}

Describe individual maintenance windows.


GET

Expand

Describe a specific scheduled maintenance window.


maintenance-windows/schedules/{scheduleId}/audits

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}/audits

Audit maintenance windows.


GET

Expand

View audit trail of a specified maintenance window.


Manage private apps and Splunkbase apps (Victoria Experience)

The ACS API provides the following endpoints to manage private apps and Splunkbase apps. For more information on how to manage private apps using the ACS API, see Manage private apps in Splunk Cloud Platform. For more information on how to manage Splunkbase apps using the ACS API, see Manage Splunkbase apps in Splunk Cloud Platform

The following ACS endpoints for managing private apps and Splunkbase apps apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

apps/victoria

https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria

List and install apps (Victoria Experience).

Authentication and authorization

  • All GET and POST operations for this endpoint require a JWT authentication token.
  • POST operations to install private apps also require an AppInspect authentication token and a legal acknowledgement that you accept risk for unsupported apps. For more information, see Manage private apps using the ACS API on Victoria Experience.
  • POST operations to install Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Manage Splunkbase apps using the ACS API.

GET

Expand

List apps.

POST

Expand

Install an app.


apps/victoria/{app_name}

https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/{app_name}

Describe and uninstall apps. Upgrade or downgrade Splunkbase apps. (Victoria Experience)

Authentication and authorization

  • All GET, PATCH, and DELETE operations for this endpoint require a JWT authentication token.
  • PATCH operations to upgrade or downgrade Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Manage Splunkbase apps using the ACS API.

GET

Expand

Describe an app.

PATCH

Expand

Upgrade or downgrade a Splunkbase app.

DELETE

Expand

Uninstall an app.


Manage private apps and Splunkbase apps (Classic Experience)

apps

https://admin.splunk.com/{stack}/adminconfig/v2/apps

List and install apps (Classic Experience).

Authentication and authorization


GET

Expand

List apps.

POST

Expand

Install an app.


apps/{app_name}

https://admin.splunk.com/{stack}/adminconfig/v2/apps/{app_name}

Describe, upgrade, and uninstall apps (Classic Experience).

Authentication and authorization

  • All GET, PATCH, and DELETE operations for this endpoint require a JWT authentication token.
  • PATCH operations to upgrade or downgrade Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Upgrade a Splunkbase app on Classic Experience.

GET

Expand

Describe an app.


PATCH

Expand

Upgrade a Splunkbase app.

DELETE

Expand

Uninstall an app.


Manage Python version

python-runtime

https://admin.splunk.com/{stack}/adminconfig/v2/python-runtime

Manage Python version in Splunk Cloud Platform.

GET

Expand

Check Python runtime version.

POST

Expand

Change Python runtime version.


Manage restarts

For instructions on how to target a specific search head or search head cluster for restart operations, see Target a specific search head for ACS operations.

restart-now

https://admin.splunk.com/{stack}/adminconfig/v2/restart-now

Initiate a restart of the search head tier in Splunk Cloud Platform.

POST

Expand

Initiate a restart of a single search head or a rolling restart of a search head cluster.


restart/status

https://admin.splunk.com/{stack}/adminconfig/v2/restart/status

Check status of search head cluster rolling restart.

The restart/status endpoint applies to search head cluster rolling restarts only. The endpoint does not work with non-clustered search heads.


GET

Expand

Check status of search head cluster rolling restart.


Provision Enterprise Managed Encryption Keys (EMEK)

emek/waiver

https://admin.splunk.com/{stack}/adminconfig/v2/emek/waiver

View EMEK legal disclaimer.


GET

Expand

View legal disclaimer.


emek/key-policy

https://admin.splunk.com/{stack}/adminconfig/v2/emek/key-policy

Generate a KMS key policy for your deployment.

Authentication and authorization

  • You must specify Y in the EMEK-Legal-Ack header to acknowledge acceptance of any risks involved in using EMEK.


GET

Expand

Get KMS key policy


emek/key

https://admin.splunk.com/{stack}/adminconfig/v2/emek/key

Upload KMS key to Splunk Cloud Platform.

Authentication and authorization

  • You must specify Y in the EMEK-Legal-Ack header to acknowledge acceptance of any risks involved in using EMEK.


PUT

Expand

Upload KMS key


Retry failed operations

deployment/status

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status

Check the status of the latest operation in Splunk Cloud Platform.


GET

Expand

Check the status of the latest operation in Splunk Cloud Platform


deployment/retry

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/retry

Retry a failed operation in Splunk Cloud Platform.

ACS supports retry for private app installation and HEC token management operations only

POST

Expand

Retry a failed private app installation or HEC token management operation.


deployment/status/{deploymentID}

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status/{deploymentID}

Check the status of an operation in Splunk Cloud Platform.


GET

Expand

Check the status of a retry or other operation by deployment ID in Splunk Cloud Platform.


Unified Identify for Splunk Observability Cloud

ovservability/sso-pairing

https://admin.splunk.com/{stack}/adminconfig/v2/observability/sso-pairing

Set up Unified Identity for Splunk Observability Cloud and Splunk Cloud Platform.

POST

Expand

Pair your Observability organization with your Splunk Cloud stack.


observability/sso-pairing/{pairing-id}

https://admin.splunk.com/{stack}/adminconfig/v2/observability/sso-pairing/{pairing-id}

Check the pairing status of Splunk Observability Cloud and Splunk Cloud Platform.

GET

Expand

Get the pairing status of a Splunk Observability Cloud organization and Splunk Cloud Platform stack.


Last modified on 19 November, 2024
Manage maintenance windows for Splunk Cloud Platform   Administer Splunk Cloud Platform using the ACS CLI

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release), 9.3.2408


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters